The payment was authorised; the change was not

Letter from the table

To the Fair Play Council,

At the last council session I attended, I came in thinking of invoice fraud as a problem of carelessness: someone misses a changed account number, presses pay, and learns the lesson the hard way. I left thinking that is too small a description. The payment may be authorised by the person at the keyboard, but the account change can still be fraudulent. The system should not treat those as the same thing.

On 16 June this year, an invoice arrived in an email thread we had used before. It was for R48,600. The amount and the due date looked ordinary. The bank details were different. I did not notice the change. The next morning, 17 June, I made an EFT from our business account. I was not paying a stranger who had approached us out of nowhere. I believed I was paying a known supplier through a familiar conversation.

Later that day, the supplier contacted me to say the invoice was still unpaid. I called using the number on earlier paperwork, not the number in the email. They confirmed that their bank details had not changed. By then the money had left our account.

I contacted my bank immediately, explained that the payment had been diverted, and asked it to recall the EFT. I sent the invoice, the email chain and proof of payment, and followed up with the fraud team. The bank logged the request, but it could not promise recovery; the money had to be traceable and available, and the receiving bank had to act on the request. I also reported the matter to the South African Police Service and gave the case details to my bank. Those steps created a record. They did not put the R48,600 back in our account.

We had to cover that gap ourselves. We postponed a repair and rearranged payments that were already due. It was not a dramatic collapse. It was the quieter sort of harm small businesses know: a sum that has already been assigned to real obligations

disappears, and the owner spends hours trying to catch up while still doing the work of running the business.

At the session, the five-part pattern test helped me see why the distinction matters. Volume and frequency are not the whole story. A repeated, consistent method can spread across businesses, and separate reports can corroborate what one person might otherwise dismiss as a private mistake. I do not know who committed the fraud in my case, and I am not going to guess. I do know that the changed details passed through a payment process in which I had no clear way to check, before sending the money, whether the named payee matched the account receiving it.

That is why I support the draft Business Fraud Standard now open for consultation. The proposed direction is practical: verify payee names, make fraud-payment recall quick, and provide reimbursement for small businesses hit by authorised push payment and business email compromise fraud, including cross-border payments. It would not make every loss disappear. It would change what happens when a business acts in good faith and discovers that a convincing instruction was false.

For a payee check to help, it has to be clear enough to use at the moment of payment. If the name does not match, the payer should receive a meaningful warning before sending, not a confusing message after the money has gone. If fraud is reported, the sending bank should be able to start a recall promptly and communicate what is happening. A small business should not have to work out which institution to contact, or wait in uncertainty while funds may still be recoverable.

And when a payment was authorised because the payer was deceived, reimbursement should not turn on pretending that the payer did nothing. I did press the button. I did not knowingly choose a fraudster as the payee. A fair standard should recognise both facts.

I understand that safeguards and reimbursement rules need workable procedures, evidence and clear responsibilities between payment providers. The consultation is the place to test those details. But complexity cannot be a reason to leave small businesses carrying the whole loss by default—especially when the payment system is the route through which the money moves and a rapid response may matter.

My experience is one case, not proof by itself. That is precisely why I value the council’s method: gather reports, test whether the pattern holds, and propose a fix that can be examined in public. I support the draft, and I ask members to keep the payee check, the fast recall and the reimbursement principle together. They address different moments in the same chain: before the payment, immediately after the report, and when the loss cannot be recovered.

The consultation remains open until 12 November. Please use it to make the standard specific enough that a business like mine knows what to expect—and strong enough that a fraudulent change to an invoice does not end with the owner being told that the payment was authorised.

Sibusiso DlaminiCited · Fair Play CouncilCape Town, South Africa