$166.8 million. That's how much Australians reported losing to payment redirection scams in 2025, according to figures the ACCC released in March 2026, combining reports to Scamwatch, ReportCyber, the Australian Financial Crimes Exchange, IDCARE and ASIC. It was one of the five most costly scam types of the year.
Most of these scams don't start with a dodgy-looking email. They start with a normal one. Same logo, same supplier name, same invoice you've paid a dozen times. Just one line is different: "Please note our bank details have changed."
You probably think you'd spot it on a quiet day. The trouble is it arrives on a busy one. The good news: you don't need to be technical to stop it. Five simple habits shut the door, and most take less than five minutes to set up.
The 60-second version:
- Never change bank details from an email. Call the supplier on a number you already have.
- Turn on multi-factor authentication (MFA) for every email account in the business.
- Add a "two-person rule" for new or changed payee details.
- Learn the three red flags: urgency, secrecy and new bank details.
- Know exactly who to call in the first hour if money goes to the wrong place.
Here's how to do each one.
Why this scam works so well on busy small businesses
Payment redirection (often run through business email compromise, or BEC) usually works in one of two ways. Scammers either break into a real email account, yours or your supplier's, or set up a lookalike address that's one letter off. Then they wait for a real invoice to be due and slip in new bank details.
It works because it looks exactly like normal business. The Australian Signals Directorate's Annual Cyber Threat Report 2024–25 found business email compromise fraud with a financial loss was the second most commonly reported cybercrime for Australian businesses, making up 15% of reports. Email compromise without a loss was the top one, at 19%.
And the cost isn't small. The same report found the average self-reported cost of cybercrime for an Australian small business was $56,600, up 14% on the year before.
Do this today: Ask whoever pays your bills, "If a supplier emailed new bank details, what would you do?" If the answer is "update them", keep reading.
Check #1: The two-minute phone call that beats almost every fake invoice
This is the single most powerful habit, and it costs nothing. Whenever an email asks you to change bank details, pay a new account, or rush a payment, pick up the phone.
The key is which number you call. Don't use the one in the email, because the scammer wrote it. Use a number from your accounting software, an old invoice, or the supplier's website.
Picture a Melbourne plumber who gets an email from their pipe supplier with "updated banking details" two days before a $9,000 order is due. A quick call to the rep they've dealt with for years settles it in two minutes, either way.
Do this today: Write a one-line rule and stick it near whoever does the payments: "Bank details never change by email. Always call a known number first."
Check #2: Lock the front door on your email with MFA
If a scammer gets into your inbox, they can read your real invoices, learn who you pay and when, and even send fake details from your genuine address. That's why protecting your email matters as much as checking theirs.
Multi-factor authentication means logging in needs your password plus a second step, like a code or an app approval on your phone. Microsoft's research says MFA can block more than 99.2% of account compromise attacks. It's also one of the key actions in this October's Cyber Security Action Month campaign, run by the National Office of Cyber Security under the theme "Take a second. Stay secure."
Do this today: Check every email login in the business, including the shared "accounts@" or "info@" inbox. If MFA isn't switched on in Microsoft 365 or Google Workspace, turn it on this week.
Check #3: The two-person rule that saves you from a bad day
Scammers love one person, working alone, under time pressure. So take that away. Make it a rule that any new payee, or any change to a payee's bank details, needs a second person to check it before money moves.
In a small team, that might just be the owner signing off. For a two-chair physio clinic, it could be the practice manager setting up the change and the principal approving it in the banking app. Many business banking platforms let you set up dual authorisation so the system enforces it for you.
Do this today: Log in to your business banking and look for "dual approval" or "authorisation" settings. If you're a sole trader, give yourself a 24-hour wait before paying any new account.
Check #4: Spot the three red flags in under ten seconds
Almost every fake invoice email leans on the same tricks. Train your eye to catch them:
Urgency. "Payment needed today or the order will be cancelled." Real suppliers rarely threaten you over one invoice.
Secrecy. "Our accounts team is being audited, please only reply to this email." Anything that discourages you from checking is a warning sign.
New details. A new account, a new bank, or a different name on the account. Treat this as a stop sign every time.
Also look closely at the sender's address. A café owner might get an email from "accounts@freshproduce-supply.com" when the real one is "freshproducesupply.com.au". It's easy to miss on a phone screen.
Do this today: Forward this list to anyone who handles your invoices, and make it clear they'll never be in trouble for pausing to check.
Check #5: Know what to do in the first hour
If money has already gone, speed matters. Call your bank straight away and ask them to try to recall or freeze the payment. Then report it to ReportCyber at cyber.gov.au, and let the supplier know their name was used.
If the scam started from your own email being accessed, change your password, turn on MFA, and check for any email forwarding rules you didn't set up. Scammers often add a hidden rule so they keep seeing your mail.
Do this today: Save your bank's fraud line in your phone and bookmark cyber.gov.au. You'll hopefully never need them, but you'll be glad they're there.
The bottom line
Fake invoice scams don't beat you with clever technology. They beat you with a single believable email on a busy day. A two-minute call, MFA on your inbox and a second set of eyes on bank changes take most of that power away. Take a second before you pay, and you keep the money you earned.
Not sure whether your business email is set up securely? EkkoByte can check your Microsoft 365 or email setup, switch on MFA and walk your team through it, in plain English. See our IT services or get in touch.