---
title: "How to verify a remit-to or bank-account change: an SOP for factors"
url: https://carrierkyc.com/guides/remit-to-change-verification
description: "How to verify a carrier's remit-to or bank-account change before the next ACH: a factor's step-by-step SOP with call-back rules, ownership proof and red flags."
updated: 2026-10-19
author: "Isaac Welch"
---

# How to verify a remit-to or bank-account change: an SOP for factors

*A bank-change request is the moment money is most likely to leave for the wrong account, and this is the procedure that keeps it home.*

Category: Fraud & verification. Published 2026-10-19, updated 2026-10-19. By Isaac Welch.

## Key takeaways

- Verify a bank-account change by confirming it with a known officer through a channel you trusted before the request arrived, proving the new account belongs to the carrier's legal entity, and paying nothing to it until both checks pass.
- The request itself is never evidence, even when it comes from the email address the carrier has always used.
- A voided check proves only that someone can produce a document; prefer a bank-reported account holder name that matches the legal entity.
- Nacha's 2026 fraud-monitoring rules require non-consumer ACH Originators to have risk-based processes to catch payments induced under false pretenses, including misrepresented account ownership.
- If money goes to the wrong account, call your bank for a recall immediately and file at ic3.gov, because recovery depends on speed.

## How do you verify a carrier's bank-account change?

You verify a carrier's bank-account change by confirming it with a known officer of the carrier through a channel you trusted before the request arrived, proving the new account belongs to the carrier's legal entity, and paying nothing to the new account until both checks pass. Everything else in this guide is detail on those three steps. The request itself, however convincing, is never evidence.

Factors meet two versions of this. In the first, your client (or someone posing as your client) asks you to send advances and reserves to a new account. In the second, someone posing as you or as the carrier asks a broker to change where it pays, which is covered in the [notice of assignment guide](https://carrierkyc.com/guides/notice-of-assignment-freight-factoring).

This guide is about the first. The glossary entry for [remit-to change](https://carrierkyc.com/glossary/remit-to-change) has the short definition.

## Why are bank-change requests so risky for factors?

Because the next payment is the loss. An ACH credit to the wrong account can be withdrawn quickly, recovery depends on how fast the receiving bank acts, and the real carrier still expects to be paid.

The umbrella term for this attack is [business email compromise](https://carrierkyc.com/glossary/business-email-compromise), and it is large. The FBI's 2025 Internet Crime Report lists $3,046,598,558 in reported BEC losses for 2025, second only to investment fraud among cyber-enabled fraud types by loss. In freight, Highway's Q2 2026 Freight Fraud Index (vendor data, broker-side) says communication-based attacks were 50% of classified fraud vectors that quarter.

Transflo, a document-workflow vendor, puts the factor's problem well: "The banking change may be a social-engineering attempt wearing a real carrier's face." Your client may be the victim of a compromised mailbox and have no idea the request was sent.

## What does a fraudulent remit-to change look like?

Most fraudulent requests are ordinary messages with one unusual instruction. Watch for the pattern rather than any single tell.

> **Red flag: Red flags in a bank-change request** Urgency tied to a payment date ("before Friday's advances"); a new account at a different or online-only bank, in a name that isn't the carrier's legal name; a reason that discourages checking ("our old account was frozen for fraud"); a request to pay a third party such as a dispatcher or fuel vendor; a new phone number in the signature; a reply-to address that differs from the sender; or a request that arrives soon after the carrier's FMCSA contact details changed.

That last flag ties into account takeovers, where the fraudster changes the carrier's public contact details first so your call-back reaches them. [Carrier identity theft](https://carrierkyc.com/guides/carrier-identity-theft) explains how that works.

Attacks run the other direction too. Abnormal Security documented an email posing as a collection manager at a factoring company that asked a business for its aging report, with customer balances and contact details. That is the raw material for redirecting payments, and brokers who pay your clients' invoices can receive emails like it with your name on them.

## What is the step-by-step SOP for a bank-account change?

Run every step on every change, including for clients you've funded for years, because long relationships are exactly what attackers borrow. The interactive [bank-change verification checklist](https://carrierkyc.com/tools/remit-change-checklist) walks through the same steps and prints for your file.

1. **Log the request and freeze the change** Record who asked, through which channel, when, and the exact new details. Don't update the payee in your system yet. Keep paying the existing verified account, or hold the payment, until the SOP is complete.
2. **Ignore every contact detail in the request** Don't reply to the email, call the number in the signature, or use a link it contains. The FBI's BEC guidance is to "use secondary channels and/or two-factor authentication to verify requests for changes in account information."
3. **Call the verified officer on the number you verified at onboarding** Use the phone number your team confirmed when the carrier was onboarded and that hasn't changed since. If the carrier's numbers changed recently, find one from a source the carrier doesn't control, such as its insurance agent.
4. **Let the officer tell you the details** Ask what changed, why, which bank, and the last 4 digits of the new account. Don't read the details out yourself. A real owner knows them, and an impostor working from a hijacked mailbox often can't answer the phone you're calling.
5. **Prove the new account belongs to the carrier** Use a method that returns the account holder's name from the bank, or a bank letter you confirm by calling the bank at a number you found yourself. The table below compares the options.
6. **Match the account name to the legal entity** The holder name should match the carrier's legal name on its formation record and FMCSA registration, or a DBA the carrier has registered. A personal account for an LLC needs a written explanation and a supervisor's sign-off.
7. **Re-verify identity if anything is off** If the officer is new, the voice is unfamiliar, or the story shifts, run the same ID and selfie or video check you ran at onboarding before going further.
8. **Get a second person to approve** The person who took the request should not be the person who approves it. The approver checks the evidence in the file, not the requester's say-so.
9. **Notify the old channels and watch the first payment** Tell the carrier through its previously verified email and phone that the change was made, so a real owner can object. Consider a short hold or a smaller first payment to the new account, and confirm receipt with the officer.
10. **File the evidence** Save the request, call notes with names and times, the ownership proof and the approvals. If anyone ever asks how you verified a payee, this file is the answer.

## What counts as proof that a bank account belongs to the carrier?

Different methods prove different things. Most prove that an account exists or that someone can see it, and only a few prove who owns it.

*Bank-account proof methods, weakest to strongest*

| Method | What it shows | What it doesn't |
| --- | --- | --- |
| Voided check or bank screenshot | That someone has a document with routing and account numbers | Ownership. Both are easy to fabricate or alter. |
| Prenote or zero-dollar test entry | That the account number is valid and open, if no return comes back | Who owns the account |
| Micro-deposits | That the requester can see the account's activity | That the account is in the carrier's name |
| Bank letter | Account holder name and status, if the letter is genuine | Authenticity, unless you confirm it with the bank at a number you found yourself |
| Bank-reported ownership data (the carrier signs in to its bank through an account-verification service) | The account holder name as the bank reports it, with the account and routing numbers | Coverage at some small banks and credit unions, so you need a fallback |

For an LLC or corporation, the strongest file has a bank-reported holder name that matches the legal entity, plus a call-back to a verified officer. If you can't get a bank-reported name, a bank letter confirmed with the branch is the next best.

## Who should be allowed to approve a payee change?

Write the authority down before you need it. Fraud lands on the person who holds both the request and the power to act on it, usually late on a busy day.

- **Separate duties.** One person verifies, another approves, and the system records both names.
- **No same-call approvals.** A change requested and "confirmed" on one call, by the same caller, has not been verified.
- **No exceptions for urgency.** A deadline in the request is a reason to slow down, and your clients should hear that from you at onboarding.
- **Lock the field.** Payee details should be editable only through the change workflow, not by anyone with access to the client record.
- **Re-verify every change.** A client that changed banks last quarter gets the same checks this quarter.

Tell clients at onboarding how you handle bank changes, and that you will never accept one by email alone. It costs nothing, and it gives a real owner a reason to call you when a strange request appears.

## What do Nacha's 2026 fraud rules mean for payee changes?

If your factoring company sends ACH credits to carriers through its bank, Nacha's 2026 fraud-monitoring rules probably reach you. Phase 2 took effect on June 19, 2026 (in practice June 22, 2026, because June 19 was a federal holiday) and removed the volume threshold, so it covers all non-consumer Originators, Third-Party Service Providers and Third-Party Senders.

The rule requires risk-based processes and procedures "reasonably intended to identify Entries that are suspected of being unauthorized or authorized under False Pretenses," reviewed at least annually. Nacha's definition of False Pretenses covers a person misrepresenting their identity, their authority to act for someone else, or the ownership of the account to be credited, and Nacha says it covers business email compromise and vendor impersonation. A fraudulent bank-change request is close to the textbook case.

Nacha also notes the rules don't require screening every entry individually or monitoring before processing. Ask your bank how it expects you to document your controls; a written payee-change SOP with evidence in each file is a natural place to start.

How the rule applies depends on your banking setup, so confirm it with your bank and talk to counsel.

## What should you do if money already went to the wrong account?

Act within minutes, not days. The FBI's 2025 Internet Crime Report says that when you discover a fraudulent transfer, "time is of the essence": contact your financial institution immediately and request a recall of the funds, and file a complaint at ic3.gov regardless of the amount lost.

1. Call your bank's fraud or ACH operations line and ask it to request a recall from the receiving bank. Have the trace number, amount, date and receiving account ready.
2. File a complaint at [ic3.gov](https://www.ic3.gov) with full transaction details. The IC3's Recovery Asset Team works with banks to freeze funds, and in 2025 it reported freezing $679,013,183 across 3,900 incidents, a 58% success rate.
3. Reach the real carrier through verified channels, tell it what happened, and check whether its email or FMCSA access has been compromised.
4. Lock the client's account against further changes, and review other clients for similar requests in the same week.
5. Preserve the emails with full headers, the call log and the approval trail, and notify your insurer if you carry crime or social-engineering coverage.

Then close the gap that let it through. Verified Payee, the CarrierKYC product now in early access, is built around this SOP: it re-verifies the officer and the bank account on every change and holds the next ACH until both pass. The [demo](https://carrierkyc.com/demo) shows a spoofed bank-change email being stopped.

## Frequently asked questions

### How long should a cooling-off period be after a bank change?

There's no industry standard. A hold of 24 to 48 hours, or a smaller first payment, gives a notice sent to the old email and phone time to reach the real owner. Pick a period your clients can live with and apply it to everyone.

### Should we accept bank changes through our client portal?

Only if a portal change triggers the same verification. A portal login can be phished like an email account, so treat a portal request as a request, not a verification, and require a call-back and ownership proof before the change takes effect.

### What if the carrier's owner is hard to reach by phone?

Schedule the call rather than skip it. Owner-operators drive, so offer a time window or a short video call, and keep paying the old verified account (or hold) until you speak. A real owner would rather wait a day than have an advance stolen.

### Does the same SOP apply to fuel advances and reserve releases?

Yes. Any payment to a new destination, including fuel cards, reserve releases and third parties the carrier names, is a payee change and gets the same checks.

### Can a fraudster get a broker to pay the carrier directly instead of us?

Yes. A forged letter of release or a request "from the carrier" to change its remit-to can redirect a broker's payment. Your NOA should tell debtors that changes are valid only when confirmed with you by phone, and [two NOAs, one carrier](https://carrierkyc.com/guides/conflicting-noas) covers what to do when a competing notice appears.

## Sources

- [FBI IC3: Business Email Compromise: The $55 Billion Scam (I-091124-PSA)](https://www.ic3.gov/PSA/2024/PSA240911) (FBI public service announcement, 2024-09-11)
- [FBI IC3: 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) (FBI, published 2026)
- [Nacha: Risk Management Topics, Fraud Monitoring Phase 2](https://www.nacha.org/rules/risk-management-topics-fraud-monitoring-phase-2) (Nacha Operating Rules, effective 2026-06-19)
- [Highway: Q2 2026 Freight Fraud Index](https://highway.com/press-releases/q2-2026-freight-fraud-index-half-of-all-incidents-now-tied-to-communication-based-attacks) (Vendor data, 2026-07-28)
- [How freight factors can fight fraud in 2026 without slowing funding](https://www.transflo.com/blog/how-freight-factors-can-fight-fraud-in-2026-without-slowing-funding/) (Transflo blog (vendor), 2026-09-02)
- [BEC attack poses as a factoring company to request aging report with customer payment information](https://abnormal.ai/threat-intelligence/digest/bec-attack-poses-as-a-factoring-company-to-request-aging-report-with-customer-payment-information) (Abnormal Security (vendor), 2023-02-01)

## Related free tools

- [Bank-change verification checklist](https://carrierkyc.com/tools/remit-change-checklist): The step-by-step SOP for verifying a carrier's remit-to or bank-account change before any money moves. Score your process and print it.
- [Carrier risk check](https://carrierkyc.com/tools/carrier-check): Enter a USDOT or MC number. See authority age, revocations, insurance, out-of-service orders, and other carriers sharing the same phone, email, or address.