Supplier address change: just update it or call first?

A supplier emails a new address or contact person and your administration updates it — no questions asked. Here's why this is a classic first step towards invoice fraud, and how to stop it in three simple steps.

You get an email from a supplier: "Please find our updated address details below — kindly update your records." Address, Chamber of Commerce number, contact person. Sounds harmless, and your administration makes the change without a second thought. Two months later it turns out an invoice went to the wrong company, or a package was delivered to an empty building.

Address changes are a blind spot. We check IBANs (rightly so), and sometimes call to confirm a new bank account number — but an address or contact person? That usually gets updated without a murmur. Yet this is a classic first step towards invoice fraud and identity abuse.

Why this is a problem

A fraudster impersonating a supplier or customer rarely starts with "surprise — pay this invoice to a new IBAN". That raises flags. What does work is a gradual build-up:

1. First, submit an innocent change — a new postal address, a new contact person, a new phone number.
2. A few weeks later, a normal-looking invoice arrives, perhaps with one small detail that's slightly off.
3. Then comes the real blow: an urgent payment request, a new IBAN, or a request to forward confidential documents.

Because the first step was already "approved" by your administration, everything that follows feels legitimate. After all, your records now match what the fraudster sends you later.

What this looks like in practice

• A new postal address from an existing supplier, passed on by email, with no follow-up call.
• A new contact person ("Jan has left, I'm taking over") with an email address on a subtly different domain name.
• A changed Chamber of Commerce or VAT number "due to a restructuring".
• A new invoice address where invoices should be sent — often a PO box or virtual office.

Any of these changes can be entirely legitimate. Companies move, people come and go, structures change. The problem isn't that it happens — it's that it almost always gets processed without verification.

A simple process for your administration

You don't need a dedicated fraud team. Three steps are enough to eliminate 90% of the risk.

1. Call back on a known number

Received an email with an address or contact change? Call the supplier on the number you already had — not the one in the email. That means: the number on your old invoice, or the number on their website (typed into your browser, not clicked from the email). One question: "Can you confirm you sent us an address update?" Five minutes' work.

2. Verify VAT and Chamber of Commerce numbers at source

If a supplier says their Chamber of Commerce or VAT number has changed: check it. Against the Chamber of Commerce database and against EU VIES for VAT numbers. It literally takes a minute each. With our VAT check you can instantly see whether a number is valid and whose name it's registered under. If that doesn't match what the supplier told you — red flag.

3. Record changes in your system

For every change you process, note down: the date, who submitted it (email and name), who verified it and how. This doesn't need to be a complicated process — a note in the supplier folder or a comment in your accounting system is enough. Why bother? If something goes wrong later, you can trace exactly where it started. And if your insurer or bank asks you to demonstrate that you acted with due care, you have something to show.

Red flags to watch out for

Not every change is suspicious, but these patterns deserve extra scrutiny:

• The email comes from a subtly different domain name than usual (think: supplier-ltd.com instead of supplierltd.com).
• There's a sense of urgency: "please process this before the end of the week, otherwise our accounts department will have a problem".
• The sender is new to you — a name you've never seen before in any previous correspondence.
• The new address is a PO box or virtual office in a different city from the company's original location.
• The change coincides with an outstanding invoice that's due to be paid soon.

What if a customer sends you an address change?

Don't only think about suppliers. If one of your customers sends a change — a new invoice address, a new contact person, a different VAT number — that's also a moment for a quick check. Especially if a large delivery or service is coming up soon. Fraudsters posing as customers do exist: think free goods or services, or the redirection of credit notes.

Make it a routine, not a one-off

The ideal outcome is that these kinds of checks simply become part of your administrative routine — just like an IBAN verification or a VAT check. Nothing dramatic, nothing paranoid — just: "we'll give them a quick call back, it's standard practice". That way it becomes part of how you work, rather than an exceptional step you forget on busy days.

Want to set up administrative checks like these on a more structural basis? Our VAT check and IBAN check are a good place to start. If you have broader questions about invoice flows and verification, take a look at our access check — gaining insight into who is authorised to process which changes is part of that too.