From the reel: Your supplier emails a new bank account
Bank details changed? The 3-step check
Print this and stick it where you pay bills. Every time a supplier's bank details change, do all three before you pay.
The 3 steps
1. Stop. Don't pay yet.
New bank details are the moment to slow down, even if the email says it's urgent. Especially if it says it's urgent.
2. Check the sender's address, letter by letter
Scammers register lookalike addresses: "rn" for "m", an extra letter, .com instead of .com.au. Check the reply-to address too. Email security settings can't stop a lookalike address or a supplier whose own mailbox was hacked.
3. Ring the supplier on a number you already have
From an old invoice or your phone contacts. Never the number in the email. Ask them to confirm the new details out loud.
If you've already paid
Call your bank straight away
The sooner they know, the better the chance of stopping the money.
Report it
Report it at cyber.gov.au (ReportCyber), and tell the real supplier.
The average cost of a cybercrime report from a small business was $56,600 in 2024-25, according to the Australian Signals Directorate.
Want a copy in your inbox?
I'll email you this checklist. Nothing else unless you tick the box.
Sources: ASD Annual Cyber Threat Report 2024-25, business fact sheet
More free checklists: see them all.
Want a hand with this? Get in touch or see what I do.