7 Red Flags in a Vendor Bank-Change Request
The warning signs that a vendor's request to change bank details might be fraud, and the one move that catches all of them. For QuickBooks Online bookkeepers and AP teams.
Read the postBlog
Plain-English notes for bookkeepers and small CPA firms on the 2026 Nacha rules, vendor bank-change fraud, and the controls that hold up under review.
The warning signs that a vendor's request to change bank details might be fraud, and the one move that catches all of them. For QuickBooks Online bookkeepers and AP teams.
Read the postA step-by-step standard operating procedure for verifying vendor bank-account-change requests in a QuickBooks Online bookkeeping firm: the trigger, the out-of-band callback (with a script), what to record, and the approval gate.
Read the postHow vendor impersonation (BEC) fraud plays out against QuickBooks Online bookkeepers, the patterns to recognize, and the one out-of-band control that stops most of it.
Read the postA practical internal-controls checklist for small bookkeeping firms running client AP in QuickBooks Online: separating duties, vendor-payment verification, access, and audit trails.
Read the postWhat a defensible record of a vendor bank-change control actually contains, why a QBO memo or screenshot is not enough, how long to retain it, and what an auditor, insurer, or bank asks for under Nacha Phase 2.
Read the postA step-by-step guide for QBO bookkeepers: what to do in QuickBooks when a vendor says their bank changed, why you should not edit the vendor record until verified, how to verify out-of-band, what to record, and how to decide release or hold.
Read the postHow to verify a vendor banking change in QuickBooks Online using an out-of-band callback, and what evidence to retain so the control holds up under Nacha Phase 2.
Read the postA plain-English guide to Nacha's 2024 fraud-monitoring rule, the Phase 2 threshold removal on June 22, 2026, and what a documented vendor bank-change control looks like for a small QuickBooks Online shop.
Read the post