Verify a supplier bank-detail change without trusting the email thread

A familiar supplier emails an amended invoice. The amount is expected, the purchase order is correct and the message sits in an existing conversation. Only the bank details have changed.

That is a payment-change request, not evidence that the new destination is legitimate. Scamwatch explains that scammers impersonate a business and send invoices with changed payee information. Familiarity is not enough to approve the change.

For a lean Australian organisation, including an APRA-regulated business, the useful control is a clear handoff between the supplier owner, finance and whoever can approve a change. The workflow below is an original practical design, not a regulatory checklist, guarantee against fraud or instruction to make a payment.

Separate three decisions

Do not combine these questions into a single “verified” checkbox:

1. Is the request authentic? Has an authorised supplier representative confirmed the change through an independently established route?
2. May our supplier record change? Has the person with the appropriate internal authority approved the specific amendment?
3. May this payment be released? Have the usual invoice and payment controls been completed using the approved record?

A valid invoice does not answer the first two questions. A genuine change request does not authorise payment of every invoice attached to it.

Finance should own the payment process. The supplier relationship owner can help establish who is authorised to speak for the supplier. Risk and security teams help define escalation when evidence conflicts or compromise is suspected.

Hold the proposed change, not the question

Capture the request in the organisation's controlled process. Keep the existing approved supplier record separate from the proposed amendment, and identify any payment batch that might use the new information.

Avoid copying full banking details into widely shared risk registers or chat channels. Store sensitive evidence in the authorised finance system or restricted location; the risk record can point to its reference.

The hold needs an owner and a next action. “Waiting for confirmation” is inadequate if nobody checks it before the next payment run. A service owner should also assess any operational impact of a delay and raise it through the approved process. Urgency changes the escalation priority, not the evidence needed to accept new bank details.

Verify the change independently

Scamwatch recommends checking changed payee information by contacting the business through a phone number sourced independently. Do not use the replacement number or link supplied in the change request as its own proof.

Use the organisation's approved method to establish the supplier contact and their authority. A previously verified record may help, but check whether that record was itself recently amended. If it is stale or contested, resolve that problem before relying on it.

Confirm the specific change and its intended effective date through the approved secure process. Record who was reached, their role, how the contact route was established, what was confirmed and who performed the check. A note saying “called supplier” leaves the important questions unanswered.

A reply from the original email address is not independent confirmation if that account may be compromised. Equally, a signed letter or bank document arriving through the disputed route should not be treated as sufficient proof merely because it looks formal.

The animation illustrates a conditional approval path when the evidence supports the amendment. It does not approve the disputed request in the fictional example below.

Test the handoff with a fictional example

Banksia Services is a fictional organisation preparing its Friday payment run. An email apparently from its facilities supplier asks finance to replace the account used for future invoices. It also asks staff to use a new phone number for verification.

The accounts officer records the proposed change but does not overwrite the approved details. The supplier owner checks the established supplier record and arranges verification through the previously validated finance contact, rather than the number in the email.

That contact says no change was requested. Finance leaves the amendment unapproved, holds the affected payment for investigation and alerts the security lead. It does not assume the old account is automatically safe or decide on its own to send money there instead.

The important result is not “the call was made”. It is that contradictory evidence prevented an unapproved record change and triggered an accountable decision. No real organisation, payment or account is described here.

Make approval independent of data entry

As an internal control design, assign a second authorised person to compare the proposed amendment with the verification evidence before the record changes. Separate amendment approval from payment release wherever the team's approved process permits.

Small teams should name a backup approver in advance. If the normal person is away, use the authorised escalation route rather than letting one person invent an exception under time pressure.

Keep a concise decision record: request reference, verification method, discrepancies, decision, approver, effective date and affected transactions. After an approved update, check that the actual system entry matches the approved amendment. Approval of the right information does not prevent a transcription error.

Escalate suspected compromise promptly

If money may have gone to the wrong destination, contact the financial institution immediately rather than waiting for the supplier investigation to finish. The Australian Government's business email compromise recovery guidance also covers reporting the incident, reviewing account security and retaining a record of actions. Recovery is not assured.

Use the organisation's supplier-incident escalation process for operational and security coordination. For a broader review of email and account controls, CPA Australia's cyber security checklist provides useful professional context.

Start with one question: could someone enter a new supplier account and release a payment using only evidence from the same email thread? If so, define the missing independent check before the next change arrives.