How does payment redirection work?
A scammer impersonates a client, business or employee by email and asks you to pay an account the scammer controls. It is also called business email compromise.
Scammers hack supplier email accounts and get customer lists, bank details and previous invoices. A scammer inside an email account can change the bank details on genuine invoices, or ask for a change to a worker's banking details.
Remember
- The message often comes from a real, hacked account.
- The target is a change of bank details.
Facts and sources for this part
- In a payment redirection or business email compromise scam, a scammer impersonates a client, business or employee by email and asks you to pay an account the scammer controls. [S28]
- Scammers hack supplier email accounts and get customer lists, bank details and previous invoices. The scam may only come to light when the real supplier complains about not being paid. [S27]
- A scammer who gets into an email account can change the bank details on genuine invoices, or ask for a change to a worker's banking details. [S33]
Where does this hit a tax practice?
Your practice pays suppliers and staff, and it moves client money: trust deposits, refunds you receive for clients, and fee payments. Each is a place where a changed bank account can slip in.
A client who emails "please send my refund to this new account" from an address that looks right is the same scam, aimed at your process.
Remember
- Staff pay runs, supplier invoices and client refunds are all exposed.
- A request to use a new account is the warning sign, whoever it comes from.
Facts and sources for this part
- In a payment redirection or business email compromise scam, a scammer impersonates a client, business or employee by email and asks you to pay an account the scammer controls. [S28]
- Warning signs in an email are payment requests that are urgent or overdue, a change of bank details, and an email address that does not look quite right, such as a domain that does not exactly match the supplier's name. [S32] [S33]
Warning signs
Be wary of payment requests that are urgent or overdue, a change of bank details, and an email address that does not look quite right. A common trick is a domain that does not exactly match the supplier's name.
Check the address character by character against earlier genuine messages, not just the display name.
Remember
- Urgent, overdue or secret.
- New bank details.
- Domain not quite right.
The call-back rule
The most effective defence is to call the sender to confirm they are legitimate, using a number you already trust. Do not check by replying to the email, and do not call a number in the email.
Use contact details already on file for the business, or found independently, such as a directory.
Remember
- Call a number you already had.
- Never verify by email.
Facts and sources for this part
- The most effective defence is to call the sender on a number you already trust, not one in the message, and to follow a formal process when payment requests arrive or bank details change. [S32]
- Do not check a change of bank details by replying to the email, and do not call a number in the email. Use contact details already on file or found independently. [S27]
A payment process that cannot be hurried
Write down how invoices are verified and paid. Consider a multi-person approval for payments over a set amount, and a formal step for any change of bank details.
The process should be one that staff are allowed to follow even when a partner says it is urgent. A rule that bends for urgency is the scammer's way in.
Remember
- Changes of bank details need a second person and a call-back.
- Set a dollar threshold for dual approval.
Facts and sources for this part
- Have a defined process for verifying and paying invoices and consider a multi-person approval for payments over a set amount. [S27]
- The most effective defence is to call the sender on a number you already trust, not one in the message, and to follow a formal process when payment requests arrive or bank details change. [S32]
If the money has already gone
Contact your bank immediately and report the incident. If an email account was compromised, change its password and tell anyone affected.
In one reported case, a small business paid an invoice twice to a new account after an email said the supplier had changed banks. Over $150,000 was paid in total and no funds were recovered.
Remember
- Bank first, then report.
- Speed matters: recovery is rare.
Facts and sources for this part
- If you have sent money or bank details to a scammer, contact your bank immediately and report the incident. If an email account was compromised, change its password and tell anyone affected. [S33]
- In one reported case a small business paid an invoice twice to a new bank account after an email said the supplier had changed banks. Over $150,000 was paid in total and no funds were recovered. [S32]
Scenario: the supplier changes banks
Your software supplier emails new bank details with the next invoice. The sender name is right and the logo matches.
You look closely at the address and find one letter is different. Either way, you phone the supplier on the number already on file, and they say nothing has changed. The invoice is paid to the old account and the fake email is reported.
Remember
- Look at the address, then call anyway.
- Pay only to details already verified.
Facts and sources for this part
- Warning signs in an email are payment requests that are urgent or overdue, a change of bank details, and an email address that does not look quite right, such as a domain that does not exactly match the supplier's name. [S32] [S33]
- The most effective defence is to call the sender on a number you already trust, not one in the message, and to follow a formal process when payment requests arrive or bank details change. [S32]
- Do not check a change of bank details by replying to the email, and do not call a number in the email. Use contact details already on file or found independently. [S27]
Scenario: a staff member asks to change their pay account
An email from an employee's address asks you to send the next pay to a new account. The tone is rushed and it says they cannot take calls.
A request to change banking details is a classic trick, and a hacked email account can send it. You confirm in person or by phone using the number on file. A second person approves the change.
Remember
- Banking changes need a call-back and a second person.
- Cannot take calls is itself a warning sign.
Facts and sources for this part
- A scammer who gets into an email account can change the bank details on genuine invoices, or ask for a change to a worker's banking details. [S33]
- The most effective defence is to call the sender on a number you already trust, not one in the message, and to follow a formal process when payment requests arrive or bank details change. [S32]
- Have a defined process for verifying and paying invoices and consider a multi-person approval for payments over a set amount. [S27]
Checklist: the rule for any change of bank details
Never act on the email alone. Phone a number already on file. Have a second person approve. Write a short note of who confirmed what and when. Pay only after all four.
The rule works because it does not depend on spotting a fake. It makes every request wait for a check.
Remember
- Call, second person, note, then pay.
- The rule beats spotting fakes.
Facts and sources for this part
- Do not check a change of bank details by replying to the email, and do not call a number in the email. Use contact details already on file or found independently. [S27]
- Have a defined process for verifying and paying invoices and consider a multi-person approval for payments over a set amount. [S27]
- The most effective defence is to call the sender on a number you already trust, not one in the message, and to follow a formal process when payment requests arrive or bank details change. [S32]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
A supplier's email says their bank account has changed. You have used that address for years. What do you do?
Show the answer
Right answer: A, Call them on a number you already have and confirm the change. The most effective defence is to call the sender using details you already trust. The scam often comes from a hacked, genuine account. [S32]
Question 2 of 3
How can a scammer know your supplier's usual invoice details?
Show the answer
Right answer: B, By hacking the supplier's email and reading customer lists, bank details and past invoices. Scammers hack vendor and supplier email accounts and take customer lists, bank details and previous invoices. [S27]
Question 3 of 3
Your practice has just paid a fraudster. What is the first step?
Show the answer
Right answer: C, Contact your bank immediately and report the incident. If you have sent money or banking details to a scammer, contact your bank immediately and report the incident. [S33]