How do you check a change to a supplier's bank details?
Quick answer
Do not act on the email. Phone the supplier on contact details you have verified separately, such as a number from your own records or their website, never the number in the message1. ASD asks for a clear, consistent process to verify requests for payment1, and Scamwatch says to confirm banking details are correct before paying2.
On this page
Why is a change of bank details a red flag?
Because it is how invoice fraud works. ASD describes criminals getting into a supplier's email account, editing the contact and bank details on genuine invoices, and sending them to customers from the real account1. Scamwatch says small businesses are often targeted with an invoice they were expecting, but with altered payee and contact details3.
The contact details that arrive with a changed invoice can be edited too13, so check through a number from somewhere else.
ASD lists an unexpected change of bank details as a warning sign by itself1.
How do you do a call-back check, step by step?
The idea is simple: check through a different door from the one the request came through.
- Stop. Do not change the details and do not pay. Scamwatch says not to action a request about financial details that you know nothing about until you are sure it is genuine4.
- Find a number you can trust. Use contact details you have verified separately, such as a number from your own records or the supplier's website, not anything from the message12.
- Phone and ask if they sent it. Use the call-back script.
- Get a second opinion. Ask a colleague, or someone you trust, to look at the request before you act2.
- Confirm the banking details before you pay2.
- Do it the same way every time, for every supplier. ASD asks for a clear and consistent process1.
What does a worked example look like?
This example is made up for this guide. It is not a real business.
Sam runs a small joinery firm and pays a timber supplier every month. Late on a Friday, an email arrives that looks like it is from the supplier's accounts person. It says the supplier has a new bank and asks Sam to pay the next invoice into a new account.
Sam does not reply. First, Sam looks at the sender's address. One letter is different from the supplier's real domain, which ASD lists as a warning sign1. Next, Sam finds the supplier's number in last year's paid invoices, not in the email, and phones it1. The supplier says no change was requested. Sam does not pay the new account, and tells the supplier, whose email account may have been taken over1.
Compare the real Scamwatch story: an accounts manager got an email late on a Friday and changed a supplier's details without a check4. The fake came to light 2 weeks later, when the goods had not arrived4.
Which red flags should make you stop?
| Red flag | What it looks like | Source |
|---|---|---|
| Unexpected change of bank details | New account number or payee with no warning | 1 |
| Urgency or threats | Pay today, or something serious will happen | 1 |
| An unusual request from the boss | A payment request from a senior person that is out of character | 1 |
| Pretending to be the owner | Urgency and secrecy, with a claim that the matter is sensitive | 2 |
| Sender address not quite right | A domain that does not exactly match the supplier's company name | 1 |
| Altered invoice | An expected invoice, but with a different payee and contact details | 3 |
| Pressure to skip your usual steps | Secrecy, or a request to get around your process | 1 |
| It looks exactly right | Phone numbers, email addresses and SMS senders can be spoofed | 2 |
The last row matters most. Looking right is not proof. Scamwatch says not to assume that contact is real, even when it looks like it comes from someone you trust2.
What if you have already paid?
Move fast. The steps for the first hour are in what to do after paying a fake invoice. The main one is to call your bank immediately1.
Should you write the rule down?
Yes, so that new staff and busy days do not change it. ASD says workers should have clear guidance to verify account details, and a way to report pressure and demands for secrecy1. It also lists training staff to spot suspicious emails among its key actions1. Scamwatch suggests considering eInvoicing to reduce the risk of fake invoices3. The payment fraud kit gives you the rule as an editable document, and the free AI-scam tools cover fake voices and messages.
Frequently asked questions
Can I use the phone number on the invoice?
No. ASD says criminals can edit the contact details on genuine invoices1. Use contact details you have verified separately1.
What if the supplier's email really was hacked?
The call-back still works, because it does not rely on email. It is also why the check matters: ASD describes criminals using a supplier's real email account1.
Do I need two people to approve a change?
The sources do not set a number of approvers. Scamwatch lists getting a second opinion as a check2, and ASD asks for a clear, consistent process1. Decide your own rule and write it down.
Does eInvoicing help?
Scamwatch suggests considering it to reduce the risk of fake invoice scams3. It does not replace the call-back check for a changed account.
What if the change turns out to be genuine?
Confirm the banking details are correct before you pay2, then update your records.
Sources
Each number in the text links to the document the fact comes from. We keep a dated copy of every source with its SHA-256 fingerprint, so we can show what it said on the day we checked it.
- Source 1: Protecting against business email compromise (guidance page on cyber.gov.au). Australian Signals Directorate (ASD), cyber.gov.au, checked 2 November 2026.
https://www.cyber.gov.au/publication/protecting-against-business-email-compromise - Source 2: Small business scams: Scams impacting small business (Scamwatch guidance PDF). Scamwatch, National Anti-Scam Centre (ACCC), checked 2 November 2026.
https://www.scamwatch.gov.au/system/files/small-business-scams-guidance_1.pdf - Source 3: Protect your small business from scams (Scamwatch). Scamwatch, National Anti-Scam Centre (ACCC), checked 2 November 2026.
https://www.scamwatch.gov.au/stop-check-protect/protect-your-small-business-from-scams - Source 4: False billing: John updated supplier details and it ended up costing thousands (Scamwatch scam story, based on real reports). Scamwatch, National Anti-Scam Centre (ACCC), checked 2 November 2026.
https://www.scamwatch.gov.au/stop-check-protect/real-life-stories/false-billing-john-updated-supplier-details-and-it-ended-up-costing-thousands
Aptia Skills is a private training company. It is not connected with any bank, police force, regulator, FINTRAC or government, and this guide is general information, not legal or financial advice.