After a payment scare, change how bank details are approved
A payment scare should change the next approval
Imagine a diverted supplier payment left your business scrambling to fund the real invoice. The immediate problem has been addressed, and the next job is starting. A new payment request arrives with changed bank details.
Use the earlier scare to change the process before money leaves again. A familiar logo and a correct invoice amount do not verify the destination account. Assign the check rather than relying on everyone remembering to be more careful.
A familiar-looking message still needs checking
business.gov.au warns that scammers impersonate trusted businesses and that requests to change bank details need direct verification using contact details you already trust. A familiar appearance is not enough to confirm the new account.
Use a contact you already trust
Call the supplier on a number from your established records, rather than a number supplied in the change request. Ask the appropriate accounts contact to confirm that a change was requested and explain your verification process.
If you cannot reach that person, flag the payment for review. Do not let an urgent message turn an unverified account into an approved one. Record any payment timing issue and discuss it with the supplier through the trusted channel.
Keep the change separate from the payment approval
One practical control is to record who checked the account change and who authorised the payment. Keep the date and supporting correspondence beside the supplier record.
For a small business, that might mean the owner checks the change before the bookkeeper updates it. The important point is that copying details from the email is not treated as verification.
After the incident, test the revised process with the people who prepare and approve payments. Record who checks a change when the owner is on site or the usual bookkeeper is away. A recovery lesson needs a workable backup, not just a verbal warning.
If money has already gone, act promptly
business.gov.au advises contacting your bank immediately if money has been transferred in a suspected scam, and securing affected accounts. Preserve the emails and payment reference, and involve your IT support where an account may be compromised. Prompt action does not guarantee recovery.
Resolve the payment problem before repeating it
Confirm with the real supplier what it received and keep any disagreement about the unpaid invoice separate from the fraud investigation. Do not automatically send a second payment without checking the position.
Review the first payment runs under the revised process and keep unresolved changes visible. If the earlier loss still leaves the business unable to meet bills, put the amount and timing in front of an adviser or CRP. Bank and IT support remain the immediate contacts for any fresh suspected fraud.