The weeks before Christmas are the hardest of the year for whoever pays the bills. Invoices pile up, suppliers want settling before the shutdown, and half the team is already thinking about the beach. It is also when a changed bank account number is least likely to get a second look.
That is the opening fraudsters wait for. The National Cyber Security Centre (NCSC) recorded $12.4 million in direct losses in the third quarter of 2025, more than double the quarter before. It put the jump down to a handful of business email compromise cases, where a criminal gets into an email account and then sends fake invoices or changes payment details.
Losses have eased since, but the pattern holds: A few big hits rather than many small ones. In the first quarter of 2026, just 42 incidents made up 97 percent of the $5.6 million reported.
“Payment fraud doesn’t always involve an obviously suspicious request, and often looks more like a routine change to supplier details,” says Ramesh Menon, Chief Product Officer at payment verification firm Eftsure.
The invoice can be genuine, approved and due. The only thing wrong is where the money lands. Here are five ways Menon suggests to help close that gap before the year-end rush.
1. Treat every bank account change as suspect
A request to update a supplier’s account details should trigger a check every time, even when it comes from a contact you know. Phone the supplier on a number you already hold, never one in the email or on the new invoice.
Then go one step further. Menon’s point is that confirming a supplier asked for the change is not the same as confirming the new account belongs to them. Both need a tick before any money moves.
2. Use Confirmation of Payee, and know its limits
New Zealand banks now run a name-and-number match when you pay someone new. It is free, and it is the quickest check you have. It is not a safety net.
- It runs when you add a payee, edit one or make a one-off domestic payment. Payees you saved earlier are not rechecked.
- A “no match” is a warning only. The bank will not block the payment.
- A supplier’s account may sit under its legal name, not its trading name, so ask for the exact account name up front.
- Coverage across business banking portals and batch payment files is uneven. Ask your bank whether the channel you use is checked.
Put your own exact account name on your invoices too, so customers get a clean match when they pay you.
3. Don’t let urgency set the pace
Last-minute changes and “pay today” requests deserve more scrutiny, not less. Fraudsters time them for busy periods because rushed people skip steps.
Write down a simple rule, such as no account change processed on the day it is requested. Make it clear that anyone can pause a payment they cannot verify, and that nobody gets in trouble for doing so.
4. Put two people on every change
No change to supplier bank details should rest on one person. Have a second authorised person review it, limit who can edit supplier records, and keep a note of who requested, verified and approved each change.
If you are the whole finance team, borrow a second pair of eyes. Your bookkeeper, accountant or business partner can sign off changes in a two-minute call.
5. Find out who carries the loss
Many owners assume the bank or the insurer will make them whole. Check before you need to.
Since 30 November 2025, banks have committed to reimbursing some scam victims up to $500,000 where the bank fails to meet its own protection commitments. The scheme was announced as a consumer protection and comes with conditions, so ask your bank where a business account stands.
Insurance is no surer. Funds transfer fraud is often excluded from standard cyber policies or capped at a lower limit unless you have added specific cover. One call to your broker will tell you.
Before the shutdown
Most of these scams start in a hijacked inbox, so the fix is not only in accounts payable. Turn on multi-factor authentication for email, and have your IT provider look for auto-forwarding rules you did not set up, which the NCSC flags as a sign someone else is reading your mail.
Then make verification routine rather than something you do only when a request feels off. As Menon puts it, businesses need “to ensure verification is a standard part of their payment processes”.
An hour spent now mapping where account details come in, who checks them and what happens when they change costs far less than a payment you cannot get back. If one does go astray, ring your bank straight away and report it to the NCSC.
