A real supplier may change banks. A false request may arrive inside a familiar email thread and quote the right invoice. The payment team needs a separate record of who asked, who called back and who approved the new payee details.
For a small dairy maker, the most urgent invoice may be for milk or a refrigeration repair. That urgency is operationally real. It does not establish that a new BSB and account number belongs to the supplier.
Two records, two decisions
An approved invoice tells finance what the business owes. The supplier master tells finance where an authorised payment can go. A change request does not update either record by itself. The invoice can be valid while the new bank details remain unverified.
Dairy businesses also keep supplier and product records for food traceability. Those records can help identify a trading relationship; they do not validate bank ownership. The distinction matters when a message appears to come from a known producer, carrier or cold-chain contractor.
A useful sequence for the payment desk
- Reconcile the invoice. Match the payee, invoice number, amount and approval to internal records. Note the payment date without using it to compress the verification step.
- Separate the requested bank change. Keep the approved details in the supplier master until the business completes its change process. Do not treat an email, attachment or web notice as approval.
- Call a known number. Use contact details held before the change request. Record who answered, what was confirmed, who called and when.
- Obtain independent approval. Apply the business's second approval before the master is changed. Hold the affected invoice while either step is outstanding.
What belongs in the draft run
Show each approved invoice and its current status. A pending bank change belongs on the exception list with the verification action and owner. The proposed account field can remain blank. The existing bank details should not be treated as a safe workaround when the supplier has said they are changing.
A supplier notice, a call-back record and a bank-side name match answer different questions. Confirmation of Payee is a service delivered within the payment flow by participating financial institutions. A public article or notice index cannot provide that bank-side result.
Sources and scope
The Australian Cyber Security Centre describes payment-detail change requests as a common business email compromise pattern and advises independent contact. Dairy Food Safety Victoria's licensee register is relevant to dairy supplier identity and licensing; it is not a bank-account register. These notes are general practice guidance. Your organisation's procedure governs approval and release.