The progress claim matches the project. The supplier's name is familiar. The email sits in the conversation you have been using throughout construction. Then a short note says the supplier has changed banks.
That is a separate decision from whether the work or materials should be paid for. Before authorising the affected transfer, independently verify where the money is going. A correct invoice amount and an approved construction milestone do not authenticate new bank details.
For a small developer, this is a project cashflow control, not just an IT issue. Money sent to the wrong destination may no longer be available for the next trade, while the intended supplier still expects payment. Build the check into the payment timetable rather than discovering the problem at the bank's cut-off time.
A genuine invoice can carry a false destination
The Australian Cyber Security Centre's business email compromise guidance describes criminals accessing a vendor's email account, changing contact and bank details on legitimate invoices, and sending them from the compromised account. The problem is not limited to an obviously fake sender or an unfamiliar invoice.
Scamwatch's current guidance says to stop and check changes to payee information and telephone the business using an independently sourced number. Checking the spelling of an email address can help, but it cannot settle whether a genuine account has been compromised. Nor does recognising a logo prove that the account receiving the transfer belongs to your supplier.
Separate the claim approval from the bank-detail change
Use two questions for invoices your project entity actually pays. First: is this the right claim for the agreed work, supply and project? Second: have the destination details been independently confirmed? Passing the first check should not automatically pass the second.
A practical project rule is that an email alone cannot authorise a supplier bank-detail change. Keep the existing supplier record intact while the proposed change is checked, flag the affected transfer for prompt escalation, and assign someone to resolve it. Do not substitute the old account automatically: a genuine supplier may have closed it.
This is a suggested internal control, not permission to disregard payment obligations. Arrange verification early enough to meet the applicable due date. If details remain unresolved, escalate immediately through your project's established payment process rather than assuming that a suspected scam extends a contractual or statutory deadline.
The callback needs an independent starting point
In its 19 October 2026 payment-redirection guidance, Commonwealth Bank recommends calling a trusted number already used or independently sourced, not the number on the invoice, and verifying the specific payment details. That distinction matters: calling a replacement number supplied in the same change request simply keeps you inside the suspect communication.
For an established contractor or supplier, start with a contact recorded and verified before the request arrived. If you do not have one, source contact details independently; do not follow the request's link to a supposedly updated contact page. Ask to speak with the person authorised to confirm that business's payment instructions.
Confirm that a change was requested, which supplier entity and project invoice it concerns, and the account name, BSB and account number intended for that payment. Compare the specific details, not just the statement that the business has changed banks. If the person cannot confirm them or the answers conflict, keep the matter unresolved and escalate; a friendly conversation is not the same as verification.
Leave a record the payment approver can actually test
The following is a suggested construction-project workflow built around the official callback advice. It is not an official prescribed form. Keep the record in your controlled accounts system, with access limited to the people who need it.
- Identify the change: record the supplier entity, project, invoice reference and the old and proposed details in the supplier-change record.
- Record the independent route: note where the trusted number came from, who was called, when, and their role in confirming payment instructions.
- Record the result: state which details were confirmed and which remain unresolved. Keep the original request available for investigation.
- Separate the approvals: have an authorised second person review the change evidence before the supplier record is updated and the affected payment is released.
- Check the actual transfer: compare the destination entered in the bank payment with the verified record, not merely with the latest PDF invoice.
Commonwealth Bank's guidance also recommends more than one payment approver. Two people pressing approve on the same unverified invoice is not the purpose of this control. The reviewer needs the independent confirmation evidence, not just the document that triggered the change.
Practice scenario: a change before the fit-out payment run
Consider a hypothetical duplex project where your project entity directly buys cabinetry. Before the scheduled fit-out payment run, an email in the usual supplier thread asks for the next invoice to go to a new account. This is a decision exercise, not a reported incident; no loss or outcome is assumed.
The trap is to let site urgency do the verification: the delivery is approaching, the invoice looks familiar and someone wants the payment cleared. Instead, the accounts person flags the proposed account change and uses the previously verified supplier contact to confirm the exact instructions. The authorised reviewer checks that evidence and the destination entered for the transfer.
If confirmation is unavailable, the useful next action is immediate escalation and communication through trusted contacts about the unresolved payment instructions and delivery timing. Do not invent a cleared-payment date, send to an unverified account to keep the programme moving, or assume that ignoring the invoice has no consequences.
The TPC deal lens: protect cash and programme together
A feasibility depends on cash reaching the right party at the right time. Redirection risk can create a funding gap; a poorly organised checking process can also put pressure on delivery and trade sequencing. The practical answer is not to choose between speed and checking, but to start checking before the payment run becomes urgent.
At supplier onboarding, establish a verified contact and explain your bank-change process. Before each run, identify changed destinations early, allow time for callbacks, and have a backup authorised approver available. Ask your accountant or bookkeeper to help make that workflow workable for your project entity and banking permissions. Verification reduces risk; neither a callback nor a second approval guarantees that fraud cannot occur.
If the money has already gone, act immediately
Do not wait for the next reconciliation. Scamwatch says to contact your bank immediately and ask it to stop transactions. Use the bank's trusted app or independently obtained contact route. Give its fraud team the transfer reference, time, amount and destination, and follow its instructions. Commonwealth Bank explicitly warns that recovery cannot be guaranteed; do not treat a report as money back in the project account.
Preserve the invoice, messages and approval record. Notify the genuine supplier through a trusted channel. The Cyber Security Centre recommends reporting the cybercrime and responding to compromised email accounts. If compromise is suspected, involve an IT security professional to investigate and secure the affected systems. Multi-factor authentication for email and banking is another protective layer recommended by Commonwealth Bank, not a replacement for checking changed payment instructions.
Key Takeaway
Approve the work and authenticate the destination as separate tasks. Independently call the supplier, confirm the exact changed details, keep a usable record and give the payment approver that evidence before project funds move. Plan this around payment deadlines, and involve the bank immediately if a suspicious transfer has already occurred.
Reader question: If a supplier's bank details changed before your next construction payment run, where would your team find a trusted callback number that did not come from the change request?
Image credit: Sasun Bughdaryan / Unsplash. Illustrative photograph. Source · Licence Cropped.
Sources and boundaries
Sources checked 30 October 2026.
- Australian Cyber Security Centre — Protecting against business email compromise — Current page checked 30 October 2026; the earlier deep link redirects here. Supports compromised-vendor invoice mechanisms, independently verified contact routes, consistent verification processes, MFA and incident response. Not a construction payment-law source or a guarantee.
- Scamwatch — Business email compromise scams — Current guidance checked 30 October 2026. Supports checking changed payee information, independently sourced callback numbers and urgent bank contact. No recovery entitlement or construction-contract deadline is established.
- Commonwealth Bank — Why payment redirection scams are getting harder to spot — Bank guidance dated 19 October 2026, checked 30 October 2026. Supports exact-detail callbacks, more than one approver, MFA and no guaranteed recovery. Bank education, not regulator directions; its named business case and monetary figure are not used in this article.
Sources checked 30 October 2026. This is Australia-wide cyber education applied to construction invoices the reader's project entity is responsible for paying, not a new law or an instruction to pay a builder's suppliers directly. The callback log, supplier-change review and scheduling steps are suggested project controls derived from official guidance, not a mandated universal procedure. The scenario is hypothetical and contains no loss figures or claimed real incident. Sources do not determine who bears a loss, whether an invoice remains payable after fraud, payment deadlines, suspension rights, insurance cover, reimbursement or fund recovery. No control guarantees prevention; reporting does not guarantee recovery.
General educational information only, not financial, legal, accounting or cybersecurity advice for your circumstances. Confirm your project's payment arrangements and deadlines independently. Your accountant or bookkeeper can help design accounts controls, your bank's fraud team can respond to a suspicious transfer, and an IT security professional can assess suspected email compromise. No fraud-prevention or recovery outcome is guaranteed.
Learn with Jason & AmyBuild practical small-scale property development skills with experienced mentors.Enquire nowRate this article
Guest rating: select 1 star for poor or 5 stars for great. No account is required.
Leave a comment
Join the discussion. Your email address will not be published.
Frequently asked questions
Should we still call if the request comes from the supplier's real email address?
Yes. The Cyber Security Centre describes invoice fraud using compromised legitimate vendor email accounts. Independently call a trusted supplier contact and confirm the exact new payment details rather than relying on the sender address or email thread.
What if the supplier is genuinely changing banks?
A change can be legitimate. Confirm it through an independently trusted route, record the details and obtain the required internal approval before updating the supplier record. Do not assume either the new account or the previous account is suitable without checking.
Does the builder approving the progress claim confirm the bank account?
No. Approval of work, materials or a claim amount answers a different question from authenticating the payment destination. For an invoice your project entity pays, keep the claim approval and the changed-bank-detail verification as separate checks.
What if I run the project accounts on my own?
Ask your accountant or bookkeeper to help design a practical callback record and review process, and arrange a second authorised approver where possible. Confirm appropriate banking permissions rather than sharing a login. An unavailable reviewer is a workflow issue to plan for, not evidence that an emailed bank change is genuine.
Will the bank get the money back if we report immediately?
Recovery is not guaranteed. Contact your bank's fraud team immediately through a trusted route, provide the transaction details and follow its instructions. Do not wait for a supplier dispute or assume a reported transfer has been reversed.
Loading comments…