How to verify a remit-to or bank-account change: an SOP for factors

You verify a carrier's bank-account change by confirming it with a known officer of the carrier through a channel you trusted before the request arrived, proving the new account belongs to the carrier's legal entity, and paying nothing to the new account until both checks pass. Everything else in this guide is detail on those three steps. The request itself, however convincing, is never evidence.

Factors meet two versions of this. In the first, your client (or someone posing as your client) asks you to send advances and reserves to a new account. In the second, someone posing as you or as the carrier asks a broker to change where it pays, which is covered in the notice of assignment guide.

This guide is about the first. The glossary entry for remit-to change has the short definition.

Because the next payment is the loss. An ACH credit to the wrong account can be withdrawn quickly, recovery depends on how fast the receiving bank acts, and the real carrier still expects to be paid.

The umbrella term for this attack is business email compromise, and it is large. The FBI's 2025 Internet Crime Report lists $3,046,598,558 in reported BEC losses for 2025, second only to investment fraud among cyber-enabled fraud types by loss. In freight, Highway's Q2 2026 Freight Fraud Index (vendor data, broker-side) says communication-based attacks were 50% of classified fraud vectors that quarter.

Transflo, a document-workflow vendor, puts the factor's problem well: "The banking change may be a social-engineering attempt wearing a real carrier's face." Your client may be the victim of a compromised mailbox and have no idea the request was sent.

Most fraudulent requests are ordinary messages with one unusual instruction. Watch for the pattern rather than any single tell.

That last flag ties into account takeovers, where the fraudster changes the carrier's public contact details first so your call-back reaches them. Carrier identity theft explains how that works.

Attacks run the other direction too. Abnormal Security documented an email posing as a collection manager at a factoring company that asked a business for its aging report, with customer balances and contact details. That is the raw material for redirecting payments, and brokers who pay your clients' invoices can receive emails like it with your name on them.

Run every step on every change, including for clients you've funded for years, because long relationships are exactly what attackers borrow. The interactive bank-change verification checklist walks through the same steps and prints for your file.

1. 1

   Log the request and freeze the change

   Record who asked, through which channel, when, and the exact new details. Don't update the payee in your system yet. Keep paying the existing verified account, or hold the payment, until the SOP is complete.

2. 2

   Ignore every contact detail in the request

   Don't reply to the email, call the number in the signature, or use a link it contains. The FBI's BEC guidance is to "use secondary channels and/or two-factor authentication to verify requests for changes in account information."

3. 3

   Call the verified officer on the number you verified at onboarding

   Use the phone number your team confirmed when the carrier was onboarded and that hasn't changed since. If the carrier's numbers changed recently, find one from a source the carrier doesn't control, such as its insurance agent.

4. 4

   Let the officer tell you the details

   Ask what changed, why, which bank, and the last 4 digits of the new account. Don't read the details out yourself. A real owner knows them, and an impostor working from a hijacked mailbox often can't answer the phone you're calling.

5. 5

   Prove the new account belongs to the carrier

   Use a method that returns the account holder's name from the bank, or a bank letter you confirm by calling the bank at a number you found yourself. The table below compares the options.

6. 6

   Match the account name to the legal entity

   The holder name should match the carrier's legal name on its formation record and FMCSA registration, or a DBA the carrier has registered. A personal account for an LLC needs a written explanation and a supervisor's sign-off.

7. 7

   Re-verify identity if anything is off

   If the officer is new, the voice is unfamiliar, or the story shifts, run the same ID and selfie or video check you ran at onboarding before going further.

8. 8

   Get a second person to approve

   The person who took the request should not be the person who approves it. The approver checks the evidence in the file, not the requester's say-so.

9. 9

   Notify the old channels and watch the first payment

   Tell the carrier through its previously verified email and phone that the change was made, so a real owner can object. Consider a short hold or a smaller first payment to the new account, and confirm receipt with the officer.

10. 10

    File the evidence

    Save the request, call notes with names and times, the ownership proof and the approvals. If anyone ever asks how you verified a payee, this file is the answer.

Different methods prove different things. Most prove that an account exists or that someone can see it, and only a few prove who owns it.

For an LLC or corporation, the strongest file has a bank-reported holder name that matches the legal entity, plus a call-back to a verified officer. If you can't get a bank-reported name, a bank letter confirmed with the branch is the next best.

Write the authority down before you need it. Fraud lands on the person who holds both the request and the power to act on it, usually late on a busy day.

• Separate duties. One person verifies, another approves, and the system records both names.
• No same-call approvals. A change requested and "confirmed" on one call, by the same caller, has not been verified.
• No exceptions for urgency. A deadline in the request is a reason to slow down, and your clients should hear that from you at onboarding.
• Lock the field. Payee details should be editable only through the change workflow, not by anyone with access to the client record.
• Re-verify every change. A client that changed banks last quarter gets the same checks this quarter.

Tell clients at onboarding how you handle bank changes, and that you will never accept one by email alone. It costs nothing, and it gives a real owner a reason to call you when a strange request appears.

If your factoring company sends ACH credits to carriers through its bank, Nacha's 2026 fraud-monitoring rules probably reach you. Phase 2 took effect on June 19, 2026 (in practice June 22, 2026, because June 19 was a federal holiday) and removed the volume threshold, so it covers all non-consumer Originators, Third-Party Service Providers and Third-Party Senders.

The rule requires risk-based processes and procedures "reasonably intended to identify Entries that are suspected of being unauthorized or authorized under False Pretenses," reviewed at least annually. Nacha's definition of False Pretenses covers a person misrepresenting their identity, their authority to act for someone else, or the ownership of the account to be credited, and Nacha says it covers business email compromise and vendor impersonation. A fraudulent bank-change request is close to the textbook case.

Nacha also notes the rules don't require screening every entry individually or monitoring before processing. Ask your bank how it expects you to document your controls; a written payee-change SOP with evidence in each file is a natural place to start.

How the rule applies depends on your banking setup, so confirm it with your bank and talk to counsel.

Act within minutes, not days. The FBI's 2025 Internet Crime Report says that when you discover a fraudulent transfer, "time is of the essence": contact your financial institution immediately and request a recall of the funds, and file a complaint at ic3.gov regardless of the amount lost.

1. Call your bank's fraud or ACH operations line and ask it to request a recall from the receiving bank. Have the trace number, amount, date and receiving account ready.
2. File a complaint at ic3.gov with full transaction details. The IC3's Recovery Asset Team works with banks to freeze funds, and in 2025 it reported freezing $679,013,183 across 3,900 incidents, a 58% success rate.
3. Reach the real carrier through verified channels, tell it what happened, and check whether its email or FMCSA access has been compromised.
4. Lock the client's account against further changes, and review other clients for similar requests in the same week.
5. Preserve the emails with full headers, the call log and the approval trail, and notify your insurer if you carry crime or social-engineering coverage.

Then close the gap that let it through. Verified Payee, the CarrierKYC product now in early access, is built around this SOP: it re-verifies the officer and the bank account on every change and holds the next ACH until both pass. The demo shows a spoofed bank-change email being stopped.