If someone changes a supplier’s bank details and your team pays the new account, your business may still owe the supplier the full amount. Two Australian courts have reached that outcome: the NSW District Court in 2026 and the WA District Court in December 2024. A bank-detail change needs a process that runs every time, not a phone call made when someone has time.

How big is payment redirection fraud in Australia?

Payment redirection is the second most costly scam type reported in Australia, behind investment scams. Australians reported losing $166.8 million to it in 2025, up from $152.6 million in 2024 (National Anti-Scam Centre, Targeting Scams report).

That figure covers Australians generally, not only businesses, and it only counts what was reported. But the pattern is one every AP team knows. A request arrives that looks like it’s from a real supplier. The only thing that has changed is the account the money goes to.

What did the NSW District Court decide in 2026?

In MJ Concepts Kotara Pty Ltd v Pandora Jewellery Pty Ltd (No 2) [2026] NSWDC 262, Pandora had agreed to buy back the assets of a store run by one of its franchisees, MJC, for $467,378. MJC’s invoice set out its bank account.

A fraudster then used a compromised MJC email account to send different bank details, in an email sent at 2.16am with a fake bank letter attached. Pandora paid the full amount to the fraudster’s account. Most of the money was moved on quickly and couldn’t be recovered.

The court found the email had no legal effect, because nobody at MJC sent or authorised it. It also found that the email’s timing, wording and attachment should have prompted a check with MJC through a known contact. Pandora remained liable to pay MJC the $467,378, plus interest and costs.

What happened in Mobius v Inoteq?

Mobius Group invoiced its client Inoteq for electrical services. A fraudster got into the email account of a Mobius director and sent Inoteq new bank details with a fake invoice.

Inoteq was suspicious and phoned Mobius to check, but a poor connection meant the call confirmed nothing. Rather than call again, it sought confirmation by email through the same account the fraudster controlled. Then it paid.

The court ordered Inoteq to pay Mobius $191,859.16 plus interest ([2024] WADC 114). It found Inoteq was in the better position to protect itself, including by making another call.

What do the two cases have in common?

The payers in both cases were innocent, and the fraud came from the supplier’s real email account. The courts still left the loss with the payer, because the payer was better placed to check the bank details before paying.

These are District Court decisions in two states. They don’t bind courts elsewhere and they aren’t settled national law. Every case turns on its facts, so take legal advice on your own contracts and position. But they put a clear question in front of every CFO: if our process fails, who pays?

Why isn’t a callback policy enough?

Most finance teams have a rule: if bank details change, call the supplier on a number you already hold. It’s a good rule. The problem is that it relies on one person, on one day, following it all the way through.

Inoteq did make the call. When it didn’t get a clear answer, it fell back on the channel the fraudster controlled. That’s an easy mistake under pressure. Think about when these requests land: late on a Friday before the payment run, when the AP officer who knows the supplier is on leave, or when a project manager forwards the email with “the supplier is chasing, please pay today”.

A callback is a useful check. On its own, it’s a habit, and habits slip. A control is a step the process won’t let you skip, whoever is at the desk.

Where can a bank-detail change get into your process?

In most organisations there are several entry points:

An email to the shared AP inbox, often with a letter on the supplier’s letterhead
A request forwarded by a site, store or project manager
A phone call to someone in finance
A direct edit to the vendor master in the ERP
A new invoice that simply shows different bank details

If any of these can change where money goes without a separate check and approval, that’s your gap.

What controls reduce the risk of bank-detail fraud?

The stronger approach treats a bank-detail change as a controlled event, not an email to action.

Suppliers maintain their own details. Changes come through a supplier self-service portal, not an inbox, so there is one way in.
No one person can request, approve and release a change. Segregation of duties (SoD) separates these steps, so the person who receives or enters a bank-detail change can’t also approve it or release the payment.
Changes are approved before they reach finance. A new or changed account is validated and approved before it reaches the ERP vendor master.
Bank details are verified independently. An optional third-party service checks the details before payment.
The rules run every time. The check doesn’t depend on who is at the desk or what time it is.
Every step is recorded. The audit trail shows who requested the change, who approved it and what was checked.

None of this replaces your ERP. The ERP stays the system of record for posting and payment. The controls sit in front of it.

Can better controls change your insurance outcome?

They can, and this is the part many CFOs don’t expect. The clearest example we have comes from construction.

Lipman is a construction company on Jobpac, with up to 3,000 invoices a month processed with minimal manual input. It uses RapidP2P together with Eftsure. With those controls in place, Lipman secured $250,000 in social engineering fraud cover at no additional premium, and its insurer rated the control environment low risk.

The same supplier checks also helped Lipman avoid approx. $200,000 a year in ATO repayments from GST incorrectly claimed from non-registered vendors and subcontractors, again with Eftsure.

That changes the conversation. Supplier controls become evidence you can put in front of your insurer and your board, not just an AP cost.

Four questions to ask your team this week

How many ways can a supplier’s bank details be changed in our business today?
Can the person who requests a bank-detail change also approve it, or release the payment?
How do we confirm a change, and is it ever through the same channel the request came from?
If we paid the wrong account tomorrow, could we show our insurer exactly what was checked?

Next step

If you’re not confident of the answers, book a complimentary 30-minute AP assessment. We’ll map where bank-detail changes can enter your process and where a rule can replace a judgement call.

Book your AP assessment