{
  "question": "Our invoices show our bank account so customers can pay by transfer. How do we stop a bookkeeper, staff member or outsider from changing those details so customers pay someone else, and how would we even notice?",
  "slug": "how-to-stop-someone-changing-the-bank-details-on-the-invoices-you-send-customers",
  "url": "https://www.rightshold.com/answers/how-to-stop-someone-changing-the-bank-details-on-the-invoices-you-send-customers",
  "short_answer": "Lock the pay-to details down like a vendor's bank details, because they are the one field on your invoices that sends money somewhere. Most protection in accounting software points the other way, at the bank details of suppliers you pay. A request on Xero's product-ideas forum, open since 2022 with comments into 2026, says anyone with non-read-only access can edit the bank account typed into invoice settings, and users there say template edits leave no history of who changed them. MYOB is a useful contrast: its online-payments settlement account can only be changed by the business owner or an Online Admin, a new account must be verified and a confirmation email follows within 48 hours, while the direct-deposit details printed on invoices are an ordinary sales setting. In a case sentenced in Victoria, Australia on October 29, 2026, a bookkeeper doctored a company's invoices so its customers paid into her own account, then altered the amounts recorded as paid in the books; the court put her total across three employers at about A$6.7 million. So: limit who can edit invoice settings and templates, record the approved pay-to details somewhere the people who send invoices can't edit, check a sample of sent invoices against that record every month, tell customers your bank details never change by email, and reconcile customer payments against the bank, not against the books.",
  "checklist": [
    "Find every place your bank details appear on what customers see: invoice and statement templates, payment-method settings, email signatures, payment links and the PDF your system sends. Write down the account number each one shows today.",
    "Restrict who can edit invoice settings, templates and payment methods. If your software can't restrict them separately, keep the number of users with edit access small and review that list monthly.",
    "Prefer a payment link or online payment option whose settlement account has its own owner-only control and verification, and keep typed-in bank details to one approved template.",
    "Record the approved pay-to details outside the accounting system, as a hash of the routing and account number, with the date and who approved them, so a later change has to match a record the bookkeeper can't edit.",
    "Each month, pull a few invoices exactly as customers received them (from the sent email or the customer portal, not a fresh print) and compare the bank details with that record.",
    "Tell customers in writing, at onboarding and on every invoice, that your bank details will not change by email and that they should call a number they already have before paying a new account.",
    "Reconcile customer receipts from the bank statement to each invoice. An invoice marked paid with no matching bank receipt, or a customer who says they paid but your bank shows nothing, needs an answer the same week.",
    "Send customer statements yourself, or have someone other than the bookkeeper send them, so a customer who paid the wrong account sees a balance they don't expect and tells you.",
    "If an AI agent drafts or sends invoices, have it read the pay-to details from the approved record and stop if the template differs, rather than trusting whatever the template or an email says."
  ],
  "sections": [
    {
      "heading": "How invoice bank details get changed",
      "points": [
        "From inside: someone with access to the invoice settings or template types a different account, usually one they control. Customers pay as normal, the money lands elsewhere, and the books still need to show the invoice as paid or someone will chase it. In the Victorian case reported on November 2, 2026, that was done by changing the amounts recorded as paid in the company's accounting system.",
        "From outside: a fraudster who has your mailbox, or a lookalike address, emails your customers a copy of your invoice with new bank details, or a letter saying your account has changed. This is the mirror image of the vendor bank-change scam, and your customers are the ones asked to verify. Payment diversion advice from police and banks is the same in both directions: query any change, because companies rarely change bank details, and confirm on a number you already hold.",
        "The ACFE's Occupational Fraud 2026 report, based on 2,402 cases, found that billing schemes, skimming and check and payment tampering showed the biggest gaps between small and larger organizations: skimming appeared in 17% of cases at organizations with fewer than 100 employees against 6% at larger ones. Altering transactions in the accounting system was a concealment method in 14% of cases."
      ]
    },
    {
      "heading": "Why the accounting software may not catch it",
      "points": [
        "Supplier bank details often have a separate permission and a change notice. Invoice templates and payment settings often don't. On Xero's product-ideas forum, a request to restrict access to invoice settings has been open since September 2022; its comments describe any user without read-only access being able to change the bank account on invoices and template edits having no audit trail of who made them. Check your own software's user roles rather than assuming either way.",
        "MYOB separates the two. Its help says only the business owner or an Online Admin user can change the bank account used to receive online invoice payments, a new account has to be verified, and a confirmation email follows within 48 hours. Direct-deposit bank details that print at the bottom of invoices are entered under Sales settings, Payments, like other sales preferences.",
        "Even good audit logs sit inside the system the person controls. A record of the approved pay-to details kept somewhere they can't write is what lets you prove what the invoices were supposed to say, and when that changed."
      ]
    },
    {
      "heading": "What to do if customers paid the wrong account",
      "points": [
        "Call your bank and the customer's bank straight away; recalls work best within hours or days. Report it to the police fraud service where you are, and in the US to the FBI at ic3.gov.",
        "Work out the scope: which invoices carried the changed details, from when, and which customers paid. Compare sent invoices with the approved record, and bank receipts with the invoices marked paid.",
        "Remove the person's access before you start asking questions, and preserve the accounting system's history, sent emails and template versions. Whether the customer still owes you is a legal question, so take advice before chasing customers who paid in good faith."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "Our bookkeeper wants to change the bank account printed on our customer invoices. Record it as a pending change that only I can approve with my own account key, bound to a hash of the new routing and account number, so the invoice template can be checked against what I approved.",
    "mcp_call": {
      "tool": "request_human_approval",
      "arguments": {
        "action": {
          "type": "invoice_pay_to_change",
          "template_ref": "INV-TEMPLATE-STANDARD",
          "new_bank_details_sha256": "<sha256 of routing and account number exactly as the template shows them>"
        },
        "summary": "Change the pay-to account on the standard customer invoice template (bookkeeper request; owner to confirm with our bank first).",
        "expires_in_minutes": 1440
      }
    },
    "also": [
      "Needs your API key. Only the owner's account key can decide it (decide_human_approval); delegated agent keys are refused. The decision is a signed, timestamped receipt.",
      "verify_human_approval (free) with the receipt, its signature and the action as the template stands now says whether it matches what was approved. A different account number gives a different hash, so it won't match. With only {id} it returns the status without comparing the action.",
      "To keep a dated record of each sent invoice, seal it on a mirror ledger (REST, your API key): POST /v1/mirror-ledgers/{id}/entries with type invoice, your invoice_ref and total_cents, plus your own fields such as pay_to_sha256 and pdf_sha256. GET /v1/mirror-entries/{id} is free to check. Use customer_ref, not names or emails; entries with identity fields are refused.",
      "Send hashes, never account numbers."
    ],
    "scope": "Rightshold doesn't connect to Xero, MYOB, QuickBooks, your bank or your email, and it can't stop anyone editing an invoice template or detect payment diversion. It records the approvals and invoice hashes you send and lets anyone check them later, so it only helps if you compare sent invoices against them. Software behavior is from MYOB's help and Xero's product-ideas forum as checked on November 10, 2026; the Victorian case is as reported by the Dandenong Star Journal on November 2, 2026. Not legal, banking or accounting advice."
  },
  "sources": [
    {
      "title": "Dandenong Star Journal: Bookkeeper swindled $7m from three businesses (sentenced October 29, 2026; doctored invoices, altered amounts paid)",
      "url": "https://dandenong.starcommunity.com.au/news/2026-11-02/breath-taking-bookkeeper-swindled-7m-from-three-businesses/"
    },
    {
      "title": "Xero Product Ideas: User roles, restrict access to Invoice Settings (open since 2022)",
      "url": "https://productideas.xero.com/forums/967121-users-setup/suggestions/45708967-user-roles-restrict-access-to-invoice-settings"
    },
    {
      "title": "MYOB: Editing your business bank details (online payments; owner or Online Admin only)",
      "url": "https://www.myob.com/au/support/myob-business/sales/receiving-payments/online-invoice-payments/editing-your-business-bank-details"
    },
    {
      "title": "MYOB: Set up your invoice payment details (direct deposit details on invoices)",
      "url": "https://www.myob.com/au/support/myob-business/sales/sales-settings/set-up-your-payment-details"
    },
    {
      "title": "ACFE: Occupational Fraud 2026, A Report to the Nations",
      "url": "https://www.acfe.com/-/media/files/acfe/pdfs/rttn/2026/2026-report-to-the-nations.pdf"
    },
    {
      "title": "FSB: How to avoid invoice fraud",
      "url": "https://www.fsb.org.uk/resources/article/how-to-avoid-invoice-fraud-MCHP7F4RTN2BDQ7N6WLQNVVJUNCE"
    },
    {
      "title": "FBI IC3: 2025 Internet Crime Report (business email compromise)",
      "url": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf"
    }
  ],
  "related": [
    {
      "title": "How to verify a vendor's bank account change request before you pay",
      "url": "https://www.rightshold.com/answers/how-to-verify-a-vendors-bank-account-change-request-before-you-pay"
    },
    {
      "title": "How to keep a copy of your business books that your bookkeeper can't edit",
      "url": "https://www.rightshold.com/answers/how-to-keep-a-copy-of-your-business-books-that-your-bookkeeper-cant-edit"
    },
    {
      "title": "How to spot signs someone is hiding theft in your bank reconciliation",
      "url": "https://www.rightshold.com/answers/how-to-spot-signs-someone-is-hiding-theft-in-your-bank-reconciliation"
    },
    {
      "title": "How to prove small business books weren't edited after the fact",
      "url": "https://www.rightshold.com/answers/how-to-prove-small-business-books-werent-edited-after-the-fact"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-11-10"
}