XBert Type: Standard
Accounting Software: Xero, MYOB, QuickBooks Online
Country Restriction: All supported countries
Risk Type: Fraud Risk
Business Function: Purchases
Overview
This XBert watches for one of the most common payment scams: a supplier's bank account details are changed in your accounting software, and soon after, a payment goes out to that same supplier. This pattern is a classic sign of payment redirection fraud, where a scammer poses as a real supplier and asks you to update their bank account so the next payment lands in the wrong hands. Catching it early gives you a chance to verify before the money leaves.
What it does
XBert links two separate events that are easy to miss when looked at on their own: a change to a supplier's saved bank details, and a payment made to that same supplier shortly afterwards. It then checks whether that follow-on payment looks unusual for that particular supplier, based on their own past payment history.
How it works
When a supplier's bank account details are changed, XBert looks for any payment to that supplier in the days that follow. It only acts when there is a real, sizeable payment at stake, so very small payments are ignored.
How it decides to raise the XBert depends on how much history you have with that supplier:
If you have paid the supplier many times before, XBert compares the new payment against what you would normally pay them. It only raises the alert when the amount is clearly out of step with their usual pattern. This keeps the focus on the payments most worth a second look.
If the supplier is fairly new and there is not enough history to judge what is "normal", XBert raises the alert once for that change, on the first meaningful payment, simply asking you to confirm the new bank details are genuine.
XBert deliberately ignores a few things to avoid unnecessary noise. It skips very small payments, it only looks at payments made within a short window after the change (not unrelated payments weeks later), and once you have confirmed a bank change is genuine, it will not keep alerting you about that same change again.
Example/Use Case
Priya manages payments for a building firm. An email arrives, appearing to come from a long-standing subcontractor, saying they have switched banks and asking for future payments to go to a new account. Priya updates the supplier's bank details and, a few days later, pays a $14,500 invoice. XBert notices that the bank account was changed and that this payment is well above what the firm normally pays that subcontractor. It raises this XBert the same day. Priya phones the subcontractor on their known office number (not the number in the email) and discovers they never changed banks. She reverts the bank details, contacts her own bank's fraud line immediately, and the redirected payment is stopped before it clears.
Accounting software
This XBert runs for organisations connected through Xero, MYOB and QuickBooks Online.
Which countries it supports
This XBert is available in all supported countries.
Processes
Business area: Purchases (Accounts Payable). If you receive this XBert, treat it as time-critical and take these steps:
Do not make any further payments to the supplier until you have verified the change.
Phone the supplier directly on a known, official number you already have on file. Never use a phone number or link supplied in the email or message that requested the bank change.
Confirm with the supplier whether they genuinely changed their bank account details.
If the change is not genuine, revert the supplier's bank details to the correct account straight away.
If a payment has already gone out, contact your bank's fraud line the same hour to attempt a recall, and report the incident to the police or your country's cybercrime reporting service.
Once you have confirmed the bank change is legitimate and your records are correct, mark the XBert as resolved.