Verifying bank details before payment is the call-back habit that stops payment redirection fraud — the scam where an attacker inserts their own account into an otherwise legitimate supplier relationship. Australians reported $166.8 million lost to these scams in 2025 (Scamwatch), and almost every loss traces back to the same moment: a bank-detail change accepted on the strength of a convincing email. The fix is a five-step process, done every time, by everyone who pays.
TL;DR
- The rule: any change to supplier bank details — or any first payment — gets verified by phone on a number you already had, never one from the email.
- The five steps: pause, find the number independently, call a known contact, document the confirmation, then pay.
- It applies to bank-detail changes, first payments, urgent payment requests and any invoice that arrives right before a large payment is due.
- The process takes ten minutes; the average redirection loss takes it back a thousandfold.
- Train it monthly with realistic supplier scenarios — phishing simulations are the practice rep.
Why the call-back works
Payment redirection (business email compromise's money-moving cousin) needs exactly one thing: your payment sent to the wrong account. Every fake — the vendor impersonation email, the hijacked mailbox, the lookalike domain — collapses at the moment someone rings the real supplier on a trusted number. The attacker cannot intercept a phone call to a number they did not provide, which is why the source of the number matters more than anything else in the process.
The 5-step verification process
Step 1 — Pause at the trigger. A bank-detail change, a first payment, an urgent request, a changed signatory, or an invoice due within days of arriving. Any of these starts the process; no exceptions for familiar names, because hijacked supplier mailboxes make familiar names worthless.
Step 2 — Find the number independently. Use the number from your records: the signed contract, a previous verified invoice, the supplier's portal, the contact who has invoiced you correctly before. Never the phone number, email signature or website link contained in the message that asked for the change.
Step 3 — Call a known person. Speak to the contact you dealt with before, or ask for the accounts team through the main line. Confirm two things: that they requested the change, and the exact details (BSB and account number) verbally. If the change is real, most suppliers will confirm without hesitation — and if they did not request it, you have just caught an attack and warned a real business.
Step 4 — Document the confirmation. Log who confirmed, on what number, on what date, against which invoice. This is the step auditors and cyber insurance assessors ask about, and it is what lets a second person approve the payment with confidence.
Step 5 — Pay and close the loop. Release the payment, then send the supplier a short confirmation through the portal or a known email: "we've updated your details on file after phone verification". If the confirmation bounces or the supplier disputes it, the window to recall the payment is still open.
When the process applies
| Trigger | Verify? |
|---|---|
| Supplier emails updated bank details | Always, by phone |
| First payment to a new supplier | Always, at onboarding |
| Urgent or "final notice" invoice | Yes — urgency is the scammer's tool |
| Large payment due soon after a change | Yes — timing is the pattern |
| A supplier's signatory or contact changes | Yes — re-verify the whole chain |
| Routine payment to unchanged, previously verified details | No — this is the payoff for having the process |
The last row matters: the call-back rule costs a small business a handful of ten-minute calls a year, not a call per invoice. It fires only on changes and firsts.
Making the habit stick
| Step | Action | Why it works |
|---|---|---|
| 1 | Write the rule into the payment procedure | Folk practice dies with staff turnover; written rules don't |
| 2 | Add a "bank details changed?" field to the payment approval | Makes the check visible in the workflow |
| 3 | Monthly simulation with a supplier-invoice scenario | Practice reps in a safe format |
| 4 | No-blame reporting for near-misses | The team logs the fake instead of quietly catching it |
| 5 | Include the process in the cyber security policy | Auditors, insurers and tenders ask for it in writing |
The measure that matters is not attendance at a training session — it is that every bank-detail change in the last quarter has a documented call-back. That record is the audit evidence version of this habit, and it is the first thing a forensic accountant asks for when money has gone missing.
If the details were already wrong
Speed is everything. Call your bank and request a recall on the payment, then report to ReportCyber and Scamwatch, and notify the real supplier — their mailbox is likely compromised and their other customers are targets too. Recalls succeed far more often in the first hours; the process above exists so this paragraph stays theoretical.
FAQ
How do I verify bank details before making a payment? Call the supplier on a number from your own records — never one from the email asking for the change — speak to a known contact, confirm the BSB and account number verbally, document who confirmed and when, then pay.
What if the supplier confirms by email instead of the phone? Email confirmation is not verification: if the attacker controls the mailbox, the confirmation comes from the attacker too. Voice on a known number is the standard; a video call with a familiar face is the only remote alternative.
Does this apply to small payments? Yes to every bank-detail change regardless of amount — the first redirected payment is often small, set up to test whether the change went through, and the large one follows immediately.
How often should finance staff train on this? Monthly, in short scenario form. The pretexting and supplier-impersonation scenarios in a monthly cadence keep the call-back reflex current without eating into the month.
Is the call-back rule required by any standard? It is the practical heart of payment-fraud controls under Essential Eight's user-application hardening spirit and SMB1001's process controls, and it is the evidence insurers and auditors look for after a redirection claim.
One last thing
Open your payment procedure right now and check whether "verify changed bank details by phone on a stored number" is written in it. If it lives only in someone's head, the process leaves with them — and the next convincing email lands in an inbox with no defence. Ten minutes to write the rule; the training platform handles the monthly practice reps and the human risk reporting shows whether the habit is landing across the finance team.