Someone Changed the Bank Details on Your Invoice — How This Scam Works

You receive an invoice from a supplier you’ve worked with for years. The amount looks right. The logo is familiar. The email even appears in the same conversation you’ve been using to discuss the job.

There’s just one small change: the supplier says they’ve moved banks and asks you to pay a different account.

Would you notice?

For many busy business owners, bookkeepers and accounts teams, that request can look like another routine task. Unfortunately, it’s also the exact situation scammers exploit in a payment redirection scam, sometimes called invoice fraud or business email compromise (BEC).

The frightening part is that the invoice may be genuine, the supplier may be genuine, and the work may have been completed. Only the destination of the money has changed.

In this guide, we’ll explain how the scam works, what to do if you’ve already paid, and how to put practical safeguards in place without turning every invoice into a complicated investigation.

What is a payment redirection scam?

A payment redirection scam happens when a criminal tricks someone into sending a legitimate payment to an account controlled by the criminal instead of the intended recipient.

The scammer may impersonate a supplier, compromise a real email account, or alter an invoice before it reaches the customer. The payment itself is often authorised by the victim, which is why the fraud can be difficult to detect until the genuine supplier asks why they haven’t been paid.

According to Scamwatch’s guidance on business email compromise, unexpected changes to supplier payment details are a key warning sign. The safest response is to independently contact the business and verify the new details before transferring money.

A simple example: the $18,400 renovation invoice

Imagine a Melbourne construction company, Harbour Projects, has completed a renovation. Its customer, Daniel, is expecting the final invoice for $18,400.

On Tuesday, Daniel receives an email that appears to come from Harbour Projects:

Hi Daniel, please find the final invoice attached. We’ve recently changed our banking arrangements, so please use the updated account details on this invoice. Thanks again for your business.

The invoice includes the correct project description, the correct amount and the company’s branding. Daniel pays it.

A week later, Harbour Projects calls to ask when payment will be made.

Daniel replies, “I paid you last Tuesday.”

The money has gone to a scammer’s account.

This is an illustrative scenario, not a real Computer Cures customer case. It demonstrates why checking the invoice amount and recognising the sender’s name are not enough.

How scammers get into the invoice conversation

There are several ways a criminal can make a fraudulent payment request appear convincing.

1. They compromise a genuine email account

An attacker may gain access to a supplier’s or customer’s mailbox through a stolen password, phishing attack, reused credentials or another security weakness.

Once inside, they may search for words such as “invoice,” “payment,” “accounts” or “bank details.” They can observe an existing conversation and wait until a payment is due.

The attacker then sends an altered invoice or payment instruction from the compromised account. In some cases, they may also create mailbox rules to hide replies or forward messages.

This is why a message coming from the correct email address does not automatically prove it is safe.

For more background on how email attacks begin, read our guide to recognising phishing emails.

2. They create a lookalike email address

Not every invoice scam involves a hacked account. Sometimes the criminal registers a domain that looks almost identical to the genuine business.

For example:

• Genuine: accounts@harbourprojects.com.au
• Impersonator: accounts@harbourproject.com.au

One missing letter can be easy to overlook, particularly on a mobile phone.

The scammer may copy the supplier’s signature, logo, invoice template and writing style. They may even refer to a real project or purchase to make the message more believable.

3. They alter the invoice or payment instructions

The criminal’s objective is usually simple: replace the legitimate BSB and account number with their own.

The invoice may otherwise remain unchanged. The ABN, address, invoice number and amount can all look correct.

A copied logo or genuine ABN is not proof that the payment details are genuine.

4. They create urgency or discourage verification

The message might say:

“Please pay today so we can release the goods.”

“Our old account has been closed.”

“The accounts manager is away, so please don’t call the office.”

These explanations may sound reasonable, but they should never override your normal payment verification process.

A genuine supplier changing banks should understand why you want to confirm the details independently.

Why this scam is so convincing

Most people imagine a scam email as something full of spelling mistakes, strange links and obvious threats. Invoice fraud is often much more ordinary.

The attacker may already know who you deal with, what you purchased, how much you owe and when payment is expected. They can use that information to make the request fit naturally into your working day.

Scamwatch has documented cases where fraudulent invoices appeared in genuine email conversations and where criminals used compromised business accounts. In one published case, a couple lost more than $800,000 during a property transaction after receiving incorrect payment details through what appeared to be legitimate correspondence.

The lesson is not that every invoice is suspicious. It’s that email alone is not a reliable way to approve a change in banking details.

The warning signs to look for

A payment request deserves extra attention when:

• A supplier unexpectedly changes their BSB or account number.
• The email address contains a subtle spelling or domain difference.
• The sender asks you to ignore previous payment details.
• There is unusual urgency, secrecy or pressure to bypass your normal process.
• The invoice arrives at an unexpected time or differs from previous invoices.
• The sender refuses to confirm the change through an independently sourced phone number.
• A familiar contact suddenly uses different language or an unusual tone.

None of these signs proves fraud on its own. Equally, their absence does not prove the invoice is safe. A compromised mailbox can produce a perfectly normal-looking message.

What should you do before paying an invoice with new bank details?

The most effective protection is a simple, repeatable verification process.

Step 1: Stop the payment temporarily

If the bank details have changed, don’t approve the transfer until the change has been verified. A short delay is preferable to sending money to the wrong account.

Step 2: Contact the supplier using a trusted number

Call the supplier using a phone number from your existing records, a previous verified invoice or their independently located official website.

Do not rely on the phone number included in the suspicious email or attachment. That number may also have been changed.

Step 3: Confirm the details with an authorised person

Ask the supplier to confirm the account name, BSB and account number. For larger payments, follow your organisation’s approval process and record who confirmed the change.

Step 4: Update your supplier records securely

Only after verification should the new details be entered into your accounting or banking system. Ideally, the person approving the change should be different from the person who originally received the request.

Step 5: Keep a record

Record the date, the person contacted and the method used to verify the change. This creates an audit trail and helps prevent the same details being questioned repeatedly.

Example: a safer way to handle the request

Your bookkeeper receives an email from a regular supplier saying their bank account has changed.

Instead of replying to the email, she calls the supplier’s accounts department using the number already saved in the business’s supplier records. The accounts manager confirms the change, and a second authorised employee approves the update.

The payment is then processed using the verified details.

That extra phone call is a small inconvenience compared with the cost of recovering a misdirected payment.

What if you’ve already paid the wrong account?

If you suspect you have transferred money to a scammer, act immediately. Do not wait for the supplier to investigate or for the bank to confirm that the payment has cleared.

1. Contact your bank immediately

Call your bank’s fraud or scam team using its official contact details. Explain that you believe you have been the victim of an invoice payment redirection scam.

Ask whether the payment can be stopped, recalled or traced, and provide the transaction details. Recovery is not guaranteed, but reporting quickly gives the bank the best opportunity to act.

2. Contact the genuine supplier through a trusted channel

Tell the supplier what happened and ask them to check whether their email account or invoicing system may have been compromised.

Do not continue the suspicious email conversation as your only method of communication.

3. Preserve the evidence

Keep copies of the original invoice, altered invoice, emails, payment receipts and any relevant messages. Do not delete suspicious emails or mailbox rules before your IT provider has had an opportunity to preserve evidence, unless immediate containment requires action.

4. Secure potentially compromised accounts

If your own business email may have been accessed, contact your IT provider promptly. They may need to reset credentials, revoke active sessions, review sign-in activity, inspect forwarding rules and check whether other accounts have been affected.

Changing a password alone may not be enough if an attacker still has an active session or another method of access.

5. Report the incident

Report the scam to Scamwatch and, where business email compromise is suspected, to the Australian Cyber Security Centre. The ACSC also provides a 24/7 hotline on 1300 CYBER1 (1300 292 371).

If your bank’s response does not resolve the matter, you may be able to raise a complaint through the Australian Financial Complaints Authority. Recovery rights depend on the circumstances and the applicable rules, so do not assume every scam payment is covered by the mistaken-payment process.

Important: If money has already been transferred, contact your bank first. An IT provider can help investigate and secure your systems, but cannot guarantee that stolen funds will be recovered.

What if your customer received the fake invoice?

Invoice fraud can affect both sides of a transaction. Your business might never receive the money, while your customer believes they have already paid you.

If a customer reports receiving changed bank details from your business:

1. Ask them to stop any further payments and contact their bank immediately.
2. Verify the invoice and payment details through a trusted channel.
3. Notify your IT provider and investigate whether your email or invoicing systems have been compromised.
4. Preserve relevant messages and logs.
5. Identify whether other customers may have received similar requests.
6. Communicate clearly with affected customers and obtain appropriate legal or professional advice about any financial dispute.

Avoid immediately assuming the customer made a mistake. A compromised supplier mailbox can be the source of the fraudulent instruction, and the technical investigation may be important in establishing what happened.

How to protect your business from invoice fraud

A good defence combines payment procedures with technical security. Neither one is sufficient on its own.

Make bank-detail changes a separate approval process

Create a rule that no supplier bank-detail change is accepted solely by email. Require independent phone verification and, where appropriate, a second approval for changes or high-value payments.

This is one of the most practical controls because it can stop a fraudulent transfer even when the attacker has access to a genuine mailbox.

Enable multi-factor authentication

Multi-factor authentication (MFA) adds another verification step when someone signs in. It can significantly reduce the risk of account compromise, particularly when combined with strong, unique passwords and secure account recovery settings.

MFA is not a complete guarantee, however. Some attacks can steal sessions or trick users into approving fraudulent sign-ins.

If your team uses Microsoft 365, our guide to Office 365 multi-factor authentication explains the basics.

Review your Microsoft 365 security settings

Many small businesses use Microsoft 365 every day without reviewing the security configuration behind it.

A proper review may include MFA and conditional access, administrator privileges, legacy authentication, mailbox forwarding, sign-in monitoring, device security and account recovery settings.

Computer Cures provides Microsoft Office 365 services for businesses that need help configuring and managing their environment.

Use email filtering and authentication

Email filtering can help identify malicious attachments, suspicious links and impersonation attempts. Domain authentication technologies such as SPF, DKIM and DMARC can also help reduce certain forms of email spoofing when configured correctly.

These controls are not a substitute for payment verification, but they reduce the number of dangerous messages reaching staff.

Explore our business email spam filtering and protection services for help improving your email defences.

Train staff using realistic scenarios

A short, practical exercise can be more useful than a generic annual presentation.

For example, show your accounts team two invoices from the same supplier—one with the usual details and one with a changed account. Ask them what they would do before approving payment.

The goal is to make verification a normal part of the workflow, not to make employees afraid of opening every email.

Keep systems updated and monitored

Outdated devices, weak passwords and unmanaged accounts can increase the risk of compromise. Businesses should also review who has access to financial systems and remove access promptly when employees leave.

Our article on cybersecurity mistakes that could cost your business covers other common gaps worth addressing.

How Computer Cures can help

Invoice fraud is a financial scam, but the underlying weakness is often connected to business IT: an exposed mailbox, poor account security, inadequate monitoring or an inconsistent process for handling sensitive changes.

Computer Cures can help Melbourne businesses assess and strengthen the technology side of that risk.

Cybersecurity solutions

Our cybersecurity solutions can support businesses with security assessments, protective controls and practical improvements designed around their environment.

For a business concerned about email compromise, the starting point may be reviewing account access, MFA, email security and the processes used to protect sensitive information.

Managed IT support

With managed IT services, businesses can move away from relying on ad hoc fixes and toward ongoing support, maintenance and security management.

That can be particularly valuable when your team depends on Microsoft 365, shared files, business applications and email to keep daily operations running.

IT health check and audit

Not sure where your biggest risks are? An IT health check and audit is a practical starting point for identifying gaps and prioritising improvements.

You don’t need to know whether the problem is your email configuration, staff access, devices or backup arrangements before asking for help. The purpose of an assessment is to understand the environment and determine what needs attention.

A practical invoice fraud prevention checklist

Use this as a starting point for your accounts and management teams:

• Require independent verification for every supplier bank-detail change.

• Use trusted contact details rather than those supplied in the change request.

• Require a second approval for high-value payments or sensitive supplier changes.

• Enable MFA on business email and other important accounts.

• Use unique passwords and a business password manager.

• Review Microsoft 365 administrator access and mailbox forwarding.

• Configure appropriate email filtering and domain authentication.

• Train staff to recognise payment redirection requests.

• Keep devices and software updated.

• Maintain tested backups and an incident response plan.

• Make sure staff know who to contact if they suspect a scam.

For broader planning, our business data backup guide explains why reliable backups matter. Backups cannot reverse a fraudulent bank transfer, but they are an important part of recovering from other cyber incidents and maintaining business continuity.

Frequently asked questions

Can a scam invoice come from a real email address?

Yes. If a genuine mailbox has been compromised, an attacker may be able to send messages from that account or participate in an existing conversation. A correct sender address is therefore not enough to verify payment instructions.

Is a changed BSB always a scam?

No. Businesses legitimately change banks. The important step is to verify the change independently before updating your records or making payment.

Can my bank recover money sent to a scammer?

It may be possible, but recovery is not guaranteed. Contact your bank immediately and ask its fraud team to investigate the transfer. The outcome depends on factors such as timing, where the funds have gone and the circumstances of the transaction.

Does MFA stop invoice fraud?

MFA helps protect accounts from many forms of unauthorised access, but it does not stop every attack. It also cannot prevent an employee from voluntarily paying a fraudulent invoice. Strong technical security and payment verification procedures work best together.

What should I do if I receive a suspicious invoice but haven’t paid?

Do not use the new bank details. Contact the supplier using a trusted phone number, verify the request and report the suspicious message to your IT provider or internal security contact.

Can small businesses be targeted?

Absolutely. A business does not need to be large to have valuable invoices, customer relationships or email accounts. Small teams may also have fewer layers of approval, which makes a clear verification process especially important.

Protect your business before the next invoice arrives

You shouldn’t have to wonder whether every supplier email is genuine. With the right payment procedures and a properly secured IT environment, your team can work confidently while reducing the risk of a costly mistake.

If you’re concerned about suspicious invoices, Microsoft 365 security or whether your current IT setup is leaving your business exposed, Computer Cures can help you identify the gaps and plan the next steps.

Book an IT Security Health Check

Find out where your business may be vulnerable to email compromise and invoice fraud.

Talk to Computer Cures about reviewing your email security, account access, MFA and broader business IT environment. We’ll help you understand what needs attention and which improvements make sense for your organisation.

Request an IT Security Health Check

Already dealing with a suspected compromise? Contact your bank immediately if a payment has been made, then get in touch with our team for assistance investigating and securing your IT systems.

Contact Computer Cures

Computer Cures provides IT support, managed IT and cybersecurity services for Melbourne businesses. Technical assistance cannot guarantee recovery of stolen funds or eliminate every cyber risk.