Supplier bank change requests

Detects supplier/vendor bank detail change requests - the payment-redirection pattern behind business email compromise: a bank-detail change phrase combined with a BSB, a bank account number, a named supplier/payee or a vendor number/ABN. Phrase-only mentions (scam warnings, AP procedures) stay discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Enforce tiers need a populated BSB, account, supplier or vendor-number field beside the change phrase; 'fraud prevention' and 'supplier verification' were removed from the primary because they matched generic policy text. Scam warnings and AP procedures stay at 65. Medium because legitimate supplier onboarding forms share the structure.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
Frameworks: ISO 27001, ISO 27701
Data categories: pii
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:(?:supplier|vendor|creditor|payee)\s+bank(?:ing)?\s+(?:details?\s+)?(?:change|update|amendment)(?:\s+request)?|change\s+of\s+bank(?:ing)?\s+details|bank\s+details?\s+(?:change|update|amendment)|(?:new|updated|revised)\s+bank(?:ing)?\s+(?:account\s+)?details|payment\s+redirect(?:ion)?|BSB\s+change|remittance\s+(?:details\s+)?update|vendor\s+bank\s+modification)\b

Corroborative evidence keywords

call-back, callback, verified by phone, verbal verification, effective date, effective immediately, previous account, old account, authorised signatory, bank statement, data record, database record, record set, data extract, data export, database table, spreadsheet, data registry, registry entry, master data (+2 more)

Proximity: 300 characters

Should match

Supplier bank details change request Supplier: Harbour Logistics Pty Ltd Vendor ID: V10442 ABN: 51 824 753 556 New BSB: 064-000 New account number: 12345678 Effective date: 01/10/2026. Verified by phone call-back to the number on file by Casey Rourke. — Populated change request - supplier, vendor ID/ABN, BSB, account and call-back verification (85)
Change of bank details Vendor: Coral Coast Freight Pty Ltd Forwarded to accounts payable for review. — Change notice with a named vendor only (75)
Subject: Updated bank details for remittance Account name: Greenvale Produce Co Pty Ltd BSB: 082-991 Account number: 48213367 Our previous account is closing on 30/10/2026. Bank statement on company letterhead attached - please apply before the next payment run. AP note: held pending call-back to the supplier contact in the vendor master. — Supplier email with account name, BSB, account number and previous-account/letterhead/call-back evidence (85)

Should not match

Fact sheet: payment redirection scams ask you to update a supplier's bank details. Always verify a change of bank details by calling the supplier on a known number before updating the BSB and account number. — Scam-awareness fact sheet
SUPPLIER BANK DETAILS CHANGE REQUEST Supplier name: __________ ABN: __ ___ ___ ___ BSB: ___-___ Account number: __________ — Blank change-request form - placeholder values
Police warned businesses after a payment redirection scam cost a Gold Coast firm $480,000 when fraudsters emailed new bank details, a news report said. — News report about a scam
unrelated generic text without domain phrases — Unrelated
credit premium — Unrelated

Known false positives

Accounts-payable procedures and payment-redirection scam warnings. Mitigation: They name the change without populated bank or supplier fields, and guidance/scam-warning framing is excluded.
Legitimate new-supplier onboarding forms with bank details. Mitigation: They can reach 75/85; they carry the same payment-redirection risk and warrant protection.