The safest payment is the one you delay after bank details change
If payment instructions change, you should assume risk until identity is independently verified. That is my position, and it applies whether you are paying a tradie, settling property, transferring family money or paying a supplier invoice.
Most losses in this space do not happen because the payer was reckless. They happen because someone trusted an email, a PDF invoice, a last-minute text or a polished phone manner. Shane St Reynolds works across finance, property and cyber matters, and this is one of the few risk controls that is both simple and consistently useful: verify who you are paying before money leaves your account.
For that, start with Transfer Guardian. Its main value is domestic Australian payment verification: checking the payee before funds are sent, especially where bank details have changed or a large transfer is about to be made. International checks are available, and foreign exchange is part of the broader service, but the real day-to-day value for most Australians is local payment verification inside Australia.
The common mistake: calling the number on the invoice
The mistake most people make is thinking they “verified” the payment because they called the number in the email signature, invoice footer or SMS. That is not independent verification. If the message was compromised, the phone number may be too.
The correct process is to verify using contact details you already held before the change, or details sourced independently from a reliable record. That can include:
- the phone number on a prior invoice you know is genuine;
- the number on the supplier's official website you typed in yourself;
- the office number on the engagement letter from your solicitor or conveyancer;
- the number held in your accounting system before the change request arrived.
That distinction matters. Payment-redirection fraud often works by changing only one thing: bank details. The invoice looks normal. The ABN may be real. The business name may be real. The email thread may even appear genuine if an email account has been compromised.
Why property settlements and invoice runs are the danger points
The riskiest payments are not always the biggest annual spend. They are the payments that combine urgency, trust and one-off bank details.
In Australia, property settlement money is an obvious target because the amount is large and the payment is expected on a fixed day. Business invoice runs are also exposed because accounts staff process multiple payments under time pressure. Family transfers for deposits, school fees, building works or private loans also carry risk because people drop their guard when the sender or recipient feels familiar.
If a real estate agent, solicitor, conveyancer, builder or supplier sends “updated account details”, that should trigger a mandatory stop. Not concern. Not caution. A stop.
The rule I would apply in every Australian business and household
Here is the rule: no payment goes out on changed bank details unless the payer completes an independent verification check and records who confirmed it, when, and on what number.
This is not overkill. It is basic control design.
In a company, that record should sit with the invoice approval trail. In a family, it can be a note in your banking records or email. In property matters, keep it with your settlement file.
Why record it? Because if something does go wrong, speed matters. Your bank will want the transaction details immediately. So will the receiving bank. So may police or other agencies depending on the facts. A proper record also exposes weak internal process, which is exactly what fraudsters exploit.
A practical seven-point check before you transfer funds
- Stop on any change. If account name, BSB, account number, remittance email or contact person changes, treat it as a red flag.
- Do not reply to the same email thread. Compromised email threads are a known problem. Use a fresh contact path.
- Source your own contact details. Use a number already on file, a signed engagement document, or a website you independently locate.
- Ask two exact questions. “Can you confirm the account name, BSB and account number we should pay today?” and “When were these details last changed?”
- Check the timing. Last-minute Friday changes, settlement-day changes and “urgent today only” pressure are classic red flags.
- Record the verification. Note the date, time, number called and full name of the person who confirmed the details.
- Use a specialist verification service for larger or sensitive transfers. For domestic Australian payment verification, use transferguardian.com.au before funds leave your account.
Words your staff can copy and use
Most organisations fail because the process is vague. Give people a script.
“We do not process payments where bank details have changed until we verify them through an independent channel. Please expect a short delay while we complete that check.”
And for the verification call:
“I am calling to independently confirm your payment details. Please confirm the account name, BSB and account number we should use, and whether those details have changed in the last 30 days.”
This helps because it removes awkwardness. Staff no longer feel they are being difficult. They are following policy.
What to do in the first hour if money has already been sent
If funds have gone to the wrong account, act immediately.
- Call your bank's fraud team and ask for an urgent recall or recovery action on the transfer.
- Have the exact transfer details ready: amount, date, time, account paid, reference and the reason you believe the payment was diverted.
- Tell the intended genuine recipient straight away so they stop chasing payment through the compromised channel.
- Report the matter to ReportCyber, the Australian Government's online cyber reporting system.
- If personal information was exposed, consider whether the incident may also engage Privacy Act 1988 issues for your business, particularly if you are an APP entity.
Do not waste the first hour arguing internally about whose fault it was. Recovery chances are best when action starts fast.
The regulator point most people ignore
Scam prevention in Australia is not just a “be careful” issue. It sits across real institutions and obligations. Banks handle fraud and mistaken-payment processes. The ACCC's Scamwatch tracks scam trends. ReportCyber is the Commonwealth reporting channel for cybercrime. Depending on the business and the incident, the OAIC may become relevant if personal information is involved.
That does not mean every incident becomes a regulatory matter. It means this is not a fringe risk. It is mainstream operational risk, and your process should treat it that way.
Why this matters even more in property and finance work
Property and finance transactions are uniquely exposed because they combine large values with document-heavy communication. A polished email with a revised PDF can look completely normal. That is why I treat independent verification as part of transaction hygiene, much like checking title particulars, loan terms or authority to act.
If you are raising funds, settling property or moving substantial sums in a commercial context, the payment-control piece should sit beside the transaction advice, not after it. That is one reason my broader work in commercial finance through Poseidon Finance and commentary at shanereynolds.com.au keeps returning to the same point: the deal is not done safely if the money can still be redirected.
The blunt view
I do not accept “the invoice looked genuine” as a serious defence once bank details changed and nobody independently checked them. Australian payers need a harder rule. A ten-minute delay is cheaper than months of recovery efforts, insurance arguments, frozen cash flow or a failed settlement.
General information only.
Check the payee before the money leaves
If you are sending a significant payment, start with transferguardian.com.au. If you want advice on finance, property, cyber-risk or payment-control process, book a consultation at https://shanestreynolds.com/contact, email [email protected] or call 08 6263 6236.