An email about an insurance claim can look convincing and still contain fraudulent payment instructions. If someone changes the bank account for an excess, repair invoice or other claim-related payment, pause and independently verify the request before transferring money. A familiar logo, accurate claim reference or message in an existing conversation does not establish that the new account is genuine.
This is general information for Australian readers, not personal financial advice. Your policy, Product Disclosure Statement (PDS), claim arrangements and applicable terms determine your responsibilities and benefits. Scam checks do not establish insurance coverage or payment approval.
Recognise the instruction that needs checking
The warning sign is not simply a spelling mistake. It is a change in what you are being asked to do: use a new account, pay urgently, follow an unexpected link or disclose security information. In its scam guidance, Suncorp specifically recommends verifying changed payee or invoice bank details verbally using a number you already know, rather than contact details inside the email.
Suncorp also warns that caller IDs and SMS threads can be spoofed, and that increasingly polished messages may contain no grammatical mistakes. Its statement that it will not request passwords, PINs, multi-factor authentication codes or remote device access is a provider-specific assurance, not a reason to disclose those details to someone claiming to represent another organisation.
Use a separate, trusted contact route
- Stop the proposed transfer. Do not use the message’s payment link, attachment or callback number to verify itself.
- Find a contact route independently: your saved policy documents, a previously verified contact or the insurer’s official website entered directly.
- Give the existing claim reference and explain exactly which payment instruction changed.
- Ask whether the named recipient is authorised, what the payment is for and how the correct account can be confirmed securely.
- Record the contact time, team, outcome and any follow-up reference before deciding what to do next.
If a builder sends the request, independently contact the builder through a previously established channel as well. Insurer confirmation that a repair is approved is not automatically confirmation of a contractor’s bank account, and a contractor’s invoice is not proof that the insurer will reimburse it.
Keep payment verification separate from claim approval
Consider this hypothetical situation: a repair invoice arrives during an accepted home claim, followed by an email saying the builder’s bank account has changed. The accepted claim does not authenticate that second email. Equally, confirming the builder’s account does not establish who is responsible for this invoice under the repair contract.
Ask three separate questions: is the sender genuine, is the account instruction genuine, and is this an amount you actually owe? Compare the requested amount with the existing invoice and claim correspondence. If it differs, ask for an explanation rather than treating account verification as approval of every charge.
For cash-settlement arrangements, also check the builder contract before hiring or paying. The relationship between you, the insurer and the contractor matters independently of whether the message is authentic.
If you have already paid or shared information
Act promptly rather than waiting for the claim team to complete its ordinary review. Suncorp’s guidance says to contact your bank immediately if you have transferred money or shared financial information. Tell the bank what happened and follow its instructions; do not assume recovery is guaranteed.
Report the suspicious contact to the insurer through an independently verified channel. Preserve the original message, attachments without opening them, payment receipt and timestamps. Ask whether any claim contact or payment instructions were changed and what protective action is required. An acknowledgement of your report is not confirmation that an account change has been reversed.
If account credentials were exposed, follow the relevant provider’s security process, change affected passwords safely and check for unexpected account activity. Never share a one-time code with someone promising to recover a payment.
Quick questions before releasing a transfer
- Did I verify the change without relying on the suspicious message?
- Do I know the purpose, recipient and correct claim reference?
- Have disputed invoice amounts been resolved separately?
- Do I have a record of the confirmed instruction?
Does a matching claim number prove authenticity? No. Use it to identify the claim during your independent enquiry, not as proof that the sender is authorised.
Does a bank receipt prove the insurer received an excess? It proves a transfer was made, not that the intended recipient received and allocated it. Request confirmation of the processed claim payment record through the genuine claims channel.
