The One-Page Policy That Stops Fake Invoices Getting Paid
A free, fill-in-the-blanks payment change policy and phone script for Australian accounting and conveyancing practices. Most of it’s already written. You add your practice name, get the partners to sign it, and you’re done this week.
- A one-page payment change policy your partners can sign this week, so the next “we’ve changed banks” email gets a phone call instead of a payment.
- A 60-second call-back script even your newest admin can follow, so checking a bank change stops feeling awkward and becomes just how things are done round here.
- A signed, dated control you can show your insurer at renewal, so when they ask how you stop payment fraud you’ve got a page to hand over, not a box you ticked and hoped for the best.
All it takes is one email saying “we’ve changed banks”, landing on a busy Friday arvo, and your client’s money is sitting in a crook’s account overseas before anyone thinks to pick up the phone.
Who this is for
You run the office at a practice with somewhere between 5 and 50 people. Somewhere along the way “the IT stuff” landed on your desk as well, on top of everything else. Your IT provider looks after the computers. Nobody has ever actually written down what happens when a client or supplier emails to say their bank details have changed. Mostly it’s fine. Then one day it isn’t. One doctor on Whirlpool found out the hard way when his practice paid his wages to a scammer:
“It was one of those swiss cheese things where no one checked with me.”
This page is the bit of cheese with no holes in it.
What’s inside
The policy
One page, in plain English. Nobody pays a changed bank account until someone has rung a phone number you already had on file. It covers who checks, when, and what to do if something smells off.
The call-back script
What to say on the phone, word for word, so your newest admin can make the call without feeling like they’re accusing anyone.
The sign-off block
A spot for partner signatures and a date, so you’ve got proof the control exists, not just a good intention.
It comes as a Word document, a Google Doc and a printable PDF. Use whichever one your practice actually opens.
Put together by Haden McAlpine at McAlpine Cyber. I’m a Kiwi in Sydney, a CISSP and ISO 27001 Lead Auditor with 13-plus years in security, and I’ve run a full ISO 27001 programme for a global company. Turns out the control that saves the most money is a phone call. Go figure.
On its way.
Check your inbox for an email from Haden McAlpine with the Word, Google Doc and PDF links. If it’s not there in a few minutes, check your junk folder.