The supplier email looks genuine. Has the bank account changed?

Before paying an invoice with changed bank details, pause the payment and verify the change through an independently established supplier contact. Then approve the supplier-record update and confirm that the final payment instruction matches the verified details. A genuine-looking email thread is not sufficient evidence.

This is a practical control for Australian accounts-payable teams, including those paying overseas suppliers. It is not a guarantee against fraud or a substitute for the bank's security procedures. The aim is to make the payment decision reconstructable before money leaves the business.

Separate the request from its verification. Use a trusted contact route that did not come from the change request. Keep an approval record for the supplier master data, and compare the payment file with that approved record. Urgency should escalate the decision, not remove the checks.

Scamwatch's business email compromise guidance describes criminals altering legitimate invoices or impersonating a business to redirect payments. It recommends checking payment details through contact information independently obtained, rather than relying on details in a suspicious message. If money has already been sent, contact the bank immediately.

A control limited to spotting spelling errors will miss a convincing request sent from a compromised mailbox. The following workflow is an original implementation method based on that threat; its proposed records and role separation are practical controls, not a prescribed Australian statutory form.

Record the supplier identifier, affected invoice, amount and currency, received date, requested effective date and requester. Flag the supplier account so that an automatic payment run cannot use the new details while the check is open.

Keep the request and attachments in an access-controlled case record. Avoid circulating full bank details in broad email groups or screenshots. Retain only the personal information needed for the verification and the organisation's established record obligations.

Start with a previously verified supplier contact held in an established contract or supplier record. If that record is unreliable or unavailable, establish an independent route and document how it was obtained. Do not use the telephone number, link or new contact introduced by the bank-change email as the sole verification channel.

Confirm the legal supplier identity, the intended account change and its effective date. For an overseas supplier, arrange a callback during its local working hours and check currency and account-format requirements through the normal banking process. Do not let the time difference turn an unresolved request into an approved one.

Record who made the check, whom they reached, the trusted contact source, the time and the outcome. Avoid treating a tick labelled “called supplier” as enough when it does not identify the route or the details verified. If the response conflicts with the request, keep the hold and escalate through the organisation's fraud process.

Once verification is satisfactory, an authorised person approves the supplier-record change. Preserve the prior value securely and link the change to the verification case. Limit edit rights so that an email recipient cannot silently overwrite the record and release the payment without the required checks.

At payment approval, compare the beneficiary details in the actual payment instruction with the approved supplier record. Check the amount, currency, invoice and any duplicate-payment warning. A correct master record does not help if someone manually enters a different account in the bank portal.

For smaller teams, define a realistic second check by an owner or other authorised person. If independent verification of the changed details remains incomplete, keep the payment on hold and escalate through the organisation's fraud and payment-control process. Urgency is a reason to accelerate the verification, not to replace it with acceptance of an unexplained gap.

Fictional completed decision record. An accounts-payable clerk receives a request to change the beneficiary for an AUD 18,400 invoice. These details illustrate a control decision, not an actual transaction or fraud finding.

The case is not closed simply because the supplier callback succeeded. The payment preparer must explain and correct the conflicting instruction through the authorised process, and a checker must compare the resulting instruction again. Neither a plausible explanation nor a screenshot of the master record demonstrates what the bank would receive.

The management summary can state the supplier identifier, amount, hold reason, owner and next action without exposing full bank details. The evidence supports a narrow conclusion: an inconsistency was identified in this invented case. It neither proves criminal intent nor demonstrates that the overall payment-control system prevents every fraud.

Check that the record update, payment approval and bank instruction all refer to the same case. Review attempted changes, bypasses and unresolved holds without exposing bank details in general management reports. Feed repeated incidents into supplier cyber assurance at renewal.

If an incorrect payment is discovered, contact the bank immediately using its trusted channel and follow the organisation's incident process. Preserve evidence and assess appropriate reporting with the relevant specialists. Do not wait for an internal root-cause meeting before seeking the bank's help; recovery is not assured.

AI assistance was used in preparing this article. No client transaction, loss-prevention result or firsthand fraud investigation is claimed.

This article is general information. Verify current requirements and seek qualified advice for your specific circumstances.

Spotted an issue? Contact our editorial desk.