How to check a payment for fraud before you send it

Why it matters

Business email compromise and false billing scams are common. The only warning sign may be a new bank account.

A two minute check before release is cheaper than trying to recover money from a bank after it has left.

The steps

1. Compare the bank details. Check the BSB and account number against the last payment to that supplier. Any change stops the payment until it is confirmed.
2. Call the supplier. Phone a number you already hold, not one in the email. Ask them to confirm the new details and the invoice.
3. Check the sender. Look at the full email address. A swapped letter or a different domain is a warning sign.
4. Check for pressure. Urgency, secrecy or a request from a director to skip the normal steps are warning signs.
5. Check the invoice. Does it match a purchase order or a delivery? Is the ABN valid and registered for GST? Is the invoice number in sequence?
6. Check the amount. Compare with the supplier's usual invoices. A big jump or a round number is worth a second look.
7. Use two people. The person who enters the payment is not the person who releases it. Record who checked.
8. Report a scam fast. If money has gone, call your bank straight away. Then report the scam to Scamwatch and the Australian Cyber Security Centre.

The Pulsify way

1. Pulsify flags changed bank details against the supplier's past invoices and the supplier record in your accounting system, such as a Xero or MYOB contact.
2. It checks the supplier ABN and flags one that is invalid or not registered for GST.
3. It checks every invoice for a possible duplicate and asks for confirmation before approval.

Pulsify never moves money. The phone call to the supplier is still yours to make.

Worked example

Example Builders Pty Ltd gets an invoice from Example Timber for A$18,700 with new bank details.

Check	Finding	Action
Bank details	Different from the last 6 payments	Hold the payment
Sender address	examp1e-timber.com instead of example-timber.com	Do not reply to the email
Pressure	Asks for payment today	Treat as a warning
Phone check	Supplier says they have not changed banks	Report the scam

All four checks fail. The payment does not go out and the invoice is reported as a scam. Paying it would have cost A$18,700.

Common mistakes

• Calling the number printed on the suspicious email.
• Letting a director override the checks.
• Checking only first-time suppliers.
• Not recording who confirmed the change.

Next step

Use the Payment fraud risk check first. Then see Pulsify fraud prevention.