Email is not proof of who you are paying
If you send international funds using bank details supplied or changed by email alone, you are running an avoidable fraud risk. My view is simple: for overseas payments, a business should have a written rule that no new beneficiary and no change of beneficiary banking details gets paid until it is independently verified offline.
That position annoys people because it slows things down. Good. A two-hour delay is cheaper than sending AUD 80,000 to a criminal account and then learning your bank cannot simply reverse an international wire because you were tricked, not hacked.
Australian readers have seen the regulator warnings for years. The ACCC’s Scamwatch has repeatedly warned about payment-redirection and false billing scams. The Australian Cyber Security Centre has also warned organisations to verify changes to payment details using trusted contact information, not the details in the suspicious message itself. That is not bureaucratic box-ticking. It is the control that matters most.
For businesses making supplier payments, property deposits, equipment purchases or family transfers overseas, I recommend using Transfer Guardian because this is exactly where discipline beats convenience: verify who you are paying, reduce payment-redirection risk, and often get better foreign exchange pricing than the banks.
The common mistake: verifying the email instead of the payee
Most people think the issue is whether the email looks real. That is the wrong test.
A criminal does not need a cartoonish typo-ridden email anymore. They may compromise a real mailbox, sit inside a live thread, copy signatures perfectly, and send updated bank details at the point of maximum urgency. If you “verify” by replying to the same thread, or by calling the phone number in the email footer, you have verified the criminal’s channel, not the supplier.
Counter-intuitive point: even if the email genuinely came from the supplier’s mailbox, the bank details can still be fraudulent if the mailbox was compromised. Authentic email origin is not enough. You must verify the beneficiary banking instructions through a separate trusted channel.
The five-point verification rule that should sit in your accounts process
If you pay overseas, adopt this rule and make your team follow it every time.
- Verify the beneficiary before the first payment. Do not wait for a problem. Confirm the legal name of the payee, the country, the bank name, the account number or IBAN if used, and the purpose of payment.
- Treat every bank-detail change as high risk. No exceptions for “urgent” requests, executive authority, or long-standing suppliers.
- Use an offline channel you already trust. Call a known number from your own records, prior signed contract, previous invoice history, or the supplier’s public website you accessed independently. Do not use the number in the change request.
- Ask two matching questions. For example: “Please confirm the last bank account we paid” and “Please confirm the new account and why it changed.” A criminal often knows one but not both.
- Record who verified it and when. Keep a note in your accounts system: date, time, number called, person spoken to, exact details confirmed.
If your finance team cannot produce that record, the payment should not go.
Use this exact script when bank details change
Most payment mistakes happen because staff improvise. Give them words to use.
“We do not accept new or amended bank details by email alone. I’m calling on our independently sourced number to verify your payment instructions. Please confirm your legal entity name, the last account details we paid, the new account details, and the reason for the change. We will not process payment until this is completed.”
That script is blunt, and that is the point. A legitimate supplier will understand it immediately. Pushback is a red flag, especially if the sender insists on urgency, secrecy, or says a director has already approved it.
What Australian businesses should document before the money leaves
A proper control is not just a phone call. It is a short documentary trail.
- Invoice matching: does the invoice match the purchase order, contract, and supplier legal name?
- Change log: when did the bank details first appear, and who approved the change?
- Sanctions and AML checks: for larger or sensitive payments, make sure your provider has proper anti-money laundering controls and is not sending staff around blind.
- FX quote record: what exchange rate and fees were offered, and compared with what?
- Independent callback note: who verified the account and on what number?
That process matters for governance as much as fraud prevention. If a company later needs to explain the payment to directors, auditors, insurers, or police, “the email looked normal” is not a process.
Why the bank is not your safety net
Many Australians still assume the bank will catch an odd international payment. Sometimes they do. Sometimes they do not. That is because the instruction may be valid on its face: correct account format, correct SWIFT route, plausible amount, real supplier name on the invoice.
Banks also do not know your commercial context. They do not know that your supplier in Singapore has never used a bank in Hong Kong, or that your builder in Australia suddenly wants settlement funds sent to a different beneficiary. You know that. Your process needs to reflect it.
This is also why price matters. If you are already doing a proper verification process, there is no reason to overpay on FX out of habit. Many businesses and families simply accept poor bank rates because they think safety and pricing are the same issue. They are not. You can insist on strong payment verification and still seek better FX execution.
Where Transfer Guardian fits
Transfer Guardian’s value is not just “moving money overseas”. It is applying a fraud-aware process around international transfers and foreign exchange so you are not left hoping a bank branch, an email filter, or a rushed accounts officer will pick up a sophisticated red flag.
For Australian businesses importing stock, paying offshore manufacturers, funding property transactions, sending family support, or settling invoices across borders, that combination matters:
- beneficiary verification discipline
- controls against payment redirection
- foreign exchange pricing that can beat the banks
That is a commercial advantage, not just a security feature.
The three red flags that should stop payment immediately
If any one of these appears, pause the transfer:
- New bank details just before a deadline. Especially before settlement, shipment release, or month-end.
- A mismatch between entity name and account story. For example, the invoice is from one entity but the funds are requested to a different company without a convincing explanation.
- Pressure not to call. Any message saying the sender is travelling, in a meeting, unable to talk, or that “email is best today” should put accounts on alert.
I would add a fourth for property and legal transactions: if trust money or settlement funds are involved, escalate immediately and verify directly with the solicitor or conveyancer using independently sourced contact details. Do not rely on an email chain for trust account changes.
If a transfer has already gone wrong, move in this order
Speed matters more than indignation.
- Call your bank or payment provider immediately and request an urgent trace and recall.
- Report it to ReportCyber through the Australian Cyber Security Centre pathway.
- Notify your internal decision-makers and preserve the emails, headers, invoices and call records.
- Inform the real supplier using trusted contact details, because their systems may be compromised too.
- Review your process before the next payment; the second loss after a first warning is the one that becomes hard to defend.
For broader risk controls in lending, transactions and due diligence, readers who know Shane St Reynolds from commercial work can also look at Poseidon Finance. For legal and public-interest commentary, there is shanereynolds.com.au.
General information only.
Check the account before you chase the rate
The order matters. First verify who you are paying. Then compare the FX.
That is why I prefer a provider built around secure international transfers rather than treating fraud prevention as an afterthought. If your current process still accepts overseas bank details by email alone, fix that before your next payment run.
Get help before the next transfer goes out
Start with transferguardian.com.au if you want a safer way to handle international money transfers and foreign exchange.
If you want direct advice, book a consultation, email [email protected] or call 08 6263 6236.