/ THE SHORT ANSWER
- 01Detect changed details without automatically accepting them.
- 02Verify through an independently established contact route.
- 03Keep master-data approval separate from payment release.
- 04Design an escalation route that preserves the hold.
/ dotSuper point of view
The important automation boundary is between reading payment details and granting them authority.
A familiar invoice can still carry a different instruction
The email thread, delivery reference and amount all fit the job.
The only difference is the bank account, accompanied by an explanation about a new finance arrangement.
Scamwatch describes business email compromise as impersonation intended to redirect legitimate payments.[
1] Its invoice alert also explains that genuine email systems can be compromised.[
2] Therefore, familiarity with the sender or the surrounding conversation should not independently authorise a change in where money goes.
Map the business events separately: an invoice arrives, a change is requested, supplier master data changes and a payment is released.
They may occur close together, but each has different evidence and authority.
Automation should preserve those distinctions instead of compressing them into one click.
Let extraction identify the discrepancy
Treat the result as a reason to investigate, including when only an account name changes.
Do not allow a language model to decide that an explanation sounds sufficiently credible.
Preserve the original invoice and message beside the extracted fields.
The reviewer should be able to see whether the discrepancy came from the document, poor extraction or a previous data-entry error.
That context prevents innocent formatting variations from becoming unexplained supplier disputes.
Separate changes from first-time supplier onboarding.
Both require checks, but the available evidence differs.
An existing supplier has a history and established contact route.
A new supplier needs an identity and purchasing relationship established before its first invoice becomes payable.
Build the independent verification route in advance
1] Our implementation recommendation is to establish that route while onboarding the supplier.
Record the source, the responsible contact and how future changes to that contact will be reviewed.
A callback is not automatically independent because it happens by phone.
Calling a number supplied in the suspicious change request simply moves the same untrusted instruction to another channel.
Staff need a clear rule about which records they can rely on and when to escalate.
Capture the outcome without collecting unnecessary personal details or call recordings.
A short record can identify the verifier, contact route, confirmed change and date.
If evidence is incomplete, keep the supplier change pending and route the issue to the finance owner.
An original control table for changed payee details
The authority column matters because an alert is useful only when someone owns the decision.
Small teams may need carefully assigned cover arrangements where complete organisational separation is difficult.
Keep the payment hold visible to the purchasing owner.
That person can manage expectations with the supplier and explain the delay.
Avoid revealing sensitive verification procedures in routine external messages, while making the internal reason for the hold easy to understand.
| Event | System behaviour | Authority |
|---|---|---|
| Invoice details differ | Flag and hold affected payment | AP investigator |
| Supplier requests urgency | Keep hold and escalate priority | Finance owner |
| Independent check completed | Attach verification record | Designated verifier |
| Master data ready to change | Require recorded approval | Authorised approver |
| Payment prepared | Check approved account version | Payment release owner |
Hypothetical scenario: urgency without a shortcut
A message requests immediate payment to a new BSB and account because payroll is supposedly waiting.
The extraction tool correctly reads the new details and detects the mismatch.
The AP officer contacts the previously established supplier number.
The nominated contact is unavailable, so the company cannot complete its normal verification.
The finance owner escalates the issue and discusses the payment timing through the established relationship, while leaving the changed account unapproved.
This scenario does not prove the request is fraudulent.
It shows that urgency should change how quickly a person investigates, not what evidence authorises the account change.
Any alternative payment decision still requires its own verified basis and approval through the company's established process.
Measure the friction and close the genuine gaps
Measure the number of changed-detail alerts, confirmed errors, unresolved requests and time spent waiting for a responsible person.
Investigate patterns before removing a control.
Review access to the supplier master itself.
If the same compromised account can change the approved record and release payments, comparing invoices against that record offers limited protection.
Evidence should show which account version was approved at the time of release.
Start with the last few legitimate supplier changes and reconstruct their decision path.
Identify where confirmation lived only in someone's memory or inbox.
Improve that handoff first, then automate detection and record assembly around the authority structure the business has deliberately chosen.
What this page cannot conclude
- 01These controls reduce exposure but cannot guarantee prevention or recovery.
- 02Bank verification services and account-name features vary by provider.
- 03No real supplier, account or payment was used in the hypothetical.
- 04This article was researched and drafted with AI assistance. Sources and limitations are provided for scrutiny; it is not an independent professional review or a compliance certification.
Sources
- 01Business email compromise scamsACCC, National Anti-Scam Centre, Scamwatch · accessed Sep 15, 2026
- 02Scam alert: Fake business invoice scamsACCC, National Anti-Scam Centre, Scamwatch · accessed Sep 15, 2026
This article was researched and drafted with AI assistance. Sources and limitations are provided for scrutiny; it is not an independent professional review or a compliance certification.
Our editorial standard · Found an error? Send a correction with its source.
/ CITE OR SHARE THIS GUIDE
Make the evidence easy to verify.
When you reference this guide, link to its canonical URL. That gives readers one stable place for the evidence, limitations and future updates.
dotSuper Research Desk. (September 15, 2026). Separate Supplier Bank Changes From Invoice Automation. dotSuper. https://dotsuper.net/feeds/applied-systems/australia-ap-supplier-bank-change-controls