Free tool · Printable

Payment-change call checklist

One page for the person who takes the call. Print it, pin it by the phone, or save it as a PDF for your procedures folder. No sign-up.

Mortgage brokers and financial advisers

A caller wants to change where the money goes

Say: "We check changes to payment instructions independently. I'll call you back on the details we already hold."
  1. 01Pause the request and end the incoming call.
  2. 02Call the client on a number established independently before the request and recorded on their file. Don't use a new number supplied with the request.
  3. 03If the number on file is missing, was recently changed, or is disputed, don't proceed on this call. Escalate it through a separate process.
  4. 04On the call-back, ask the client to state the recipient, amount, destination account and reason for the change themselves. Confirm authority through your firm's separate process.
  5. 05Have a second person review the evidence under your firm's approval process. If you work alone, keep the request paused and use your agreed licensee or principal escalation route.
  6. 06If funds may already have gone astray, contact the relevant bank straight away, keep the evidence, and report through the appropriate channels.

Keep the change paused if anything remains unresolved. Completing a call-back does not by itself authorise a change or payment.

Write down

  • How the request arrived, and exactly what was asked for
  • The number you called back on, and where that number came from
  • The checks you did, and anything left unresolved
  • Who reviewed or approved it, and the outcome

Suggested checklist from Vericode, informed by public guidance. No regulator, licensee or association endorsement is claimed. This is not their procedure and does not replace your procedures or legal obligations. This checklist does not verify identity, authority or destination-account ownership, and a call-back alone does not establish them. Never ask for or accept passwords or bank, lender, login or payment-authorisation codes. General information only, not legal or financial advice. vericode.com.au

Full guide with sources
Property managers

An owner calls to change the account their rent goes to

Say: "We check changes to owner bank details independently. I'll call you back on the details we already hold."
  1. 01Pause the change and end the incoming call. If a payment is due before the concern is resolved, escalate promptly to the principal or licensee in charge.
  2. 02Call the owner on a number established independently before the request and recorded on their file. Don't use a new number supplied with the request.
  3. 03If the number on file is missing, was recently changed, or is disputed, or contact details are changing alongside bank details, keep the change paused and escalate through a separate process.
  4. 04On the call-back, ask the owner to state the new account details and the reason for the change themselves.
  5. 05Keep checking the request, entering details and authorising payment separate under your agency's approval process. Confirm the caller's authority through a separate process and obtain the withdrawal authorisation required by the trust account rules that apply to your agency. Keep the change paused until required checks and approvals are complete.
  6. 06If you suspect fraud and details have already been changed or rent has been sent, escalate immediately, contact the bank, preserve the evidence and review potentially affected email accounts.

Keep the change paused if anything remains unresolved. Completing a call-back does not by itself authorise a change or payment.

Write down

  • How the request arrived, and exactly what was asked for
  • The number you called back on, and where that number came from
  • The checks you did, and anything left unresolved
  • Who reviewed or approved it, and the outcome

Suggested checklist from Vericode, informed by public guidance. No regulator, licensee or association endorsement is claimed. This is not their procedure and does not replace your procedures or legal obligations. This checklist does not verify identity, authority or destination-account ownership, and a call-back alone does not establish them. Never ask for or accept passwords or bank, lender, login or payment-authorisation codes. General information only, not legal or financial advice. vericode.com.au

Full guide with sources
Accountants and tax agents

A client asks to change their bank or refund details

Say: "We check changes to bank or refund details independently. I'll call you back on the details we already hold."
  1. 01Pause the change and end the incoming call or leave the email thread. Don't confirm existing bank details or disclose other client information to an unchecked caller.
  2. 02Call the client on a number established independently before the request and recorded on their file. Don't use a new number supplied with the request.
  3. 03If the number on file is missing, was recently changed, or is disputed, don't proceed on this call. Keep the change paused and escalate through a separate process. Do the same if contact fails or concerns remain.
  4. 04On the call-back, ask the client to state the requested change, new account details and reason themselves, including which ATO accounts they mean. Don't read out details from the request before your checks are complete. A read-back only checks for typing errors.
  5. 05Apply your practice's separate client identity, representative authority and approval procedures. Consider ongoing proof of identity checks under TPB(GS) 42/2022, including changed circumstances or discrepancies. A successful call-back does not satisfy TPB or ATO client verification obligations or establish destination-account ownership.
  6. 06Proceed only after concerns are resolved and required checks and approvals are complete. In Online services for agents, use Profile > Financial institution details for the intended ATO accounts. These details cover refunds and ATO-held super, not direct debits or payment plans. Check each intended record was updated, including any practice-software submission, and notify the client through a separately verified channel.

Keep the change paused if anything remains unresolved. Completing a call-back does not by itself authorise a change or payment.

Write down

  • How the request arrived, and exactly what was asked for
  • The number you called back on, and where that number came from
  • The checks you did, and anything left unresolved
  • Who reviewed or approved it, and the outcome, including which ATO accounts were updated

Suggested checklist from Vericode, informed by public guidance. No regulator, licensee or association endorsement is claimed. This is not their procedure and does not replace your procedures or legal obligations. This checklist does not verify identity, authority or destination-account ownership, and a call-back alone does not establish them. Never ask for or accept passwords or bank, lender, myGov or ATO, login or payment-authorisation codes. General information only, not legal or financial advice. vericode.com.au

Full guide with sources
Conveyancers and small law firms (QLD/NSW)

A client or the other side's practitioner asks to change where settlement funds, a deposit or a balance goes

Say: "We check changes to payment instructions independently, so I'll call back on the details we already hold."
  1. 01Pause the change and end the incoming call or leave the email thread. Don't pay out, update settlement payment details or pass the new payment instructions to the client while checks are pending. Don't disclose existing account details or other client information to an unchecked caller.
  2. 02Call the client or the other side's practitioner, as appropriate, on a number established independently before the request and recorded on the matter file. Don't use a number supplied with the request, in its email signature or on the incoming caller ID.
  3. 03If the number is missing, was recently changed or is disputed, keep the change paused and escalate to the principal or person responsible for the matter through a separate process. Do the same if contact fails or concerns remain. Escalate promptly if a settlement or payment deadline is approaching.
  4. 04On the call-back, ask the person to state the requested change, intended recipient, amount, new BSB and account number, and reason themselves. Don't read out the requested details for a simple yes. A read-back only checks for typing errors. If the client is to pay, ask them to call your firm on its previously established number to check the payment instructions before transferring.
  5. 05Apply your separate identity, authority, payment-approval and applicable trust-account procedures before changing instructions or releasing funds. Check any PEXA payment entries against the checked instructions before signing. A call-back does not verify identity, authority or account ownership, or satisfy VOI, AML/CTF, trust-account or other regulatory obligations.
  6. 06Proceed only after concerns are resolved and required checks and approvals are complete. If funds may already have gone astray, contact the relevant bank immediately, alert the principal and affected client, preserve the evidence and follow your incident-reporting process.

Keep the change paused if anything remains unresolved. Completing a call-back does not by itself authorise a change or payment.

Write down

  • How the request arrived, and exactly what was asked for, including the matter and payment affected
  • The number you called back on, and where that number came from
  • The checks you did, and anything left unresolved
  • Who reviewed or approved it, and the outcome, including any payment instructions or PEXA entries changed

Suggested checklist from Vericode, informed by public guidance. No regulator, licensee or association endorsement is claimed. This is not their procedure and does not replace your procedures or legal obligations. This checklist does not verify identity, authority or destination-account ownership, and a call-back alone does not establish them. Never ask for or accept passwords or bank, PEXA, email or other login, MFA, account-recovery or payment-authorisation codes, including SMS, authenticator and security-token codes or PINs. General information only, not legal or financial advice. vericode.com.au

Full guide with sources