Treat a request to change a supplier’s payment details as something to verify before anyone updates the supplier record or releases payment. Even a familiar email address or an existing conversation can be involved in a business email compromise scam.
Pause the change and use a separate contact route
Find the supplier’s previously verified phone number in your established business records. Make an outbound call using that number and ask for your usual contact or the accounts team. If the record is missing or uncertain, verify the business through an independently reached official source.
Do not use a phone number or link supplied in the change request to verify that same request. Replying to the email is also insufficient if the mailbox or conversation has been compromised. Scamwatch’s business email compromise guidance recommends independently checking changes to payment details.
Ask a clear question and record the answer
A simple opening is: “We received a request to change your payment details. I’m calling the number we already hold to verify it before anything is updated. Has your business requested this change?”
If the supplier confirms a legitimate change, verify the effective date and intended payment details through your business’s approved procedure. Do not disclose your own banking credentials, passwords or one-time codes during the call.
Record who was reached, where the trusted number came from, when the check happened and the outcome in an access-controlled record. Keep any account details inside the approved finance system or other authorised secure record, rather than a general email thread or team chat.
Follow the actual approval process before updating the supplier record or paying. Where your process requires a second person, have them review the independent verification before approval. If there is no clear process, keep the change paused and ask the finance lead or business owner to decide how it should be authorised.
Notice pressure without relying on warning signs alone
Urgency, secrecy or a request to bypass normal checks should increase caution. A correct logo, ABN, invoice amount or familiar writing style does not establish that the bank-account change is genuine. Scamwatch’s fake business invoice alert explains how a convincing invoice and replies from a compromised account can support the deception.
Fictional example: An invoice arrives in a familiar thread with new bank details and a request to pay before lunch. The accounts assistant pauses the payment and calls the supplier using the established contact number. The supplier says no change was requested. The business keeps the message and alerts its finance lead and IT support. This is an illustrative scenario, not an Osmicro client incident.
Practise the verification and escalation steps with staff before an urgent invoice arrives. Osmicro’s cyber security awareness training can support that preparation.
Escalate a mismatch and act quickly after a payment
If verification fails or the information conflicts, keep the change and affected payment paused. Escalate to the person responsible for finance or the business owner, and involve IT or security support if email compromise is suspected. For help reviewing the technical evidence, contact your usual IT provider or Osmicro’s service desk.
If money has already been sent to a suspected scam account, or you have disclosed banking details, contact your bank immediately through a trusted channel. Use the bank’s official app or a number you independently know is genuine. Do not wait for an internal investigation or a reporting form to be completed. Stop further contact with the suspected scammer and follow the bank’s instructions. CommBank’s scam guidance, for example, explains why quick reporting matters and why recovery cannot be assumed.
Preserve the original message, invoice and relevant transaction records for the bank and authorised investigators. Follow your business’s incident process and report the scam to Scamwatch. The ACSC’s business email compromise guidance also directs victims to ReportCyber. Keep reporting copies restricted to the people and services handling the incident.
If an account may be compromised, involve IT promptly to contain access and review the evidence. Osmicro’s guide to responding to a compromised work mailbox explains why mailbox access and sign-in activity also need attention.
A short checklist for the next request
- Pause the bank-detail change and affected payment.
- Call a previously verified number from established records.
- Confirm the request, effective date and intended details through the approved process.
- Record the verification securely and obtain the required approval.
- Escalate any mismatch. If funds or banking details were sent to a suspected scammer, contact the bank immediately.
Apply the independent check to every payment-detail change, including requests that look routine.