The fake invoice scam hitting Sydney businesses, and how to stop it

It usually starts with an ordinary-looking email. A supplier you deal with every month sends an invoice, or a note saying their bank details have changed. The logo is right, the amounts are right, and sometimes it even replies to a real conversation. You pay it. Weeks later the real supplier asks why they haven’t been paid, and the money is long gone.

This is a payment redirection scam, also called business email compromise. Scamwatch has warned Australian businesses about it for years, and the ACCC has named it the most common type of false billing scam reported by businesses.

How it works

• An email account is taken over. Yours or your supplier’s, usually through a fake Microsoft 365 sign-in page or a reused password. The criminal then reads the mailbox quietly for days or weeks.
• Or a lookalike address is used. A domain with one letter changed, or a display name that matches someone you know but an address that doesn’t.
• The timing is chosen carefully. They wait for a real invoice, a deposit or the end of the month, then send “new” bank details.
• Rules hide the evidence. In a taken-over mailbox they often add inbox rules that forward or delete replies, so the real owner never sees them.

Warning signs

• A supplier says their bank details have changed, by email only.
• Pressure to pay quickly: “please pay today”, “our account is frozen”.
• An email address that is almost, but not quite, right.
• Replies that go missing, or customers saying they received emails you didn’t send.
• Microsoft sign-in alerts from places you haven’t been.

Five checks that stop it

1. Call before you change bank details. Use a number you already have, never one in the email. Make it a rule for everyone who pays bills.
2. Turn on multi-factor sign-in for every email account. It stops most account takeovers even when a password has been stolen.
3. Require two people for new or large payments. One person sets up the payment and another approves it.
4. Protect your own domain. SPF, DKIM and DMARC records make it much harder for criminals to send email as your business, so your customers aren’t targeted in your name.
5. Filter impersonation and flag outside emails. Email security that catches lookalike domains, and a banner on external messages, help staff pause before they act.

Put the check on your own invoices

Add a line to every invoice you send: “We will never change our bank details by email. If you get a request like this, call us on our usual number before paying.” It protects your customers and your cash flow.

If it has already happened

1. Call your bank straight away. The sooner they know, the better the chance of stopping or recovering the payment.
2. Lock down the email account. Reset the password, sign out every session, and check for forwarding and inbox rules. Call us on (02) 8279 2714 and we can do this remotely.
3. Report it. Report cybercrime to ReportCyber at cyber.gov.au and scams to Scamwatch.
4. Warn the people involved. Tell the supplier or customers so they don’t pay the fake account too.
5. Find out how it happened. The Microsoft 365 audit logs usually show how the account was accessed and what was read or sent. That matters for your bank and your insurer, and, if personal information was involved, for deciding whether you need to notify under the Notifiable Data Breaches scheme.

Want us to check your business for these gaps? Book a free Essential Eight check.