Email security · Practical guide
That changed bank account might not be genuine.
A convincing email can come from a compromised account or impersonate someone you know. An independent payment check gives you a chance to catch it before money moves.
01 / A familiar-looking request
The email can look ordinary.
The change deserves a check.
Read this fictional supplier message. The reasons to stop are in what it asks you to do.
These checks follow Scamwatch’s advice on changed payment details.
02 / Before paying
Take the check outside the email.
A reply to the same message may reach the same attacker. Use contact details already in your records or verified independently.
- 01
Open your existing supplier record.
Find a known phone number. Do not use a new number supplied in the suspicious request.
- 02
Call and confirm the change.
Ask your established contact whether the payment details really changed.
- 03
Record the answer.
Keep a note of who confirmed what. Use your normal approval process and a second approver for significant or changed payments.
Independently confirmed?
Continue through your normal finance controls.
False, unclear or no answer?
Keep payment on hold and report the request internally.
03 / If you already acted
Act on what happened.
You don’t need to hide a mistake.
Money sent or banking details exposed?
Contact your bank immediately using its official number. Tell it what happened and follow its instructions. Recovery is not guaranteed.
- 01
Tell your IT contact.
Use a known contact method. Explain whether you opened a file, entered a password, approved a login or sent information.
- 02
Secure the affected account.
From a trusted device, change affected credentials and follow your provider’s incident process. They may need to revoke sessions and review MFA methods, forwarding rules and recent account activity.
- 03
Keep a clear record.
Preserve the message and note what happened and when. Report the incident and warn affected contacts as advised by your IT provider.
Read the Australian Cyber Security Centre’s recovery steps ↗
04 / Make it repeatable
A safer habit,
every payment.
Technical protection and a clear team routine work together. Make checking easy, especially when everyone is busy.
Protect access.
Use unique passwords or passkeys and multifactor authentication for email and other important accounts. Limit administrator access and keep devices updated.
Make reporting normal.
Let staff raise a concern without blame. Practise checking changed payment details independently, including requests from senior staff.
Know who responds.
Agree who handles technical response, bank contact and communications. Keep those contact details accessible if email is unavailable.
Keep these references handy.
Need a hand with your business IT?
Tell us what you need and we can discuss a suitable next step.