How To Spot A Fake Bank Detail Change Email From A Supplier

Summary

This guide helps you troubleshoot and resolve: How To Spot A Fake Bank Detail Change Email From A Supplier. Follow the steps below to fix the issue.

Common Causes

Invoice redirection fraud is a growing threat to Australian small businesses. In this type of scam, a cybercriminal compromises a supplier's email account or spoofs their address to send a request asking you to update their bank account details for future payments. If you process a payment to the new account, the funds go directly to the fraudster rather than your legitimate supplier. These emails often look convincing and may arrive as part of an existing email thread, making them difficult to spot at first glance.

Warning Signs To Look For

Before changing any supplier bank details, carefully check the email for these red flags:

• The sender's email address does not exactly match the address you have used previously, even if the display name looks correct.
• The email requests an urgent change to bank account details, often claiming the supplier has changed banks or is auditing their accounts.
• The message contains slight spelling mistakes, unusual grammar, or a different tone than you expect from that supplier.
• The email includes new bank account details but no official letterhead, invoice number, or reference to a specific purchase order.
• The request comes from a generic webmail address (such as @gmail.com or @outlook.com) instead of the supplier's business domain.
• You are asked to confirm receipt of the new details quickly or are discouraged from calling to verify.
• The new bank details do not follow the standard Australian format of a six-digit BSB and an account number typically between six and nine digits.
• The supplier mentions payment via PayID without prior arrangement or verification through a known contact.

Quick Fix Steps

1. Do not reply to the email or use any phone numbers provided in the message.
2. Do not click any links or open attachments until you have verified the request.
3. Contact your supplier using a phone number you already have on file, not one included in the suspicious email.
4. Ask the supplier to confirm whether they sent the request and to verify the bank details verbally.
5. If the request is fraudulent, delete the email and report it to your IT support provider.

Detailed Instructions

How To Verify The Sender's Email Address

1. Open the suspicious email in your email client (Outlook, Gmail, or similar).
2. Hover your mouse over the sender's name without clicking to reveal the full email address.
3. Compare the domain (the part after the @ symbol) with previous legitimate emails from that supplier.
4. Look for subtle differences, such as supplier.com.au versus supplier1.com.au or supplier-co.com.au.
5. If the domain does not match exactly, treat the email as suspicious.

How To Verify Bank Detail Changes

1. Call your supplier using a phone number from a previous invoice, their official website, or your existing contacts list.
2. Ask to speak to accounts payable or the person who normally handles your account.
3. To confirm you are speaking to the legitimate supplier, ask for specific details only they would know, such as a recent invoice number, the value of a recent payment, or a purchase order reference you have on file.
4. Confirm whether they requested a change to their bank account details.
5. Read back the BSB and account number from the email and ask them to confirm each digit. Australian BSB numbers are six digits, and account numbers are typically between six and nine digits.
6. If the supplier mentions PayID, ask them to provide the registered PayID (such as an email address or mobile number) and verify it against your existing records before accepting it.
7. Only update your accounting software or payee list after verbal confirmation from a trusted contact.

How To Check For Email Spoofing

1. In Outlook, open the email and select File > Properties to view the internet headers.
2. In Gmail, open the email, select the three vertical dots menu, and choose Show original.
3. Look at the From, Return-Path, and Received fields in the header.
4. If the domains in these fields do not match the supplier's known domain, the email may be spoofed.
5. Forward the header information to your IT provider if you need help analysing it.

If The Supplier's Email Is Compromised And You Cannot Reach Them By Phone

1. Do not update any bank details or process payments to the new account.
2. Visit the supplier's physical office if local, or send a letter to their registered business address requesting verification.
3. Check with other staff members in your business to see if they have received a similar email from the same supplier.
4. Contact your IT support provider to assess whether your own email environment has been targeted.
5. Wait until you have made direct contact through a verified channel before making any changes.

What To Do If You Suspect Fraud

1. Do not make any payment to the new bank account.
2. Do not forward the email to other staff members, as this can spread the risk.
3. Check with your accounts payable team or other staff members who process invoices to see if they have received similar requests.
4. Apply dual authorisation: ensure a second staff member reviews and approves any bank detail change before it is actioned.
5. Report the email to your IT support provider or managed service provider.
6. If you have already made a payment, contact your bank immediately to request a recall of the funds.
7. Report the incident to ReportCyber at https://www.cyber.gov.au/acsc/report.
8. Alert your supplier through a verified channel so they can secure their email account and warn other customers.

Note: Always verify bank detail changes using a second communication channel, such as a phone call to a known number. Never rely on email alone when payment details are involved.

Warning: If you have already transferred money to a fraudulent account, time is critical. Contact your bank immediately and report the incident to ReportCyber. The sooner you act, the better the chance of recovering funds.

If The Supplier Confirms The Change Is Legitimate But Details Still Seem Suspicious

1. Do not update the details immediately.
2. Ask the supplier to send confirmation on their official letterhead via a verified channel, or provide the details in person.
3. Validate the BSB against the Australian BSB directory to ensure it belongs to the bank and branch the supplier claims.
4. Make a small test payment if possible, then confirm with the supplier that they received it before processing larger amounts.
5. Escalate to your IT support provider if you remain uncertain about the legitimacy of the request.

Prevention Tips

• Establish a written process for changing supplier bank details that requires verbal verification and dual authorisation.
• Train all staff who process invoices to recognise invoice redirection scams.
• Use multi-factor authentication on all business email accounts.
• Regularly review supplier contact details and keep them in a secure, central location.
• Implement dual approval for bank detail changes in your accounting software so no single staff member can action a change alone.
• Segregate duties where possible: the staff member who enters new bank details should not be the same person who approves payments.
• Keep your operating system, email client, and security software up to date.

If you need assistance assessing a suspicious email or securing your business email accounts, Open a Ticket.

Still Having Issues?