A dental vendor bank details change should be treated as a controlled change to the payment destination, not as a routine edit requested by email. Authenticate the request through an independently established contact, obtain the required approval, and verify the saved destination before releasing a payment.
This workflow is separate from checking whether an invoice is legitimate. A real invoice can still be paid to a fraudulent account if the payee record is changed incorrectly.
Put the request on hold without losing it
Save the request in the practice's approved restricted workflow. Record the vendor identity, request date, affected account, claimed effective date, and the employee handling it. Avoid putting full bank details in an ordinary task board or meeting note.
Tell the payment preparer that the destination is under review. Identify invoices already queued, recurring instructions, and any file prepared for bank upload. Do not assume that editing the vendor master will also update or stop an existing payment file.
Use the invoice approval process to keep the obligation and due date visible while the destination is verified.
Reach the vendor through a separate trusted route
The FBI recommends verifying changes in account numbers and payment procedures with the person making the request. It also warns against using contact information supplied by a potential scammer. FBI business email compromise guidance
Use a previously established vendor contact or another independently verified official channel. A reply in the same email conversation is not independent confirmation.
Suggested opening:
We received a request to change payment instructions. Before we update our records, I need to confirm whether your authorized accounting team initiated it through our established verification process.
Follow the office's secure procedure for exchanging the actual details. Do not ask the caller to send passwords, login codes, or bank-account screenshots to a personal address.
Separate three decisions
The reviewer should distinguish:
- Is the request authentic?
- Is this person authorized to change the vendor's instructions?
- Does the requested change apply to this practice account and these invoices?
A legitimate employee might be discussing another branch or customer account. Record the scope and effective date, including whether older invoices should use the former destination.
If a vendor has been acquired or changed its legal entity, route the broader vendor-identity and tax-document questions to the appropriate financial reviewer. Do not resolve them by renaming an account field.
Control the actual edit
Have an authorized employee update only the approved fields. Preserve the previous record and the reason for change through the software's supported audit process.
A second reviewer should compare the saved destination with the verified instructions, check the effective date, and examine the next intended payment. In a small office where duties overlap, the owner should independently review the evidence before funds leave.
Keep the payment approval separate from the destination approval. Verifying an account does not authorize an invoice amount, rush fee, or newly requested advance.
Respond to a suspicious change
If the vendor denies the request, retain the evidence and notify the owner and designated security contact. Do not continue negotiating with the suspicious sender.
If funds may already have been sent, contact the financial institution immediately using its verified channel. The FBI also identifies IC3 as the reporting route for business email compromise. Do not promise that a transfer can be recovered.
Close the loop after payment
Check the actual transaction status and, through the verified vendor channel, resolve any claim that payment was not received. Preserve the confirmation reference without copying sensitive banking data into general records.
Include destination changes in the financial-control review. The useful audit question is not merely who edited the vendor, but whether an independent verification and an authorized payment can be reconstructed.
