Remit-to change

Legitimate reasons exist: a carrier changes banks, switches factors with a letter of release and a new NOA, or restructures. Fraudulent requests look the same on paper. An attacker with a hijacked mailbox, a lookalike domain or control of the carrier's FMCSA record asks you to send the next payment somewhere new.

For a factor, a bank change on a client's account is the moment when every earlier check can be bypassed. Onboarding verified the right people and the right account; a single email can swap the account, and ACH payments are hard to recover once they land. IC3 advises verifying account-change requests through a secondary channel.

1. Call the client at a phone number you held before the request, never one from the email.
2. Confirm the new account belongs to the carrier's legal entity, not an individual or another company.
3. Require a second person to approve the change.
4. Hold or limit the first payment to the new account, and tell the old contact that a change was made.

This is the event CarrierKYC's Verified Payee is built around: every bank or ownership change is re-verified before the next ACH. The remit-to change checklist and the verification SOP are free.