For businesses Payment fraud kit
Payment fraud and AI-scam controls kit for small businesses.
A Word kit for Australian small businesses that pay suppliers by bank transfer: a callback procedure and log, a bank-detail change form, a two-person approval rule, a voice-clone and deepfake procedure, first-hour incident steps, a training record and an insurer-questions sheet. Filled in with your details. A$79, instant download.
From A$79 · one-off payment · instant Word download
- A written payment verification and callback procedure that says who calls whom, on which number, before anyone changes a supplier’s bank details, and what is never trusted on its own: caller ID, an email signature, a familiar voice or a video call.
- A callback log and a supplier bank-detail change form, so that every check leaves a dated record.
- A two-person approval rule set at the dollar amount you choose, with the roles that approve payments named, and a procedure for voice-clone and deepfake calls with code words and a call back on a known number.
- First-hour incident steps (bank, evidence, ReportCyber, Scamwatch, IDCARE), a staff sign-off and training record, and a worksheet that maps your controls to the payment-fraud questions insurers commonly ask.
Aptia Skills
Payment fraud and AI-scam controls kit
Prepared for: Example Trade Supplies
- Start here: how to use this kit
- Payment verification and callback procedure
- Callback log
- Supplier bank-detail change form
- Two-person payment approval rule
- Voice-clone and deepfake procedure
+ 3
You came back without paying. Nothing was charged.
What is inside.
Every document, filled in with your details, in one Word file you can edit.
Payment fraud controls kit 9 documents
- GuideStart here: how to use this kitWhat is in the kit, what it can and cannot do, your set-up in one table, and how to build a dated evidence file.
- ProcedurePayment verification and callback procedureWho calls whom, on which number, before the business adds a payee or changes bank details, and what is never trusted on its own.
- RegisterCallback logA dated record of every callback made to check a payee or bank-detail change.
- FormSupplier bank-detail change formOne form for every request to add or change a payee’s bank details, signed by a second person before anything is changed.
- PolicyTwo-person payment approval ruleWhich payments need two people to approve, who they are, and what the second person checks.
- ProcedureVoice-clone and deepfake procedureWhat to do when a phone call, voice message or video call asks for money or a change of bank details, including code words and calling back on a known number.
- ProcedureFirst-hour incident stepsWhat to do in the first hour after money, bank details or email access may have gone to a scammer: bank, evidence, reports and support.
- RegisterStaff sign-off sheet and training recordA signed record that each person has read the payment controls and been trained, plus a yearly practice drill log.
- GuideAnswers to common insurer questionsA worksheet that maps your payment controls to the four kinds of payment-fraud question insurers commonly ask.
See a real page.
This is what a page looks like, filled in for an example business.
1. Payment verification and callback procedure
Purpose
Example Trade Supplies checks every request to add a payee or to change where money is sent before any money moves. Scammers copy real invoices, email trails, logos and even voices, so a message cannot prove it is genuine. The only reliable check is a phone call to a number Example Trade Supplies already holds. (ASD, Protecting against business email compromise; Scamwatch, supplier email hacked (victim story))
Scope
This procedure applies to Example Trade Supplies and to everyone who adds or changes a payee, enters a bill, approves a payment, releases a payment or answers the phone or email for the business, including the roles that approve payments (Director and Office Manager), casual staff and volunteers.
Why we do this
Small businesses are often targeted with an invoice they were expecting but with altered payee and contact details, or with a request to move a large sum out of the business’s accounts that claims to come from the owner or senior staff. (Scamwatch, Protect your small business from scams)
Our rule
- Any request to add a new payee, or to change a payee’s bank account (BSB, account number, PayID or remittance email), is checked by a callback before the change is made.
- The callback goes to a phone number Example Trade Supplies already holds: from an earlier invoice that was paid and received, the supplier file, a signed contract, or the supplier’s own website found independently. It never goes to a number, link or email address in the request.
- Verification is never done by replying to the email that made the request.
- Nobody changes bank details, and nobody pays to changed details, until the callback is recorded in the callback log and a second person has checked the bank-detail change form.
- A request from the owner or a senior person to pay someone urgently, or to skip these steps, is checked in the same way. Nobody at Example Trade Supplies is allowed to ask staff to bypass this procedure. (Scamwatch, supplier email hacked (victim story); Scamwatch, BEC alert, Nov 2018; Scamwatch, payment redirection alert, Mar 2021)
- Staff who ask to change the bank account their wages are paid into are checked in person, or by calling the number held on their file, before payroll is changed. Scammers pose as staff to redirect salaries. (ASD, Protecting against business email compromise; Scamwatch, payment redirection alert, Mar 2021)
What we never trust on its own
Each of these can be faked, copied or hacked. None of them replaces the callback.
| Do not rely on | Why |
|---|---|
| The sender’s name or email address looking right | Criminals can use a hacked genuine account, or a near-identical address. In one reported case the business checked that the sender’s address matched, and still lost the money. |
| An email signature, logo or letterhead | Scammers may use stolen letterhead and branding or even hacked emails. |
| An earlier email trail or copies of past invoices | The scammers in a reported case included copies of previous invoices, and everything looked like a perfect copy. |
| Caller ID, or a number that looks right | Phone numbers, email addresses and message sender IDs can be spoofed to look exactly like a real one. |
Warning signs
Staff are told to look for these, and to report them to the person responsible (Jane Smith, Director) at once:
- an unexpected change of bank details
- an urgent payment request, or threats of serious consequences if payment is not made
- an unexpected payment request from someone in authority, particularly one that is unusual for that person
- an email address that does not look quite right, such as a domain name that does not exactly match the supplier’s company name
- an invoice for a listing, advertisement or renewal that nobody remembers ordering (ASD, Protecting against business email compromise; Scamwatch, Protect your small business from scams)
Procedure: a request to add a payee or change bank details
- Stop. Do not change anything and do not reply with the new details. Save the message and any attachment as it arrived.
- Find a number you already hold for the supplier. Use an earlier paid invoice, the supplier file or a signed contract. If you have none, find the number independently (for example the supplier’s own website, typed in by hand, not a link from the message) and say so in the log. Do not use any number in the request.
- Call and speak to a person you know at the supplier, or to the usual contact. Tell them you are checking a request to change bank details.
- Ask them to read out the new BSB and account number, and the account name. Do not read the details in the request to them first. Ask why the details are changing and from when.
- Compare what they said with the request. If anything differs, or you cannot reach anyone, do not change the details and do not pay to the new account. Tell the person responsible (Jane Smith, Director) and keep paying the old details, or wait.
- Complete the supplier bank-detail change form and write the callback in the callback log: date, who you spoke to, the number you called and where it came from, and the outcome.
- Give the form and log entry to a second person from Director and Office Manager. They check the number’s source, the read-back and the account name before anything is changed. The person who made the call cannot be the second person.
- Only then change the details. For the first payment to changed details, pay in the normal payment run, not as an urgent exception, and keep the bank’s payee name check result with the form. (Scamwatch, supplier email hacked (victim story); ASD, Protecting against business email compromise; Scamwatch, BEC alert, Nov 2018; AP+, Confirmation of Payee)
The rules, in brief.
What the official sources say, word for word checked.
Scammers often pose as a regular supplier and say its banking details have changed, sometimes using stolen letterhead and branding or even hacked emails.
Contact the supplier directly using a second, reliable way to communicate, such as a known phone number, to verify any request to change bank details.
Set up a clear and consistent business process for workers to verify and validate requests for payment and sensitive information.
Consider a multi-person approval process for transactions over a certain dollar threshold.
Scammers can use a few seconds of a voice recording to create an AI clone of a voice.
Vishing is a voice-based scam in which criminals use tools like voice cloning, deepfake technology or fake caller IDs to sound real.
Sources: ASD, Learn about phishing scams
Contact your bank or card provider immediately to report the scam, and ask them to stop any transactions.
After you submit a report, record your Report Reference Number (starting with CIRS-). You may need it when dealing with banks, insurers or other organisations.
The Australian Cyber Security Centre cannot provide technical support for your device or recover lost money.
Sources: ASD, Help during a cybercrime
How it works.
- Answer a few questions about your organisation. It takes about three minutes.
- Pay once on Stripe, our payment company.
- Download your Word file straight away, then adapt it to how you really work.
Who it is for
- Small businesses, clubs and not-for-profits in Australia that pay suppliers, contractors or staff by bank transfer.
- Owners and office managers who have been asked about payment controls on an insurance proposal form and have nothing written down.
- Businesses that want one dated file showing what their payment controls are and that their people were trained on them.
Who it is not for
- Anyone who wants legal or insurance advice, or a promise that an insurer will accept the documents or pay a claim.
- Large organisations that need a full fraud-risk framework, or software that blocks payments.
- Businesses that will not follow the procedures. A control that is written down but ignored does not protect you.
What these documents can and cannot do
- These are starting documents. Adapt them to how your business really works, and follow them.
- Insurers set their own questions and conditions. No insurer has reviewed this kit, and using it does not mean a proposal will be accepted, a premium lowered or a claim paid.
- This is not legal advice, and it is not connected with any government body, bank or insurer.
- The kit cannot recover money that has been lost. The first-hour steps are about acting fast and reporting properly.
Build your documents.
Your answers go into the documents. Nothing else is asked.
Questions.
Will this stop my business being scammed?
No document can promise that. Checks reduce the risk; they do not remove it. The kit gives you a clear, tested-in-practice routine (call back on a number you already hold, two people approve large payments, staff know what to do), and it only works if your people follow it.
Will my insurer accept it?
We cannot say. Insurers set their own questions and conditions, and no insurer has reviewed this kit. The insurer-questions sheet helps you answer truthfully from what you really do, and the callback log and training record give you something to show. Read your policy and ask your broker what yours requires.
Do insurers really ask about these controls?
Insurance proposal forms we read often ask whether you confirm changes of bank details by phone, whether two people approve payments, whether you have a written procedure, and whether staff are trained on social engineering. The kit’s worksheet is built around those four kinds of question. Your insurer’s form is the one that counts, so check it.
What does it cover about AI scams?
Voice clones, deepfake video and spoofed caller ID. A procedure tells staff never to act on a call or video alone, to call back on a number you already hold, and to use a private code word as an extra check. Scamwatch says scammers can use a few seconds of a voice recording to create an AI clone.
What do you ask me, and what do you keep?
Only business details. We ask for your business name, state, the name and role of the person responsible, the role names that approve payments, the dollar amount above which two people approve, and a few yes or no questions about your banking set-up. We never ask for bank account numbers, staff details or customer details.
Can I edit the documents?
Yes. You receive one Word file (.docx). Open it in Word, Google Docs, Pages or LibreOffice. Change anything that does not match how you work, and add your logo.
Are the scam examples real?
No. Every name, business and web address in the examples is invented. The kit does not copy any real bank, supplier or government page.
Is it written by a person or by AI?
It is written with AI, using the Australian Government and Scamwatch pages listed on this page, and every rule, number and reporting step is checked word for word against them. Each one carries a short reference to its source. Things that are only our suggestion for a small business, such as the dollar threshold, are marked as suggestions so you can change them.