Bank-change (remit-to) verification checklist

Why bank-change fraud costs factors so much

A remit-to change request is the moment a factor decides where the next payment goes. If the request is fake, the money lands in a fraudster's account, the real carrier still expects to be paid, and the funds are often gone before anyone notices. One approved change can redirect every payment after it.

Public-records checks don't catch it. A hijacked carrier keeps its clean authority, insurance and safety record; the only thing that changes is the bank account. That's why the change itself needs its own verification, every time. The remit-to change guide covers the full SOP, and carrier identity theft explains how carriers get taken over in the first place.

Business email compromise

Fake bank changes often arrive by email. In business email compromise (BEC), a fraudster takes over or imitates a real mailbox and sends payment instructions that look routine. The FBI's Internet Crime Complaint Center recorded about $3.05 billion in reported BEC losses in 2025, second only to investment fraud (2025 IC3 Annual Report).

The IC3's advice is the rule this checklist is built on: use secondary channels to verify requests for changes in account information, and check sender addresses and links for misspelled domains (IC3 public service announcement). An email, even from the carrier's real address, is never enough on its own.

Why call-backs must use known numbers

A call-back only proves something if you chose the number. A number in the request, in the email signature or given by the caller may ring the fraudster, who will happily confirm the change. Call the number in your onboarding file, or the one on the carrier's FMCSA record.

FMCSA contact details can be changed too, by whoever controls the carrier's login. If the carrier's MCS-150 was updated shortly before the bank change, treat that as a reason to dig further. The free carrier risk check shows when the record was last updated.

What a good SOP looks like

A good SOP is written down, followed on every change, and doesn't depend on one person's judgment under pressure. The checklist above follows this shape:

1. 1

   Never on email alone

   Every change is confirmed outside the channel it arrived on.

2. 2

   Independent call-back

   To a number already on file, with a contact you already know.

3. 3

   Proof of ownership

   A bank letter or verified ownership check showing the account holder is the carrier, by legal name.

4. 4

   Two people

   A second approver who didn't handle the request.

5. 5

   Cooling-off

   The first payment to a new account is held, or preceded by a confirmed test deposit.

6. 6

   Notice to the old contact

   So the real carrier hears about the change even if someone else asked for it.

7. 7

   A record

   So you can show what you checked, who you called and who approved it.

CarrierKYC's Verified Payee is built to do the ownership step for you: it re-verifies that a new bank account belongs to the carrier on every remit-to change, before the next ACH. See it in the demo.