If an unexpected message tells you to pay an insurance excess, change a repair invoice’s bank details or provide account access to release a settlement, stop and verify it independently. Having a real claim underway does not establish that the message came from your insurer or an authorised supplier. The immediate task is to authenticate the instruction, not to decide whether your claim is covered.
This is general information for Australian readers, not personal financial advice. Insurance cover and claim entitlements depend on the applicable policy, Product Disclosure Statement (PDS), certificate, exclusions and assessment. Scam checks do not establish entitlement to reimbursement or extend claim deadlines.
Separate a familiar claim from an authenticated sender
A message can mention your vehicle, an appointment or an existing claim and still require checking. Do not treat a familiar display name, an insurer logo or a message appearing in an existing SMS thread as proof. In its insurance scam guidance, Suncorp warns that caller IDs and SMS threads can be spoofed and that impersonators may seek payments or personal information.
The provider also warns motor customers about third-party companies claiming to arrange repairs on an insurer’s behalf. An unexpected repair offer is not automatically fraudulent, but claimed authority needs independent confirmation. A company name or booking link supplied by the caller is not that confirmation.
Verify through a contact route you obtained independently
- Do not click the message’s payment or login link, open unexpected attachments, or reply with financial information.
- Find a trusted contact route from policy documents you already hold, the official app you normally use, or the insurer’s website reached independently.
- Ask the insurer whether the instruction and named supplier relate to your existing claim reference.
- For changed invoice bank details, speak to the genuine supplier using a previously known number. Confirm the payee, account details, amount, invoice reference and reason for the change.
- Record who verified the instruction, when, and what was confirmed before taking the next step.
Suncorp specifically recommends verbally verifying changed payee or invoice account details using a number you already know, rather than relying on contact details inside the email. That is a provider’s published security guidance, not proof that a particular invoice has been approved.
Keep identity checks separate from spending authority
Even after confirming that a repair business is genuine, ask what the insurer has actually authorised. Has the insurer appointed that business for an inspection, approved a repair scope, or asked you to enter a separate contract? Authenticity and authority are different questions. A genuine supplier can offer services outside the insurer-approved work.
For example, imagine an email arrives during a legitimate motor claim asking for an immediate excess transfer to a replacement account. The claim reference in the email does not resolve the risk. Independently confirm that an excess is currently due, who collects it, the approved payment method and whether the requested account is correct. Keep the confirmation with the invoice rather than relying on the original message alone.
If the problem instead concerns a missed genuine callback, our guide to checking the recorded claim contact number addresses that separate administration task. Updating contact details does not authenticate an unsolicited payment request.
Do not disclose access credentials to unlock a payment
Suncorp states that it will not ask by email, SMS or phone for passwords, PINs, multi-factor authentication codes or remote access to your device. Treat such a request as a warning rather than a normal step in receiving a settlement. Do not install remote-support software at an unexpected caller’s direction.
Legitimate claims administration may require identity or bank-account information through an approved channel. Verify the channel independently and ask what is required; do not assume every request for information is genuine or that an authentic-looking form is safe. Avoid forwarding unnecessary identity documents while seeking confirmation.
If you already acted, preserve evidence and respond promptly
If you transferred money or shared financial information, contact your bank immediately through its trusted contact route. Notify the genuine insurer through its published security or fraud channel, and follow its current instructions. Preserve the message, sender details, payment receipt, time and any account-change notification. Do not send another payment merely because the first recipient says it failed.
Does a genuine claim number prove the sender? No. Verify independently. Does confirming the sender approve repairs or reimbursement? No. Obtain the relevant claim decision separately. Can I ignore a real deadline while checking? Do not assume so: contact the insurer promptly, explain the suspicious request and obtain any necessary next steps through a trusted channel.
