14/10/2026
"Hi, quick heads up — we've changed banks. Please use our new account details for this invoice."
If a message like that lands from a supplier, the right response is the one in the screenshot: offer to call them back on a number you already have. Watch how fast the scammer disappears. 😄
Jokes aside — this is payment redirection fraud, and Scamwatch and the ACCC consistently flag it as the single biggest way Australian businesses lose money.
Here's why it's so effective: it doesn't break your security. A legitimate supplier's email gets compromised (or convincingly spoofed), you receive a real-looking invoice with changed bank details, and you pay — because everything about it looks normal. It often isn't discovered until the genuine supplier calls asking where their payment is.
The defence costs nothing and isn't technical:
Any change to bank details gets verified by phone — on a number you already have — before a cent moves. Not the number on the invoice. Not a number in the email. The one you had on file beforehand.
Build it into your business as a rule, not a judgement call. Because the person most likely to pay a fake invoice isn't careless — they're busy, it's 4:55 on a Friday, and the email looked exactly right.
Does your business have a "verify changed bank details by phone" rule — or would a convincing fake invoice get paid? 👇