A supplier changed their bank details. Verify before you pay

An invoice arrives from a familiar supplier. The amount looks right, the work is real and the message sits in a conversation you recognise. There is one change: payment should now go to a different bank account.

Treat that change as something to verify independently before paying. The Australian Cyber Security Centre describes business email compromise as a fraud risk involving compromised or impersonated email accounts. A request to change payment details can be part of that attack.

The scenario above is illustrative, not a report of a particular AusLume reader's experience. It shows why a familiar-looking email is not enough to approve a change involving money.

Separate a real invoice from a verified destination

A supplier can genuinely be owed money while the account details in a message are fraudulent. Checking that the goods arrived or that the invoice amount matches the purchase does not complete the check on where the payment will go.

Build the payment process around two questions: do we owe this amount, and have we verified this destination? Record the answer to each. That makes it harder for a genuine commercial relationship to substitute for verification of a new instruction.

For a small business, this can be a short note beside the invoice. For a larger team, it may be part of an existing approval system. The useful feature is the separation of the decisions, not the sophistication of the software.

Use a contact route established earlier

As a practical control, contact the supplier using a number or channel you independently verified before the change request. Do not simply call the new number supplied in the same email that asks you to change the bank details.

Ask the known contact to confirm that a change was requested and follow your business's procedure for validating it. If you cannot reach the appropriate person, leave the payment on hold and explain why through a trusted channel. A request marked urgent should not remove the check.

Write down when the verification occurred, who completed it and which established contact route was used. Keep sensitive payment details in the appropriate business system, rather than copying them into a widely shared chat. This is a suggested workflow to adapt to your organisation, not a guarantee against fraud.

Give staff permission to pause

A control is less useful if the person processing an invoice believes they will be criticised for using it. Make the rule clear before an urgent payment arrives: a change of bank details requires verification, including when the message appears to come from the owner.

Agree who can help when the usual approver is unavailable. Otherwise, a staff member may face an unrealistic choice between delaying an important supplier and skipping the process. A named backup and a documented hold status can make the safe action ordinary.

Consider a second-person check for changes where staffing allows. The reviewer should examine the verification evidence, not merely click approve because another person has already handled the invoice. In a one-person business, a separate verification step is still more useful than treating familiarity as confirmation.

Protect the mailbox as well as the payment

The ACSC's prevention guidance recommends measures including multi-factor authentication, protecting business domain names and configuring email-authentication records with the relevant service providers.

These measures address different parts of the problem. Discuss the technical settings with whoever manages your email, while keeping the payment-verification procedure understandable to everyone who processes invoices. A business should not need every staff member to become an email administrator before they can pause a suspicious request.

Make ownership explicit. Who manages the domain renewal? Who receives security alerts? Who can contact the email provider if access is lost? A short list of responsibilities is useful when the person who normally handles technology is on leave.

Practise with an invented invoice

Use a fictional supplier and no real account details for a short team exercise. Present a routine invoice followed by a message asking for a changed payment destination. Ask the team to walk through the decision rather than testing whether they can spot a deliberately poor spelling mistake.

The exercise should answer practical questions. Where is the trusted contact stored? Who can place a hold? What happens if the owner is travelling? What record shows that the change was checked? If those answers are unclear, improve the process before adding more warning posters.

Do not send deceptive messages to staff without an agreed training plan. A transparent walk-through can reveal missing steps without collecting personal information or creating anxiety about a surprise test.

If money has already been sent

The ACSC's recovery guidance says to contact the financial institution promptly when funds or banking details are at risk. It also provides steps for reporting through ReportCyber, securing affected accounts and notifying relevant contacts. Recovery is not guaranteed.

Preserve the messages and transaction information. Get appropriate technical assistance to assess whether the mailbox was accessed, rather than assuming a password change alone resolves everything. If personal information may be involved, obtain advice about any applicable reporting obligations.

The most useful routine change is small: treat new payment details as a fresh decision that needs its own evidence. A valid invoice, a familiar name and a convincing email thread can explain why a payment is expected. They do not, by themselves, verify the account receiving it.