An unexpected request to change bank details needs independent verification before the organisation updates a payment record or transfers money. Pause the requested action and use the actual finance and security process, even when the message appears to come from a familiar contact.
A real supplier can change its account, but an email alone does not establish that the change is genuine. The purpose of the check is an authorised, evidenced decision rather than an accusation.
Recognise the process risk
Australian cyber-security guidance on business email compromise describes scams involving altered invoices or payment details and the need for verification and reporting processes.
Look at the request in context: changed banking information, pressure for immediate payment, secrecy or an instruction to skip normal checks all warrant attention. A matching email signature or invoice reference does not independently verify the sender or account.
Do not test the details with a small payment or reply with sensitive information as an improvised check. Follow the organisation’s approved method.
Use an independently established contact
Obtain the verification contact from a trusted existing record or another authorised independent source. Do not rely solely on the new number or link supplied in the message requesting the change. This is a useful example of the checking responsibilities relevant to administration roles: preparing a verification record does not give the preparer authority to change supplier banking details or approve payment.
Use the actual identity and payment-verification procedure, including required approvals and separation of responsibilities. Caller identity displays or a familiar voice should not become a reason to bypass it.
If the legitimate contact cannot be reached, keep the change pending and refer the timing issue to the authorised person rather than treating urgency as approval.
A verification record
Record without exposing bank details in a general tracker:
- Request: relevant invoice or supplier reference and time received.
- Change: the category of update requested.
- Source: message or document preserved through the approved process.
- Verification: independently established route and authorised checker.
- Outcome: confirmed, unresolved or referred for security review.
- Approval: decision owner and required controls completed.
- Update: authorised system change and appropriate verification evidence.
- Follow-up: payment or incident action still required.
Keep sensitive financial and personal information in the correct restricted record.
A fictional account-change enquiry
In this invented example, an accounts employee receives revised payment details shortly before an invoice is due. They record the request, pause the update and contact the supplier through the established verification route.
The supplier says it did not request the change. The employee refers the message to the designated security and finance contacts and preserves the evidence. They do not amend the account or accuse another person publicly.
No actual fraud, supplier or bank account is described in this example.
Act promptly if payment may already be affected
Report an action already taken immediately through the designated finance and security route. The official recovery guidance advises contacting the bank promptly where banking details or funds may be involved. Follow the organisation’s authorised incident arrangements without waiting for a routine review.
Afterwards, check why the request could reach the payment process and whether controls need improvement. A reliable verification process leaves a clear decision trail and keeps an unverified message from becoming an unauthorised financial instruction.
