The BSB Check That Stops Payment Redirection Fraud Before the Money Leaves

Payment redirection fraud — sometimes called business email compromise when it starts with a hijacked or spoofed email thread — follows a consistent pattern. A legitimate-looking message arrives, appearing to come from an existing supplier, advising that their bank details have changed. An invoice that would otherwise be processed normally is paid to the new account instead. By the time anyone notices, the money is gone and the account it went to was opened specifically for this purpose, days or hours before the request landed.

The single most effective interruption point in this entire scheme is also the simplest: verifying the account name actually attached to the bank account number matches the entity you believe you are paying, before the transfer is sent — not after.

Why "It Looked Right" Isn't Verification

A BSB number that resolves to a real, active bank branch tells you the number is correctly formatted and the institution exists — it tells you nothing about whose account it actually is. Fraudulent payment redirection requests almost always include a perfectly valid BSB and account number; the fraud is not in the number being fake, it is in the number belonging to someone other than who the request claims.

The check that actually catches this is account name verification — confirming the name registered against the BSB and account number matches the expected payee, which most banks support via a name-match service at the point of transfer (often shown as a "this doesn't quite match" warning during online banking transfers, easy to dismiss under time pressure). Gumshoe's bank check formalises this as an explicit, logged verification step rather than a dismissable banking-app prompt.

What the Check Actually Confirms

Given a BSB and account number, the check confirms the BSB resolves to a valid, currently active financial institution branch, and — where supported — returns the registered account name for comparison against the expected entity name. A mismatch between the registered account name and the entity you believe you are paying is the single highest-value signal this check can return: it is close to definitive evidence that something has gone wrong with the payment details somewhere in the chain, whether through fraud or simple administrative error.

The Cheapest Insurance in the Building

Payment redirection losses are typically irrecoverable once the transfer clears — the receiving account is usually emptied within hours, and the banking system's name-match warnings are advisory, not blocking, in most transfer flows. A verification check that takes a few seconds against a payment of any meaningful size is not a proportionate cost question; it is closer to free, set against the alternative.

Make BSB and account-name verification a mandatory step specifically when supplier bank details change, not just at first onboarding. That single procedural change closes the door on the most common and most costly fraud pattern in accounts payable.

Uncommon Insights

Under the Corporations Act 2001 (Cth), specifically section 286, Australian companies are required to maintain accurate and up-to-date financial records. However, in the context of payment redirection fraud, the onus is on the payer to verify the account details before making a payment. ASIC's Regulatory Guide 221 (RG 221) on 'Facilitating online financial services disclosures' highlights the importance of verifying account details, but it is the payer's responsibility to ensure the account name matches the expected payee, which is not always explicitly stated.

The Australian Taxation Office (ATO) has reported that payment redirection scams are a significant threat to businesses, with losses totalling millions of dollars each year. However, what is less well-known is that the ATO's own systems, such as the Australian Business Register (ABR), can be used to verify the authenticity of a supplier's ABN and associated bank account details. By conducting a simple search on the ABR, businesses can quickly verify the legitimacy of a supplier's bank account details and reduce the risk of payment redirection fraud.

ASIC's enforcement patterns in relation to payment redirection fraud are worth noting. In recent years, ASIC has taken action against several businesses that have failed to implement adequate risk management systems to prevent payment redirection fraud. For example, in 2020, ASIC issued a warning to a financial services company for failing to implement adequate controls to prevent payment redirection fraud, resulting in a loss of over $1 million. This highlights the importance of implementing robust risk management systems, including real-time BSB and account-name verification, to prevent payment redirection fraud.

Section 12DL of the Australian Securities and Investments Commission Act 2001 (Cth) requires Australian financial services licensees to have adequate risk management systems in place to prevent and respond to cyber security incidents, including payment redirection fraud. However, what is less well-known is that this requirement also applies to non-financial institutions, such as businesses that provide online financial services. By implementing real-time BSB and account-name verification, businesses can demonstrate compliance with this requirement and reduce the risk of payment redirection fraud.