Guide · Accountants and tax agents

When a client asks to change their bank or refund details

A client phones or emails to say their refund should go to a new account. The change can be legitimate, but an unexpected change of bank details is a recognised warning sign of business email compromise. Here is what the published guidance says, and a short way to check before you change anything.

The short version

Check the request outside the channel it came in on.

None of the sources below sets out a step-by-step procedure for bank changes. ASD's ACSC recommends checking a suspicious request through separate contact, using details you have verified separately. TPB and ATO guidance deals separately with client verification and updating ATO records. Where this guide goes beyond their wording, it says so.

Why this request is different

An unexpected change of bank details is a known warning sign.

  • ASD's ACSC lists "an unexpected change of bank details" as a sign of business email compromise. Criminals use compromised real mailboxes or look-alike addresses, so a request that appears to come from the client's usual email isn't enough on its own.

    ASD's ACSC: Protecting against business email compromise

  • The ACSC's advice is to contact the person separately, "using contact details you have verified separately". Our suggestion for practices: hang up or don't reply, then call the client on a number your firm established earlier, not one given in the request.

    ASD's ACSC: Protecting against business email compromise

  • Scamwatch warns that scammers send messages urging people to call a number that connects to the scammer. A number in the suspect email or SMS is part of the request, so it can't be used to check the request.

    Scamwatch: ATO and myGov impersonation scams (2026)
Your obligations, briefly

Client verification is ongoing, and it stays with you.

  • TPB(GS) 42/2022 says to take appropriate proof of identity steps before providing services "and on an ongoing basis, as appropriate". For well-established clients it asks you to use professional judgement and record whether further checks are appropriate and how often, considering changed circumstances and discrepancies. Familiarity alone isn't an exemption, and a representative's authority still needs attention.

    TPB(GS) 42/2022: Proof of identity requirements

  • The ATO's agent guidance says "the responsibility to verify client identity ultimately rests with you as the tax practitioner". Having access to a client in Online services for agents doesn't move that responsibility.

    ATO: Agent client verification methods

  • The TPB also says the ATO's client-to-agent linking process "does not override your obligations to undertake client proof of identity". A linked client, or an existing engagement, doesn't make a new bank instruction genuine.

    TPB: Client verification process for tax practitioners

  • Under Code item 6 of the TPB Code of Professional Conduct, unless you have a legal duty to disclose, you must not disclose information relating to a client's affairs to a third party without the client's permission. Our inference: be careful what you confirm to an unchecked caller, including the bank details already on file.

    TPB: Code of Professional Conduct
In the ATO's systems

Know what the change actually touches.

  • In Online services for agents, a client's refund account sits under Profile, then Financial institution details. The ATO says these details "will only be used to deposit refunds and ATO-held super", not for direct debits or payment plans.

    ATO: Online services for agents user guide, Financial institution details

  • Details are listed against each account, such as income tax, activity statement and superannuation. Check which accounts the client means. Confirm whether your practice software submits or only retrieves ATO financial institution details, and check that each intended record was updated.

    ATO: Online services for agents user guide, Financial institution details

  • The ATO says it won't ask for TFNs or bank details by return email, SMS or social media. If a client says "the ATO told me to send you new details", that is a reason to slow down. People can check a contact claiming to be the ATO on 1800 008 540.

    ATO: How to stay scam safe
A suggested routine

Six steps for reception and staff

  1. 01Don't action the change in the same call or email thread it arrived in.
  2. 02Call the client on a number your firm verified separately before the request, not one in the request.
  3. 03Ask the client to state the requested change and the new account details themselves. Don't read out details from the request until your checks are done. Any read-back only checks for typing errors.
  4. 04Ask why the account is changing. A plausible reason doesn't prove anything, but no reason, or pressure to rush, is worth noting.
  5. 05Pause if contact fails or concerns remain. Whether or not the call-back succeeds, consider the client identity and representative authority checks your firm's procedures call for.
  6. 06Go ahead only once concerns are resolved and the applicable checks are done. Update the intended accounts, confirm the result, and tell the client through a channel you verified separately. A call-back doesn't show who owns the new bank account.

Our suggestion, drawn from the sources on this page. It is not a TPB or ATO procedure, and it doesn't replace your proof of identity obligations.

The file note

Record the check

  • How the request arrived, and the exact details requested
  • The number you called back on, and when and how it was first established
  • Who confirmed the change, the date and time, and which ATO accounts were updated
  • Any concerns, delays or escalation, and who approved going ahead

Keep this note separate from your proof of identity records. TPB(GS) 42/2022, paragraphs 24-25, requires contemporaneous POI records kept for at least five years after the engagement ends. This list is a suggestion, not a statement of minimum requirements.

Where Vericode fits, and where it stops

A code check is separate from the call-back in step two. It doesn't replace any of it.

Vericode sends a short code to the Australian mobile your firm already holds for the client, and records the result against the staff member who ran it. When a client calls in, a correct read-back shows the caller knew the code sent to that number for that check. That is one more recorded signal before you act. Never ask a client for a myGov, ATO, bank, login or MFA code: Scamwatch warns people not to share one-time codes, and a Vericode check never needs one.

It doesn't show who the caller is, who controls the phone, what authority they have, or that the new bank account belongs to the client. It is not a TPB or ATO client verification method, and a successful check does not establish compliance with any professional, tax or AML/CTF requirement.

Sources (checked 25 October 2026)

These organisations are cited for general guidance, not as endorsers of Vericode.

Before the next request

Hold a call-back number for every client, and note where it came from.

The check above only works if the file already holds a number you trust.

TPB, Tranche 2 and phone instructions Tax-time vishing: ATO and myGov scams
General information only. This guide is not legal or tax advice. Follow your practice's procedures and current TPB and ATO guidance.