It usually looks completely ordinary. An email from a supplier you have paid for years, with their logo and their usual sign-off, saying they have changed banks and asking you to update their details before the next invoice. Your accounts team updates the record, pays the invoice, and a few weeks later the real supplier calls asking where their money is.
This is invoice fraud, sometimes called payment redirection or business email compromise. It doesn't need malware or a clever hack, and that is exactly why it works so well. It relies on a busy person doing something that looks routine.
How big the problem is
The National Anti-Scam Centre's figures put losses to payment redirection scams in Australia at around $166.8 million in 2025, up on the year before. In ASD's latest annual cyber threat report, business email compromise fraud that caused a financial loss made up 15% of the top cybercrime reports from businesses, and the average cost of a cybercrime reported by a business was $80,850.
Those are only the reported cases. Plenty of businesses quietly absorb the loss, or never realise what happened until the real supplier chases them.
The three ways it usually happens
1. A supplier's mailbox is compromised
This is the most convincing version. An attacker gets into a supplier's real email account, watches the conversation for a while, and then sends the bank change from the genuine address, often replying in an existing thread. Nothing about the email looks wrong, because it isn't fake. It came from the right person's mailbox.
2. A lookalike domain
The attacker registers a domain one letter away from your supplier's, such as rn instead of m, or .com instead of .com.au, and emails from there. On a phone screen, at the end of a long day, it is very easy to miss.
3. Your own mailbox is compromised
Sometimes the attacker gets into one of your staff accounts instead. They can then send fake invoices to your customers, or set up a rule that quietly forwards or hides emails about payments, so nobody notices the real supplier asking what happened.
The control that stops most of it
The single most effective control is a process, not a product: never change bank details on the strength of an email alone.
When a supplier asks to change their details, someone calls them on a phone number you already have on file, not the one in the email, and confirms the change with a person they know. It takes five minutes, and it defeats all three versions above, because the attacker controls the email but not the supplier's real phone.
A few rules make that stick:
- Two people for any change to bank details. One requests, another verifies and approves.
- A pause on the first payment to new details, or a small test payment confirmed by phone.
- Urgency is a warning sign. "Please pay today or we'll stop supply" is exactly what a fraudster would say. Staff should feel safe slowing down.
- Tell your customers how you will contact them about payment details, so they know to call you if they get a request that doesn't fit.
The technical layer underneath
Process stops the payment. Technology makes it much harder for attackers to get into a mailbox in the first place, and quicker to spot when they do.
- Multi-factor authentication on every account, especially finance staff and anyone who can approve payments.
- SPF, DKIM and DMARC on your domain, so other people can't easily send email that appears to come from you.
- Alerts for suspicious mailbox activity, such as sign-ins from unusual locations and new rules that forward or delete emails.
- Email filtering that flags lookalike domains and marks external senders clearly.
Microsoft 365 Business Premium includes much of this, but it needs to be configured rather than left on its defaults. We wrote about what Business Premium does and doesn't do out of the box. Our standard managed security also includes identity threat detection, which watches Microsoft 365 sign-ins and mailbox rules for signs that an account has been taken over.
If it has already happened
- Call your bank immediately. The sooner they know, the better the chance of stopping or recovering the transfer.
- Report it through ReportCyber at cyber.gov.au. IDCARE can also help you work out what to do next.
- Secure the mailbox. Reset passwords, revoke active sessions, check MFA methods, and look for forwarding or deletion rules the attacker may have created.
- Tell the real supplier, because their mailbox may be the one that was compromised.
- Check your insurance. Some cyber policies cover social engineering fraud, but many have specific conditions. Our post on cyber insurance covers what to look for.
Never change bank details on an email alone.
Invoice fraud works because it looks routine. A phone call on a known number, two people for every bank change and a pause on first payments stop most of it. MFA, DMARC and mailbox monitoring make the rest much harder. Put the process in writing this week and make sure your accounts team knows they will be backed for slowing down.
If you'd like us to check how exposed your business is, we can review your Microsoft 365 security settings, email authentication and mailbox monitoring. Our cyber security team can walk you through it, or you can book a discovery call.