'BSB and account number scams' are a common concern for banks and payment providers because scammers use local bank details to make payment requests look routine and urgent. This guide is for fraud teams, not consumers. It explains how these scams usually work, what to check first, how to tell a one-off payment request from a broader scam pattern, and how conversation-derived intelligence can support investigations. Bank details on their own should be treated as indicators to assess in context, not as proof of ownership or intent. Active Defense (activedefenseapi.com) runs AI decoy personas that keep scammers talking on Telegram and by e-mail and turns what they hand over into a threat-intelligence feed.
What BSB and account number scams usually look like
For an international fraud audience, a BSB is the Australian Bank State Branch code used with an account number to route a payment. That pairing matters in scam reviews because including both details makes the instruction look complete, ordinary, and ready to act on. A payment request that contains a full BSB and account number can therefore appear more credible than a vague demand for money, even when the surrounding story is weak.
In practice, the mechanics are familiar. The scammer asks for a transfer to a bank account and adds pressure around it. The pretext may be impersonation, an investment opportunity, a romance story, an invoice change, a refund claim, or an account-security warning. Sometimes the bank transfer sits beside another payment method, such as gift cards, which can be useful context for teams that also track other payment signs. In each case, the bank details help turn the message into something operational: a destination, a deadline, and an instruction.
Fraud teams should also assume that the same account details may surface across different conversations, personas, and storylines. What looks like one customer report may belong to a wider pattern of reused receiving details, rotated identities, or linked contact points. That is why it helps to think in terms of account linkage and related infrastructure rather than a single report in isolation.
Bank details also rarely arrive alone. The payment request may come with phone numbers, email addresses, messenger handles, links, or images. Those surrounding artifacts often give investigators the context needed to place the request inside a broader scam workflow.
The rest of this guide builds on that point: effective review depends on linking surrounding indicators to the BSB and account number, along with timing, channel, and narrative, instead of treating the payment instruction as an isolated artifact.
How fraud teams should assess bank details in context
A practical triage flow starts with preserving the payment instruction exactly as received. Capture the full BSB and account number, keep the surrounding message content, note the channel, and record when the instruction arrived. Then log any companion indicators that came with it, such as a phone number, email address, URL, gift card request, payment handle, or messenger account.
That preservation step matters because scam narratives change quickly. A sender may delete messages later in a chat app, alter the story after a challenge, or shift the conversation from one channel to another. If the original wording, timing, and delivery path are not retained, investigators can lose the context needed to compare reports and explain why a payment request looked suspicious at the time it was made.
Once the record is preserved, the next question is consistency. Review whether the bank details fit the rest of the approach or conflict with it. For example:
- the same actor offers both bank transfer and crypto payment options
- payment instructions change during the conversation
- the same contact point appears across different pretexts
- a bank transfer request is paired with unrelated urgency cues or other payment asks
After that, look for repetition and clustering. The same BSB and account number reused across reports, the same contact details paired with multiple receiving accounts, or the same image or forwarded account appearing in related chats can all suggest coordinated activity rather than a one-off event. Teams that follow live scam briefings or review monthly scam data reports often use those patterns to decide what deserves broader internal attention.
The operational output should be a scored set of indicators, not a binary label. Structural checks and contextual review help prioritize which cases merit escalation first. For a deeper look at how receiving accounts can fit into scam payment chains, see receiving accounts in scam chains.
Where conversation-derived intelligence adds value
Scam conversations can produce threat intelligence before a payment is made and before a victim report contains the full picture. That earlier view matters when fraud teams need faster visibility into likely payment destinations and the surrounding contact infrastructure, rather than waiting until a case file is complete. In practice, the value is not just the receiving account itself, but the set of related details that arrive with it and can be assessed together as scam indicator feeds.
Active Defense runs AI decoy personas on Telegram and by e-mail to keep scammers talking and turns what they hand over into a threat-intelligence feed. The feed can contain:
- crypto wallets
- bank details
- phone numbers
- messenger accounts
- links
- gift cards
- payment handles
- file and photo hashes
Each indicator carries a confidence score. That gives fraud teams a structured way to review what was collected without treating any single data point as proof on its own.
The main operational gain comes from linkage. When separate chats share an indicator, a reused photo, or a forwarded account, they can be linked to one actor. That helps investigators move from one reported BSB and account number to a broader actor view that includes repeated contact points, reused assets, and connected payment requests. Readers who want more depth on that process can see how separate indicators are connected.
Evidence handling also matters. Every message is stored the moment it arrives, so a scammer’s later "delete for everyone" does not remove the copy available for analysis. That preserves the original message flow for later review if a bank detail, phone number, or other indicator becomes relevant only after more reports arrive.
Replies to scammers are drafted by AI and approved by a human operator by default. For teams that already work with structured intelligence workflows, this kind of collection becomes more useful when it can feed directly into STIX 2.1 delivery.
How to operationalize a BSB and account number signal
Fraud teams usually get more value from bank details when they are treated as feed items rather than left inside case notes, PDFs, or screenshots. A BSB and account number become more useful when investigators can search them, share them internally, compare them with other reports, and correlate them with the rest of a scammer’s infrastructure.
That matters because a payment instruction is rarely the whole signal. A receiving account may sit alongside a phone number, email address, messenger account, link, wallet, payment handle, or reused image. If those details are handled in a structured way, teams can review them together instead of re-reading each case from scratch.
Active Defense gives each customer their own feed and provides STIX 2.1 export. For teams that already use intelligence workflows, that supports structured sharing and downstream enrichment. Readers who want more detail on structured delivery can see this explanation of STIX 2.1 for scam indicator feeds.
In practice, that supports a few straightforward workflows:
- compare a newly reported BSB and account number with existing scam indicators
- cluster reports that share payment details or related contact points
- raise priority where multiple scored indicators point toward the same actor
- revisit older reports when new linked details appear
The ability to rebuild a feed from stored history matters for that last step. Investigations often change shape when a later case introduces a new account detail, crypto wallet, or contact point that makes earlier conversations relevant again. If the history can be rebuilt, teams can go back and re-check prior material against what they know now.
At the infrastructure level, the console and API run on Azure in Germany.
Questions fraud teams ask
What should trigger a closer review when a payment request includes BSB and account number details?
A closer review usually starts when the payment instruction arrives with signals that make it easier to connect the case to other scam activity.
Useful signals include:
- a phone number or e-mail address in the same request
- a messenger account used to continue the conversation
- a link, gift card ask, or payment handle alongside the bank transfer
- a file or photo that can be compared with material from other cases
For fraud teams, the point is not that one extra detail proves anything. It is that a richer set of indicators gives more ways to search, compare, and cluster reports.
When does a BSB and account number become more than a single case artifact?
It becomes more useful when it can be handled as part of an investigation dataset rather than left inside screenshots or case text.
That means the detail can be:
- searched across reports
- compared with later submissions
- reviewed with other indicators from the same approach
- used in actor-level clustering when related details recur
This is where conversation-derived collection can help. Active Defense turns what scammers hand over on Telegram and by e-mail into a threat-intelligence feed that can include bank details, phone numbers, messenger accounts, links, gift cards, payment handles, crypto wallets, and file and photo hashes, each with a confidence score.
What does a fraud team need from a feed if the goal is operational use, not research?
For day-to-day work, teams usually need four things:
- customer-specific delivery
- structured output that fits existing workflows
- retained history that can be revisited
- enough context to connect related chats
Active Defense gives each customer their own feed with STIX 2.1 export. Chats that share an indicator, a reused photo, or a forwarded account are linked to one actor. Because every message is stored the moment it arrives, earlier material can still be reviewed even if a scammer later deletes messages. Replies are drafted by AI and approved by a human operator by default.
From a single payment request to a usable investigation lead
For fraud teams searching for BSB and account number scams, the practical question is what to do next once those details appear. The aim is not to treat one payment request as a conclusion, but to turn it into an investigation lead with enough context to support action.
Useful lead quality usually depends on whether the case can be:
- tied to a named channel such as Telegram or e-mail
- connected to other chats through shared indicators or reused assets
- retained in its original message sequence for later review
- delivered in a format investigators can work with
Active Defense provides a free feed sample for qualified leads and a 90-day pilot for up to 500 conversations at 1,900 EUR net, credited to the subscription afterwards.