What should you say when you call to check a bank-detail change?
Quick answer
Ring on contact details you have verified separately, say you are checking a request to change bank details, and ask whether the supplier sent it. If not, do not pay12. Confirm the account details before paying, with a second opinion3. The printable sheets below hold the script and a log.
On this page
What is a call-back check?
It is a phone call that you start, to a number you trust, to confirm a request that arrived another way. ASD says that if a message seems suspicious you should contact the person separately, using contact details you have verified separately, such as a phone number taken from the organisation's website1.
The reason is that the request itself cannot vouch for its own contact details. Scammers can make a phone number, email address or SMS sender look exactly like a real one3, and they can edit the contact details on a genuine invoice1.
What should you say on the call?
Keep it short and calm. You are checking, not accusing. A call can follow this order:
- Say who you are. Give your name and your business, and say you are checking a request to change bank details.
- Ask the key question. "Did you send us a request to change your bank details?"
- If the answer is no, stop. Do not action the request and do not pay the new account2. Tell the supplier, because their email account may have been compromised1.
- If the answer is yes, ask them to confirm the account details3.
- Say that a second person checks changes before you pay. A second opinion is one of the checks Scamwatch lists3.
- Keep your own checks private. Phishing scammers try to get a business's payment security procedures, so do not explain how your checks work to someone you have not verified4.
Use contact details you have verified separately, never the ones that arrived with the request1.
What should be on the checklist?
Use the same checklist every time. ASD asks for a clear and consistent process to verify requests for payment1.
| Check | Why | Source |
|---|---|---|
| Stop and do not action the request yet | Do not act on financial details you know nothing about until you are sure | 2 |
| Look at the sender's address | A domain that does not exactly match the supplier's name is a warning sign | 1 |
| Ring a number you trust | Use contact details verified separately, not the message | 1 |
| Ask them to confirm the new details | Confirm banking details are correct before making payment | 3 |
| Get a second opinion | Scamwatch lists it as a check | 3 |
| Write down what you did | A consistent, repeatable process | 1 |
Want the call-back script and checklist to print?
Tick the sheets you want, type your business name, and print them or save them as a PDF. Keep the log with your supplier records.
Call-back script and call log
Say who you are and that you are checking a request to change bank details. Ask: did you send us that request? If the answer is no, do not pay and do not action the request2. If yes, ask them to confirm the account details3. Do not describe how your payment checks work to anyone you have not verified4. Plan a second person's check of the details before you pay3. Ring only on contact details you have verified separately, never the ones that came with the request1.
| Supplier | Date and time of call | Number called | Person spoken to | Result | Second person's initials |
|---|---|---|---|---|---|
A starting point, not a legal document. Adapt it to how your business works and use the same steps every time1.
Bank-detail change checklist
Before you change any bank details: stop, and do not action the request until you are sure it is genuine2. Look at the sender's address and whether its domain matches the supplier's company name1. Phone the supplier on contact details you have verified separately1. Confirm the banking details are correct before you pay3. Get a second opinion3. Write down what you did, and use the same steps every time1.
| Supplier | Request received (date and how) | Where the phone number came from | Call made and confirmed | Second person's initials | Safe to pay (yes or no) |
|---|---|---|---|---|---|
A starting point, not a legal document. Adapt it to how your business works and use the same steps every time1.
Nothing is sent and nothing is stored: the name and month appear only on your screen and on your printout.
What if nobody answers, or the answer is no?
Do not pay the new account. If the supplier says they sent no request, the email may be a scam. ASD says to report a cybercrime to the police through ReportCyber5, and Scamwatch uses reports to warn the community about new scams6. If you have already paid, follow what to do after paying a fake invoice.
If nobody answers, wait. Urgency is a warning sign in itself1. A late payment can be explained to a supplier, but a lost payment is harder to fix.
How does this fit with your wider rules?
The call is one step in a written process. How to check a change to a supplier's bank details shows the full steps and a table of red flags. The payment fraud kit holds the call-back rule, the first-hour steps and a short staff briefing as editable documents. The free AI-scam tools cover fake messages and voices.
Frequently asked questions
Which phone number should I use for the call?
One you have verified separately, such as a number from your own records or the supplier's website1. Never use a number that came with the request1.
Should I read out the new bank details to the supplier?
Ask the supplier to confirm the details, and check them before you pay3. Do not describe your internal payment checks to someone you have not verified4.
Do I need to use these exact words?
No. The words are a guide. What matters are the rules behind them, and they come from ASD and Scamwatch13.
Who should keep the log?
Whoever makes payments, and a second person who checks. The sources ask for a clear and consistent process1, so name the people in your own written rule.
Sources
Each number in the text links to the document the fact comes from. We keep a dated copy of every source with its SHA-256 fingerprint, so we can show what it said on the day we checked it.
- Source 1: Protecting against business email compromise (guidance page on cyber.gov.au). Australian Signals Directorate (ASD), cyber.gov.au, checked 2 November 2026.
https://www.cyber.gov.au/publication/protecting-against-business-email-compromise - Source 2: False billing: John updated supplier details and it ended up costing thousands (Scamwatch scam story, based on real reports). Scamwatch, National Anti-Scam Centre (ACCC), checked 2 November 2026.
https://www.scamwatch.gov.au/stop-check-protect/real-life-stories/false-billing-john-updated-supplier-details-and-it-ended-up-costing-thousands - Source 3: Small business scams: Scams impacting small business (Scamwatch guidance PDF). Scamwatch, National Anti-Scam Centre (ACCC), checked 2 November 2026.
https://www.scamwatch.gov.au/system/files/small-business-scams-guidance_1.pdf - Source 4: Protect your small business from scams (Scamwatch). Scamwatch, National Anti-Scam Centre (ACCC), checked 2 November 2026.
https://www.scamwatch.gov.au/stop-check-protect/protect-your-small-business-from-scams - Source 5: Help during a cybercrime (cyber.gov.au). Australian Signals Directorate (ASD), cyber.gov.au, checked 2 November 2026.
https://www.cyber.gov.au/guidance/help-during-a-cybercrime - Source 6: Report a scam (Scamwatch). Scamwatch, National Anti-Scam Centre (ACCC), checked 2 November 2026.
https://www.scamwatch.gov.au/report-a-scam
Aptia Skills is a private training company. It is not connected with any bank, police force, regulator, FINTRAC or government, and this guide is general information, not legal or financial advice.