The last of our October habits for staff, and the one that protects the most money.
The end of the quarter is a busy time for anyone who pays the bills. Invoices pile up, statements arrive, and there’s pressure to get things paid on time. That’s exactly when a fake one slips through.
How the scam usually looks
It rarely looks like a scam. It looks like a supplier you already pay, saying something ordinary:
- “We’ve changed banks, please update our details for future payments.”
- “Please use the new account on the attached invoice.”
- “Action required: update your payment details.”
That last one is a real subject line from an email one of our clients asked us to release from quarantine last year. The filter had held it for a reason.
Sometimes the email really does come from the supplier’s own address, because their mailbox has been broken into. So “it came from their normal email” doesn’t prove anything.
What one firm did right
Earlier this year, staff at a professional services firm we support received a fake invoice demanding payment. It was followed by a second email made to look like it came from someone senior in the firm, adding pressure.
Instead of acting on it, they marked it as phishing and sent it to us. We checked it, and the filter had already caught a related message as a scam.
Pressure from someone senior, a deadline and a plausible invoice is exactly the combination these scams rely on. Stopping to report it was the right call.
The one habit
Never change a payee’s bank details because of an email. Ring the supplier on a phone number from your own records first.
That means a number from their website that you typed in yourself, a past invoice you’ve already paid, or your supplier list. Not the number in the email, and not the one in the email signature, because both can be changed by whoever sent it.
Scamwatch gives the same advice: check payment details directly with the business before paying an emailed invoice, using contact details you’ve found independently.
Make it a rule, not a judgement call
A rule is easier to follow than a gut feeling, especially when you’re busy. A few that work well:
- No bank detail change is made without a phone call to a known number, no matter who asks.
- Two people check any new payee or changed account before the first payment.
- A request to “keep this quiet” or “pay it today” is a reason to slow down, not speed up.
If a senior person in your own business emails asking for an urgent payment, the same rule applies. Ring them.
If money has already gone to the wrong account, call your bank straight away, then tell IT.
If you’d like help setting up a simple payment check process for your team, get in touch.