How do bank detail change scams work?
The Australian Signals Directorate describes invoice fraud as a form of business email compromise. Criminals gain access to a supplier's email account, edit the contact and bank details on genuine invoices, and send them to the supplier's customers from the real address. The customer pays what looks like a normal bill. Other versions use a look-alike domain, or impersonate a senior person in the business asking for an urgent payment or a change to an employee's pay account. Because the email can come from the supplier's own mailbox, checking the sender address does not catch it.
What are the warning signs?
ASD lists four signs for staff to watch: an unexpected change of bank details, an urgent payment request or a threat of consequences if payment is late, an unusual payment request from someone in authority, and an email address that does not quite match the supplier's name. In an AP process, the ledger and any automation can watch for further signals that a person might miss when the bill looks routine.
- The bank account on a bill differs from the one on the supplier's contact record.
- A payment is about to go to an account added recently.
- The supplier's email address or phone number changed shortly before the bank details did.
- The amount or frequency falls outside the supplier's past pattern.
How should a change be verified?
Call the supplier on a phone number you already hold, or one taken from the supplier's official website, which is the method ASD recommends. Never use a number given in the request. Ask the supplier to read out the new BSB and account number; do not read them out yourself. Record who made the call, who answered, the date and the number used. If the supplier cannot be reached, the change waits. Larger suppliers with an accounts receivable team may also be able to confirm through a supplier portal you already use.
Who should be allowed to edit bank details?
Limit the ledger permission to edit supplier bank details to as few people as practical, and keep it separate from the permission to approve payment runs where the team is large enough. A second person should review each change against the call-back record before the next payment. In a practice that runs AP for clients, write down for each client whether the practice or the client approves bank detail changes, and keep that in the engagement records. No automated workflow should hold a role that can edit bank details or release payments.
Where should automation stop?
AP automation can read bank details printed on each bill, compare them with the contact record and flag any difference before the bill reaches approval. It can hold every bill from that supplier until a person records the verification, show the change on the payment batch and add it to an audit log. It should not update a contact's bank details from an email or invoice, send a confirmation request to the address that asked for the change, or include a bill with changed details in a payment batch. Those steps belong to named people.
What if a payment has already gone to the wrong account?
ASD's advice is to contact your bank immediately if money or banking details have been sent to a scammer, report the cybercrime to ASD, change the passwords on any compromised email accounts and notify anyone affected. Call the bank first, since it is the first step ASD lists. Then keep the emails and invoice files, write down the timeline, and tell the supplier through a known contact. Once the immediate steps are done, review how the change got through so the control can be fixed for every client or entity it covers.