Pharmacy Supplier Payment Fraud: Verify Bank Detail Changes

Pharmacy supplier payment fraud occurs when a payment intended for a legitimate supplier is redirected to someone else. A genuine delivery and a correctly matched invoice do not verify new bank details.

Imagine a routine wholesaler invoice arriving in a familiar email thread with a note announcing a new account. The amount matches, but the payee has changed.

The workflow below is a suggested control for Australian pharmacy owners. It separates invoice approval, supplier verification and payment release without assuming any particular banking software.

Identify the pharmacy supplier payment fraud trigger

Treat a new supplier payee or changed payment instruction as a verification event. Include changes sent by email, telephone, portal message or an attached invoice.

Scamwatch describes business email compromise scams involving invoices with altered payee information. Its examples include convincing threads and copied business identifiers.

Correct spelling, a known logo or an expected invoice amount cannot resolve the question by itself. Staff need to establish who authorised the payment destination.

Pause the change while checking it. Make that pause part of the normal process so staff can apply it without accusing a genuine supplier of wrongdoing.

Tell the supplier through a trusted channel when verification may affect timing. An impending payment deadline should trigger a clear escalation, rather than silent delay.

Keep invoice matching and payee verification separate

Use your supplier invoice reconciliation process to confirm accepted stock, quantities, prices and credits. That checks the liability being proposed for payment.

Payee verification asks a different question: does this payment destination belong to the intended supplier, and has the change been authorised?

Do not let a successful goods match automatically approve a new bank account. Record the invoice outcome and payee outcome as separate decisions.

For a new supplier, establish the approved contact and verification process during onboarding. Avoid making the first urgent payment the moment that process is invented.

If the invoice itself is unexpected, investigate both the liability and the payee. The receiving checklist can help locate the relevant accepted-delivery record.

Verify through an independently trusted route

Scamwatch recommends calling an independently sourced number when checking a payee change. Do not use the contact details supplied in the message being tested.

Use an established supplier contact record or an independently located official channel. Check that your existing contact record has not been changed by the same unverified request.

Ask the supplier to confirm the proposed change through the pharmacy’s agreed process. Confirm who is authorised to approve it and which invoices it applies to.

Record the verification channel, person contacted, time and result. Keep account details in the approved finance record rather than copying them across informal messages.

If you cannot reach an authorised supplier representative, keep the change unresolved and escalate it to the payment owner. Staff should know the backup destination.

Do not use a familiar voice as the sole proof

The September 2026 ASD personnel-security guidance addresses synthetic impersonation. It advises positive identity verification through a pre-established method or independent trusted channel before sensitive changes.

This includes bank-detail and transaction changes. A voice or video resemblance alone is insufficient under that guidance.

The ISM is advice with a defined legal scope, rather than an automatic legal requirement for every pharmacy. It is useful when designing your verification procedure.

Give staff a route to verify even when a request appears to come from the owner. A senior person’s apparent urgency should not waive the documented process.

Do not ask anyone to share passwords or authentication codes as proof. Escalate a request that tries to replace verification with access to another person’s account.

Control the payee change before releasing funds

Stage	Question to resolve	Suggested evidence
Invoice review	Is this the amount owed for accepted supply?	Matched invoice and resolved discrepancies
Supplier verification	Is the change genuine and authorised?	Independent contact and verification outcome
Payee update	Was the approved destination entered correctly?	Authorised change record and checked details
Payment approval	Is this release within the approver’s authority?	Approval against the verified payee and liability
Closure	Was the payment and supplier outcome recorded?	Transaction reference and unresolved follow-up

Where staffing allows, separate the person changing a payee from the person approving payment. This is a recommended operating control, not a claimed national staffing rule.

For a small team, agree an alternative independent review with the owner or authorised finance adviser. Record any exception before releasing payment.

Review the destination again if details change between verification and release. An approval for one account should not silently carry over to another.

Bank-provided name or account checks can support the process where available. Understand their limits and use them alongside independent verification.

A small test transfer only shows that money reached the supplied destination. It does not establish that the intended supplier owns the account.

Practise the pressure points with fictional requests

Ask staff to work through a pretend urgent bank change, an unavailable supplier and a request apparently sent by the owner. Use fictional account details throughout.

Check whether staff know where to find trusted contacts and who can approve an exception. A policy is difficult to apply if that information is missing.

ASD’s social engineering guidance explains how pressure and apparent authority can influence actions. It also recommends reporting suspicious workplace messages to the relevant security team.

Staff should preserve a suspicious message through the approved incident process. Avoid forwarding it broadly or opening attachments merely to gather more evidence.

Review failures in the process without turning them into blame. Update the supplier register, backup contacts and approval instructions where the rehearsal reveals a gap.

Respond quickly if money has already moved

Scamwatch advises contacting your bank immediately if you suspect a scam. Use a trusted bank number or established banking channel.

Give the bank the transaction details it requests and follow its response instructions. Recovery is uncertain, so do not promise the team that a payment can be reversed.

Alert the authorised incident owner and secure the relevant finance and communication records. Have qualified IT support assess any suspected account compromise.

Verify the supplier’s position independently and identify other payments that may be affected. Keep the investigation separate from routine invoice processing.

Follow the appropriate reporting process, including Scamwatch where relevant. If personal information may have been exposed, obtain qualified assessment of applicable privacy notification duties.

Use your continuity plan when a finance or email restriction interrupts operations. Document any alternative process and its authorisation.

Close the incident only when the payment position, supplier liability and outstanding corrective actions are clear. Keep named owners for anything still unresolved.