Alternatives to emailing bank details: portals, calls and holds

Email was never designed to carry instructions about money. It carries them anyway, because it is where the work already is, and every control in this area is an attempt to compensate for that.

If email is a poor channel for "here is where to send the payment", what are the alternatives, what do they actually fix, and what do they cost in friction? Some are better than most people expect. None removes the need for a human check, and the ones that claim to are the ones to look at hardest.

What to take away

Fix the details at the start of the relationship

The strongest option is also the least technical. Agree bank details once, at onboarding, through a channel you chose, and record that they are fixed for the life of the relationship.

Put it in the contract or the supplier setup form: payments go to these details, changes require a call to a named contact on a number recorded here, and no change will be accepted by email under any circumstances. Send the same statement to your own customers about your details, and put it on your invoices.

This does three things at once: it removes ambiguity about what a legitimate change process looks like, so an out-of-process request stands out on its own. It gives your accounts team a written basis for saying no without anyone's permission.

It makes the conversation happen while both sides are calm, not on the afternoon a payment is due.

The channels, compared

Read the middle column as the real content of the table. An alternative is only an improvement if the place the risk moves to is better defended than the place it left.

What each one is worth in practice

Portals. Genuinely useful, with one condition: you go to the portal the way you always go there, from your own bookmark, never from a link in a message telling you something needs updating. A portal reached through a message is not a second channel, it is the same channel with an extra step.

Bank-side verification. Ask your bank what it offers on outgoing payments and turn on what fits. The value depends on how you read the result. A partial match is the interesting case, because that is where real name variations and genuine problems both live, and a team that treats every partial match as fine has turned the feature off without changing the setting.

Signed documents. Weaker than they feel. The document proves a document exists. Its value is the trail it leaves and the pause it creates, not the signature, and it should never substitute for the call.

Voice as the second channel. Still the workhorse, and it survives everything above. The number has to be one you held before the request arrived, which means keeping a contacts list that is maintained rather than assembled during an emergency. Note that a voice you recognize is not by itself proof of identity, and this is why the number you dial matters more than the voice that answers.

Alternatives when you cannot verify

Sometimes the call will not connect. The named contact is unavailable, the supplier is in another time zone, the deadline is today. This is the exact moment the whole scheme is designed to survive, so decide it now rather than then.

Hold the payment. That is the alternative. Say so in advance, in writing, so that the accounts team knows holding is the approved outcome rather than a failure to complete a task.

A late payment costs a phone call and possibly a small charge. Both are recoverable, unlike a wire to the wrong account.

Where money has already moved, how quickly you report it decides whether any comes back. The United States Cybersecurity and Infrastructure Security Agency's pages on phishing and related fraud show where that report goes.

Two supporting options make holding easier to live with. Pay the old details rather than the new ones, since the previously verified account is the safer place for money if the change turns out to be genuine.

Agree an escalation path with one named person who can authorize an exception. The exception is a delay rather than a bypass.

What is not an alternative

A reply on the same email thread confirms nothing; whoever reads the thread will answer it. A phone number in the message, signature block, or attached invoice is the same channel again. A second message from a different address controlled by the same person adds nothing.

A colleague saying it looks fine is not an independent check unless they performed one.

A filtering product is not an alternative channel. It cuts how much arrives, which helps, but whatever gets through is what your process must handle.

The National Cyber Security Centre's collection on phishing scams makes the same point from the defending side: technical layers cut volume, the process decides the outcome. What tooling can and cannot reach is set out in best business email compromise software 2027.

Common questions

Is it rude to refuse an emailed change from a supplier we trust?

It is standard practice, and it protects both of you. A supplier whose mailbox has been taken over will be grateful for the call, and one who objects to a verification step on a payment change has told you something worth knowing. Say it as policy rather than suspicion.

Our customers email us their new details. What should we do?

Give them a defined route instead: a form, a portal, or a named phone number, published on your invoices and your website. Then follow the same verification you expect of others. The shapes these requests take are described in business email compromise.

Do these alternatives help against a supplier whose mailbox has been taken over?

Some of them, which is why they are worth the friction. Fixed details agreed at onboarding, a supplier portal change under the supplier's own login, and a call to a number you already held all continue to work in that case, while message inspection does not. What message inspection can and cannot show is covered in business email compromise features.

Should we tell suppliers what our own change process is?

Repeat it: state on every invoice that your bank details do not change. Add that any message claiming otherwise should be checked by phone on the number in the contract.

It costs one line. That removes a whole category of loss for people who pay you. The same idea underpins the staff habits in security compliance training.