Scam-Safe Payment Practices: What Businesses Are Now Expected to Have in Place

Banks, regulators, and industry bodies have progressively increased expectations around businesses actively preventing these scams, rather than treating them purely as an unfortunate but unavoidable cost of doing business. This shows up in a few ways:

• Increased scrutiny of whether a business had reasonable verification processes in place when a payment redirection scam occurs, which can affect commercial disputes over who bears the loss between the parties involved.
• Growing expectation that businesses verify any change to payment details through a separate, independent communication channel — not simply by replying to the same email thread the change request arrived on.
• Reputational risk, since a business whose email systems are compromised and used to defraud its own customers or suppliers faces damage to trust and relationships, beyond any direct financial loss.

1. Never update payment details based solely on an email request. Any request to change bank account details — regardless of how legitimate the email appears — should be verified through a separate channel, ideally a phone call to a previously known, independently sourced contact number (not a number provided in the email itself, which could also be part of the fraud).

2. Establish a standard process for all payment detail changes. Rather than leaving verification to individual judgment on a case-by-case basis, have a documented internal process that requires verification before any change to a supplier's or customer's payment details is actioned.

3. Train staff specifically on recognising payment redirection attempts. Many of these scams succeed because they exploit normal business urgency (an invoice due soon, a request marked urgent) — staff trained specifically to slow down and verify in these situations are considerably less likely to fall for the scam.

4. Use multi-factor authentication and access controls on email systems. Since many of these scams begin with a compromised email account (either your own or a supplier's), securing email access reduces the risk of your systems being the point of compromise in the first place.

5. Communicate expectations to your own customers. If your business regularly invoices customers, consider explicitly communicating that you will never change payment details via email alone, and encouraging customers to verify any such request through a known phone number — this protects your customers and your business's reputation simultaneously.