New Bank Details on an Invoice? A Simple Verification Routine
A practical payment-change check for Australian businesses, including trusted callbacks, approval records and urgent response steps.
Treat changed payment details as a separate request
An invoice can look familiar and still contain a fraudulent payment destination. A genuine email account may be compromised, so the sender's name, conversation history or correct project details do not establish that the change is legitimate.
Create a routine in which new or changed bank details are verified independently before the supplier record or payment is updated. Make the rule apply when the request appears urgent or comes from senior staff.
Use a known contact route
Call a trusted contact using a number already held in your records or independently established through an appropriate source. Do not use the replacement number supplied in the change request. Explain that you are verifying the payment details under the business's process.
Replying to the same email thread is not an independent check if the account is controlled by an attacker. Ask staff to use the agreed route even when the supplier is familiar.
A short approval checklist
- Has the change been verified with an authorised contact?
- Was the contact route independent of the request?
- Are the approved details recorded accurately?
- Has the required second approval been obtained?
- Is there a record of who verified the change and when?
Practise an everyday example
A regular supplier emails an invoice and says the old bank account is being closed. The accounts person pauses the change, calls the supplier's established finance contact and records the outcome. If the contact cannot confirm the change, payment waits under the agreed escalation process.
This is a sample routine. Your business should decide who can approve exceptions and how urgent payments are handled without bypassing verification.
If a payment may already have been redirected
Contact the bank immediately through a trusted channel and explain the suspected fraud. Alert the business's incident lead and IT provider. Preserve the message, payment reference and timing. Follow the bank's instructions and the relevant reporting or advice process.
The technical investigation should also consider the affected account, email rules and other related messages. Do not assume that reversing one payment closes the incident.
Combine people and technical controls
MFA, email protection and account monitoring support the process, but they do not replace the callback. Give staff a clear route to question a request without fear of blame.
Discuss email and account protection with NOX cybersecurity services. Share the official Scamwatch guidance below with the people approving payments.
Official reference: Scamwatch business email compromise guidance.