Invoice scams and changed bank details

Field 1How the scam works

Scamwatch describes it plainly: someone poses as a business you have dealt with and sends you an invoice carrying new payment details, so that a payment you meant to make goes to them. Because you were expecting to hear from that business, the email doesn’t seem out of place, and it may even sit in the same thread as your last genuine exchange. Logos and ABNs can be copied.

ASD describes three common forms of business email compromise:

• Invoice fraud. A supplier’s email account is compromised, its real invoices are edited to show the scammer’s bank details, and they are sent to customers from the supplier’s own address.
• Employee impersonation. A work account is taken over and used to pose as a colleague, often someone senior, to have a false invoice raised or a worker’s pay redirected.
• Company impersonation. A scammer registers a domain very like a well-known organisation’s, orders expensive goods from a supplier, and has them delivered before payment; the invoice then goes to the real organisation, which never ordered them.

The ATO, citing the ACCC, says payment redirection scams cost Australian businesses $152.6 million in 2024 and were the scam type small and micro businesses reported most.

Field 2Warning signs

• A supplier’s payment details change without warning.
• A request is urgent, or threatens serious consequences if payment isn’t made.
• Someone in authority asks for a payment that is unusual for them.
• The email address or website is slightly off: a spelling change, or one extra letter or number.
• A bill arrives for goods or services you never ordered.

Field 3Before you pay a changed account

1. Stop. Don’t act on the new details yet, however urgent the message sounds.
2. Find the number yourself. Use contact details from the business’s official website or app, or from earlier correspondence you know is genuine. Don’t use anything in the message itself, which may have been changed.
3. Call and confirm the change with the person you normally deal with.
4. Check the address. Compare the sender’s email domain, letter by letter, with earlier messages.

ASD’s advice is to make this a clear and consistent business process for everyone who handles payments, so that checking a request never depends on one person’s judgement on a busy day. Staff should also have a way to report demands for immediate action, pressure for secrecy, or requests to go around the usual process.

Field 4If money has already gone

1. Call your bank straight away and ask it to stop the transaction.
2. Report the cybercrime to the Australian Signals Directorate.
3. Secure email. If an account was compromised, change its password, tell anyone affected, and consider a notice on your website warning customers about the scam.
4. Report the scam to Scamwatch, which uses reports to warn others.

ASD’s Australian Cyber Security Hotline is 1300 CYBER1 (1300 292 371).

Field 5Making it harder to happen

Most of ASD’s prevention advice is about keeping email accounts from being taken over in the first place:

• use multi-factor authentication on business email and systems;
• keep the contact details of accounts, finance and HR staff out of public view, as these teams are often targeted;
• if you run your own email domain, set up SPF and DMARC so that receiving servers can spot email falsely sent in your name;
• consider registering domain names that look like yours, so they can’t be used against your customers;
• apply the Essential Eight, particularly on the computers your finance, HR and senior staff use.

The ATO adds that PDF and paper invoices are easy to intercept and alter, and that Peppol eInvoicing is more secure than email because only accredited access point providers can exchange its encrypted documents.