Maintenance
Part of Bank transfer guide: ACH, wire, instant payment, and internal transfer rails
Bank transfer details, timing, fee, and recipient checklist
Bank transfer checklist for recipient details, routing information, rail, timing, fees, independent verification, dual approval, confirmation, and records.
What to take away
- Verify recipient details through a channel separate from the payment request.
- A valid routing number identifies a participant, not the owner of an account.
- Record provider cutoff, rail settlement, and recipient availability separately.
- Require a second approval for material or changed business payments.
- Keep the request, verification, approval, bank confirmation, and reconciliation record.
Use this checklist for first-time recipients, material transfers, and every change to standing payment instructions. It applies to domestic bank payments; international transfers need additional country, currency, sanctions, and intermediary checks.
Payment purpose
- State the business or personal purpose.
- Attach the invoice, contract, closing instruction, or other basis.
- Confirm the amount and currency.
- Record the due date and time zone.
- Identify the consequence of delay.
- Confirm the payment is permitted under account and organizational policy.
- Reject unexplained urgency or secrecy.
Recipient identity
- Record the legal recipient name.
- Confirm the account title where available.
- Obtain a physical or registered business address.
- Record a known contact person and verified telephone number.
- Confirm the recipient expects the payment.
- Check that invoice and contract parties match.
- Escalate third-party payment instructions.
Do not rely on the display name in an email header.
Bank and account details
- Bank legal name.
- Bank city and country.
- Routing or institution identifier.
- Recipient account number.
- Account type if required.
- Intermediary bank details if applicable.
- Payment reference or invoice number.
- Intended rail.
The Federal Reserve Banks' E-Payments Routing Directory provides routing information for Fedwire and qualifying FedACH participants. It can confirm that a routing number maps to a participating institution. It cannot prove the beneficiary account belongs to the intended recipient.
Bank and account details
- Bank legal name
- Bank city and country
- Routing or institution identifier
- Recipient account number
- Intermediary bank details if applicable
- Payment reference or invoice number
- Intended rail
Independent verification
- Call a number already on file or independently sourced.
- Do not use contact details in the message being verified.
- Read back bank name and routing identifier.
- Confirm the account suffix.
- Confirm amount, currency, invoice, and due date.
- Record verifier, recipient contact, time, and result.
- Require fresh verification after any instruction change.
For large transfers, use two employees and two distinct approval records.
Independent verification call
- Call a number already on file
- Avoid contact details in the message
- Read back bank name and routing identifier
- Confirm account suffix
- Confirm amount, currency, invoice, due date
- Record verifier, contact, time, result
Business email compromise controls
Treat the verification channel as a control asset. Build the vendor's known telephone number and authorized contacts when the relationship begins, before anyone requests a bank change. Restrict who can edit that master record and retain an audit log. If the normal contact is unavailable, use a documented alternate rather than a number supplied in the change request.
A successful login to a real vendor mailbox does not prove the message was written by the vendor, because an attacker may control that mailbox. Payment approval should rely on the independently confirmed instruction, not the apparent continuity of an email thread.
The FBI's business email compromise guidance describes spoofed and compromised accounts, suspicious instruction changes, independent telephone verification, multifactor authentication, and immediate contact with the financial institution after a fraudulent transfer.
Business email compromise controls
- Inspect full sender address and domain
- Look for altered reply-to fields
- Treat new bank details as high risk
- Verify executive requests outside email
- Flag new secrecy or pressure
- Do not disable multifactor authentication
Rail selection
- Name the actual railACH, wire, instant, internal, card payout, or other.
- Confirm recipient reachability.
- Compare value and transaction limits.
- Understand return and recall options.
- Match the rail to urgency and finality needs.
- Confirm whether the provider can change the rail automatically.
- Record the selected method in the approval.
Timing
Time field / Verified value
- Customer submission deadline
- Bank review cutoff
- Rail transmission window
- Expected settlement
- Expected recipient posting
- Expected recipient availability
- Time zone
- Account for weekends and holidays.
- Confirm same-day eligibility.
- Do not confuse an estimate with a guarantee.
- Build time for manual bank review.
Fees and amount received
- Sender fee.
- Receiver fee.
- Intermediary fee.
- Expedited fee.
- Exchange rate and markup.
- Return, cancellation, or research fee.
- Net amount expected by recipient.
For an invoice requiring an exact net amount, agree in advance who bears fees.
Fees and amount received
- Sender fee
- Receiver fee
- Intermediary fee
- Expedited fee
- Exchange rate and markup
- Return or cancellation fee
- Net amount expected by recipient
Test-payment control
- Determine whether a test is appropriate.
- Use the same intended rail.
- Keep the amount low but distinctive.
- Confirm receipt through the verified contact.
- Record recipient descriptor and posting time.
- Do not treat an old test as approval of changed details.
Preparation and approval
- Preparer enters details from the verified master record.
- Approver compares every final field.
- Source account is correct.
- Recipient is correct.
- Amount and currency are correct.
- Date and recurrence are correct.
- Fee and method are acceptable.
- Authentication occurs on a trusted device.
- Any field change triggers reapproval.
Confirmation and reconciliation
- Save provider confirmation.
- Save trace or transaction identifier.
- Record submission and release times.
- Confirm the source-account debit.
- Obtain recipient confirmation.
- Match the recipient amount to the obligation.
- Close the invoice only after reconciliation.
- Retain records under policy.
Incident response
If instructions were fraudulent or incorrect:
- Contact the sending bank immediately.
- Request the appropriate recall, return, or fraud process.
- Ask the bank to contact the receiving institution.
- Freeze related approvals and recipient changes.
- Preserve messages, logs, and transaction data.
- Secure compromised email and banking accounts.
- Notify internal legal, security, and finance owners.
- Report to the appropriate authorities.
Do not wait for the recipient email account to respond if that account may be compromised.
Common questions
Does the routing directory verify a recipient?
No. It verifies routing information for participating institutions, not account ownership or payment purpose.
Should every vendor change require a telephone call?
Use a documented independent verification rule. Any payment-detail change deserves fresh verification through a known route.
What if the executive says controls are slowing an urgent payment?
Follow the approved exception process. Urgency is a common fraud tactic and should not erase verification.
When is the payment complete?
Completion depends on the rail and provider status. Reconcile the sender debit, rail confirmation, recipient credit, and underlying obligation.
