FREE RESOURCE
Payment & Direct-Deposit Change Verification Checklist
Before changing where money is sent, use this checklist to independently verify payment, payroll, bank-account, and direct-deposit change requests.
Estimated time: 2–4 minutes · Cost: Free · Email required: No
Built for accounting, bookkeeping, payroll, and tax teams.
Verify Financial Changes Before Money Moves
Financial-change requests may look completely normal. They may appear to come from an employee, client, vendor, manager, partner, executive, payroll provider, financial institution, or another familiar business contact.
The employee does not need to decide whether the request is fraud. The employee needs a repeatable verification process before changing where money is sent.
NEW FINANCIAL INSTRUCTIONS = VERIFY
A familiar name or urgent message should not replace your firm's normal verification procedure.
Payment & Direct-Deposit Change Verification Checklist
Secure Team · secureteamtraining.com/resources/payment-direct-deposit-change-verification-checklist/
Before We Change Where Money Is Sent, Have We Independently Verified the Request?
A familiar name, realistic message, urgent request, or existing conversation should not replace the firm’s normal verification process.
What type of change are you reviewing?
Select the closest category. Do not enter account numbers, routing numbers, payment amounts, employee names, vendor names, client names, or actual financial instructions.
1. Pause Before Changing Financial Information
Urgency does not automatically mean fraud, but it should never replace normal verification.
2. Verify the Requester's Identity
Independent verification means using information or a communication method your firm already trusts.
3. Verify the New Payment or Deposit Instructions
The original message should not also be the only source used to verify the new instructions.
4. Look for Changes That Deserve Extra Verification
These factors do not prove fraud. They are reasons to slow down and verify.
5. Complete Required Internal Approval
Verification should fit into the normal business process rather than creating an informal exception.
6. Decide What Happens Next
If anything important remains unresolved, stop processing the change and use the firm's escalation process.
What’s the Next Step?
The checklist does not label the request safe or fraudulent.
Use this when required verification and approvals are complete and no important concerns remain.
Pause the change when identity, instructions, or required approval have not been independently confirmed.
Stop processing when the request cannot be verified, information is inconsistent, procedures are being bypassed, or a potentially incorrect change may already have been processed.
Before You Change Where Money Goes
Optional Financial Change Verification Record
This blank record can be printed and used internally if it fits your firm’s procedures.
Direct-Deposit Changes Deserve Independent Verification
A request to change where an employee’s pay is deposited may appear routine and may appear to come from the employee. That does not eliminate the need for the firm’s established verification process.
Current IRS payroll guidance advises employers and payroll professionals to verify changes to direct deposit or employee information through a trusted channel. Use the firm’s payroll-change process, verify through a trusted method, complete required approval, and do not rely only on the incoming message.
Financial Changes Can Come From Several Directions
Vendor Banking Changes Should Not Depend on Email Alone
A vendor may legitimately change its bank, ACH destination, payment instructions, or remittance information. Independently verify the change according to the firm’s approved process. The email requesting the change should not also be the only source used to verify it.
Client Payment Instructions Can Change Too
Accounting and tax employees may receive requests involving payment accounts, refund destinations, reimbursement instructions, or other client financial changes. Use the firm’s normal identity and financial-verification process before changing established instructions.
Authority Does Not Replace Verification
A request that appears to come from a partner, owner, manager, or executive may create pressure to act quickly. Seniority should not automatically override the firm’s payment-verification procedure.
Familiar Writing or Voice May Not Prove Identity
Modern impersonation can use realistic writing, familiar names, copied communication style, voice imitation, or AI-assisted communication. Verify unusual financial changes through the firm’s established process rather than treating tone, voice, writing style, or familiarity as proof of identity.
What Does “Verify Through a Trusted Channel” Mean?
A trusted verification method is one already established or independently known to the firm. Verification should come from outside the request being verified.
Previously Established Contact Information
A previously known business contact method may be appropriate when it is already part of the firm’s trusted process.
Approved Employee or Payroll Process
An approved employee portal, HR workflow, or payroll-change process can provide a separate verification path.
Established Vendor-Management Process
Use an existing vendor-management or accounts-payable verification procedure rather than relying on new contact information in the request.
Known Internal Contact Method
For internal requests, use communication and approval methods already established by the firm.
Verification should come from outside the request being verified.
Some Financial Changes Benefit From a Second Review
Depending on the firm’s procedures, a financial change may require manager approval, payroll review, accounting approval, or second-person review. This checklist does not impose a universal dual-approval rule.
If your firm’s procedure requires another approval, complete it before processing the change.
Document Verification Without Recording Unnecessary Sensitive Data
A firm may want an internal record showing the request type, request date, whether independent verification was completed, the verification method, reviewer, approval status, and processed date. The public Secure Team checklist deliberately does not collect those details.
What If the Change Was Already Processed?
If you believe an incorrect, unauthorized, or fraudulent payment or direct-deposit change may already have been processed, follow your firm’s established financial-escalation and incident-reporting procedures promptly.
OFFICIAL GUIDANCE
Official Guidance on Payment and Payroll Verification
IRS — Cybersecurity Awareness Month 2026
Current IRS guidance says businesses, payroll professionals, and HR offices should remain alert for phishing, fake invoices, W-2, and payroll-related schemes and states that requests to change sensitive employee or payment information should be verified through a trusted channel. Read the IRS guidance →
IRS — National Payroll Week 2026
Current IRS payroll guidance advises employers and payroll professionals to verify changes to direct deposit or employee information through a trusted channel. Read the payroll guidance →
FTC — Cybersecurity for Small Business
FTC small-business guidance recommends verification policies for certain requests and gives independent confirmation of wire-transfer requests received through email as an example. Read FTC guidance →
FTC — Scams and Your Small Business
FTC guidance recommends clear purchasing and invoice-approval procedures, close invoice review, employee training, and caution around urgent payment demands. Read FTC scam guidance →
CISA — Phishing Awareness
CISA phishing guidance reinforces that suspicious messages may appear to come from trusted sources and that unusual requests should be verified through known contact methods. Review CISA guidance →
Important: These sources support independent verification as a useful security practice. They do not make this exact Secure Team 24-item checklist mandatory.
Continue With the Right Secure Team Resource
Did the Change Request Arrive by Email?
Use the Suspicious Email Verification Checklist to review an unusual email before clicking, replying, signing in, or acting.
Think an Incorrect Change May Already Have Been Processed?
Use the Incident Reporting Quick Guide to help employees understand what should be reported and what basic information to provide.
How Prepared Is Your Firm for Impersonation Attempts?
Use the Phishing Readiness Assessment to evaluate employee awareness, verification habits, MFA, reporting, and recurring phishing training.
Want a Broader Security Review?
Use the Accounting Firm Security Readiness Scorecard to review payment verification alongside account security, sensitive data, employee training, incident reporting, and access practices.
Do Seasonal Employees Understand Financial Verification?
Use the Seasonal Tax Employee Security Onboarding Checklist to reinforce phishing, account security, taxpayer data, reporting, and approved procedures before temporary staff begin work.
SECURE TEAM
Turn Verification Procedures Into Repeatable Employee Habits
Secure Team is being designed to help accounting and tax firms train employees on phishing, impersonation, payment verification, account security, sensitive information, and incident reporting.
Employees should know the verification process before an urgent financial request arrives.
Payment & Direct-Deposit Verification FAQ
What is a payment change verification checklist?
It is an employee-facing decision aid for reviewing unusual changes to payment, banking, payroll, vendor, client, or direct-deposit instructions before the firm processes them.
How should a business verify a direct-deposit change?
Use the independent verification method established by the firm’s payroll or HR procedure. Current IRS guidance advises employers and payroll professionals to verify direct-deposit or employee-information changes through a trusted channel.
How should accounting firms verify vendor bank changes?
Follow the firm’s established vendor-management or accounts-payable process and independently verify the change rather than relying only on the message requesting it.
Should direct-deposit changes be verified outside email?
The verification should not depend only on the incoming email or message. Use the trusted channel or approved process established by the firm.
How should an employee verify a payment request from a manager?
Use the firm’s normal verification and approval process even when the request appears to come from senior leadership.
Should vendor payment changes be verified by phone?
Use the independent verification method established by your firm’s procedures. A previously known phone number may be one option, but firms may use other approved trusted methods.
What is an independent verification method?
It is a verification method that does not rely only on the same request being verified.
What is a trusted verification channel?
A trusted channel is an established or independently known communication or workflow method, such as an approved employee portal or vendor-management procedure.
Should payment changes require a second approval?
If your firm’s procedure requires manager, payroll, accounting, or second-person approval, complete that step before processing the change.
What should I do if a payment-change request is urgent?
Urgency should not replace verification. Follow the established verification and approval process before changing payment instructions.
What should I do if a familiar vendor suddenly changes bank information?
Treat the change itself as a verification event and independently confirm it through the approved vendor-verification process.
Can an email from a real account still contain fraudulent instructions?
A familiar account or existing conversation does not eliminate the need for normal verification when financial instructions change.
What should I do if I already processed an incorrect payment change?
Follow your firm’s established financial-escalation and incident-reporting procedures promptly.
Should firms document how payment changes were verified?
A firm may find it useful to keep an internal record of request type, verification method, required approval, reviewer, and outcome.
Does this checklist determine whether a request is fraudulent?
No. It reviews whether verification steps have been completed; it does not classify a request as fraudulent or legitimate.
Is this checklist required by the IRS?
No. IRS guidance supports trusted-channel verification for certain payment and payroll changes, but this Secure Team checklist is not an IRS-required form.
Does this checklist satisfy FTC requirements?
No. FTC small-business guidance supports verification procedures, but this checklist does not certify compliance.
Does Secure Team receive the payment information I review?
No. The public checklist does not ask for or transmit bank-account numbers, routing numbers, payment amounts, or actual financial instructions.
Educational Use Only
This checklist is an educational verification aid. It cannot determine with certainty whether a financial request is legitimate or fraudulent, does not create a compliance certification, and does not replace your firm’s accounting, payroll, banking, cybersecurity, approval, fraud-response, or legal procedures.