Not in the way that protects you. QuickBooks Bill Pay runs a small test (“penny”) deposit to confirm a vendor’s bank account is real and can receive ACH — but that only checks the plumbing, not whether the change request is genuine. A fraudster’s account passes a penny test just as easily as the real vendor’s. And once a vendor’s details are set up, QuickBooks doesn’t give you a way to independently re-verify a later change. So if you run accounts payable for clients in QuickBooks, the job of confirming “is this bank-change request actually from the vendor?” is still yours — QuickBooks won’t do it for you.
That surprises a lot of bookkeepers, because “Bill Pay verified the account” feels like fraud protection. It isn’t. This guide explains exactly what QuickBooks does and doesn’t check, where the gap is, and the one step that actually closes it.
What QuickBooks Bill Pay actually checks
When you add or update a vendor’s bank details for ACH Bill Pay, QuickBooks typically initiates a micro-deposit (a penny or small test amount) to the account. The earliest it processes is usually a couple of business days later, and the point is to confirm the account number and routing number are valid and the account can receive a payment.
That’s account validation. It answers “does this account exist and can it accept an ACH credit?” It does not answer the question that matters for fraud: “did the real vendor actually ask me to send their money to this account?”
There’s a second limitation worth knowing. As QuickBooks users and Intuit support threads point out, after a vendor’s bank info is entered at setup you can’t simply re-verify it in place — to change an existing vendor’s ACH details you generally toggle the payment method (for example off Online Bill Pay and back) so the system re-requests the bank information. Convenient or not, none of that is an identity check on the person making the request.
Why a penny test doesn’t stop payment-diversion fraud
The most common way firms lose client money isn’t a hacked system — it’s a believable email: “Our bank details have changed, please update before the next payment.” The attacker has often been reading a real mailbox for weeks, copies the vendor’s branding, and sends the request right when a payment is due.
Now walk it through QuickBooks Bill Pay. You update the vendor’s ACH details to the new (fraudulent) account. QuickBooks sends a penny to that account. It clears — because the fraudster’s account is a real account that can receive money. Everything looks “verified.” The next payment goes to the criminal.
The penny test did its job (the account is valid) and still didn’t help, because validity was never the question. The FBI’s Internet Crime Complaint Center reported business email compromise losses in the billions of dollars in 2024 (2024 Internet Crime Report), and a large share trace back to exactly this swap.
The step that actually closes the gap
The control that catches a fraudulent bank-change request is an out-of-band callback: you call the vendor on a number you already had — from a prior invoice, a signed contract, or your vendor file — not a number, link, or reply address from the change request, and confirm the new details verbally before you save them. Industry surveys bear this out: roughly 55% of companies verify bank changes in-house by phoning the vendor, while only about 11% rely on penny verification (the rest use third-party tools).
Two more pieces make it stick:
- Maker–checker (dual control). The person who enters the bank-detail change shouldn’t be the one who approves it. Separating those duties is one of the most effective AP fraud controls there is.
- A documented audit trail. Record who you called, the number you used and where it came from, what was confirmed, who approved it, and when. This is what an auditor — or a cyber-insurer reviewing a claim — will ask you to produce.
None of that lives inside QuickBooks Bill Pay. The penny test stays useful for catching typos and dead accounts, but the verification-and-documentation layer is something you add on top.
What this means if you run AP for clients
If you’re a bookkeeping or accounting firm paying vendors for multiple clients through QuickBooks, the exposure is multiplied: every client’s vendor list is a place a “we changed banks” email can land, and you’re the one who’d have to prove you checked. Relying on Bill Pay’s penny test as your control is the gap that gets firms — and their clients — burned.
The fix doesn’t require leaving QuickBooks. It requires a consistent procedure around it: treat every payment-detail change as unverified until someone calls the vendor back on a known number, gets a second approval, and logs it — then update QuickBooks. No log, no change.
If you want a ready-made version of that procedure, our free vendor bank-change verification template lays out the independent-contact rule, a word-for-word callback script, a dual-approval step, and a one-page log sheet — no signup, nothing to buy. For the full mechanics, see how to verify a vendor bank account change. And if you carry cyber coverage, read does your cyber insurance require a callback — many policies make that documented call a condition of paying a claim.
CallbackProof exists to make this routine across all of your clients: it enforces the callback-and-approval sequence and keeps a tamper-evident log you can hand to an insurer or auditor. It’s a documentation and workflow tool — it doesn’t replace QuickBooks and doesn’t move money; it records that you verified the change before you made it.
The bottom line
QuickBooks Bill Pay’s penny deposit confirms a vendor account is valid and can receive funds. It does not confirm that a bank-change request is legitimate, and it gives you no built-in way to independently re-verify a change — so it won’t stop payment-diversion fraud on its own. The control that does is an out-of-band callback to a known number, with dual approval and a documented record, performed before you update the vendor in QuickBooks.
Frequently asked questions
Does the QuickBooks penny/test deposit mean the vendor change is safe?
No. The test deposit confirms the account is real and can receive ACH. It does not confirm the change request came from the real vendor. A fraudulent account passes the test too.
Can I re-verify a vendor’s bank details inside QuickBooks after setup?
Not directly. To change an existing vendor’s ACH details you generally re-trigger the bank-info request (e.g., by toggling the payment method). That’s a data-entry step, not identity verification — the out-of-band callback is still on you.
What should I do before updating a vendor’s bank details in QuickBooks?
Call the vendor on a number you already had (not one from the request), confirm the new details verbally, get a second person to approve, and log all of it. Then make the change in QuickBooks.
Is calling the vendor really necessary if Bill Pay already sent a test deposit?
Yes. The test deposit and the callback answer different questions. Only the callback to a known number confirms the request is genuine, and only a record of it proves you checked.