Small business security
How to stop fake invoice and “change of bank details” scams
A supplier emails to say their bank details have changed. The email looks right, refers to a real invoice and comes from what seems to be their address. You update the details and pay. Weeks later the supplier asks where their money is. Payment redirection scams cost Australian businesses heavily every year, and they’re largely preventable with one simple rule.
The short version
The rule that stops it
- Never change bank details based on an email alone.
- Call the supplier on a number you already have, not one in the email.
- Require two people to approve new or changed payees.
- If you’ve paid a scammer, call your bank immediately.
How it happens
An email account is compromised
Often it’s the supplier’s mailbox, sometimes yours. Attackers get in through phishing or a reused password, then quietly read emails, sometimes for weeks.
They wait for the right moment
They learn who pays whom, how invoices look, and when large payments are due. They may set up rules that hide replies from the real mailbox owner.
The request arrives
An email says bank details have changed, often attached to a genuine-looking invoice, or arriving as a reply in a real conversation. It might come from the real account, or from a look-alike domain with one letter different.
Money goes to the scammer
The account is usually emptied quickly and moved on, which is why speed matters if it happens.
The controls that stop it
Verify every bank detail change by phone
Call the supplier using a number from your records, their website or a previous invoice. Never use contact details in the email asking for the change. Ask them to confirm the new details, not just whether they sent the email.
Two people approve new or changed payees
One person sets up the change, another checks and approves it. Most business banking platforms support dual approval.
Watch for warning signs
Urgency, a new bank in a different name or state, a request to keep it quiet, or a change right before a big payment are all reasons to slow down.
Use your bank’s payee name checking
Many Australian banks now show whether the account name matches the account details you’ve entered. Take a mismatch warning seriously.
Send a small test payment for large new payees
For significant amounts, a small payment confirmed by phone with the supplier adds another check.
Write it down
Put your payment verification rule in a short written procedure, and tell suppliers and customers about it. If everyone knows you always call to confirm, a scammer’s urgency doesn’t work.
Protect your own email too
If your mailbox is compromised, scammers can send fake invoices to your customers in your name.
- Turn on MFA for every mailbox.
- Set up SPF, DKIM and DMARC on your domain, so others can’t easily send email pretending to be you.
- Block automatic forwarding to external addresses in Microsoft 365 or Google Workspace.
- Tell customers how you’ll communicate bank details, for example on your invoices: “We will never change our bank details by email.”
If you’ve paid a scammer
The first hours matter most.
Call your bank immediately
Ask them to recall the payment and contact the receiving bank. Give them the amount, time, reference and account details.
Report it
Report to ReportCyber. Businesses can also call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).
Find out how it happened
Check whether your own mailbox was involved. Look for unknown forwarding rules, sign-ins and sent emails. If so, see what to do if your email is hacked.
Tell the real supplier
They need to know their email may be compromised, and they’ll still be expecting payment.
Talk to your insurer
If you have cyber insurance, notify them early. Policies often have time limits for reporting.
Common questions
The email came from the supplier’s real address. How is that possible?
Their mailbox was probably compromised. That’s why checking by phone matters, regardless of where the email came from.
Will the bank get my money back?
Sometimes, particularly if you report it within hours. The longer it takes, the less likely recovery becomes.
Who’s responsible for the loss?
It depends on the circumstances and agreements involved. Get advice early, but focus first on trying to recover the funds.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.