Common Scams Targeting Australian Small Businesses: A 2024 Guide

Summary

This guide helps you troubleshoot and resolve: Common Scams Targeting Australian Small Businesses: A 2024 Guide. Follow the steps below to fix the issue.

Common Causes

Cybercriminals are increasingly targeting Australian small businesses with sophisticated scams designed to steal money, data, and login credentials. Because small businesses often lack dedicated IT security teams, they are viewed as soft targets. This guide outlines the most common scams affecting SMBs in 2024 and provides practical steps to protect your organisation.

Common Scams Targeting Small Businesses

Business Email Compromise (BEC)

BEC occurs when a scammer gains access to a business email account or spoofs a trusted sender's address. They typically request an urgent payment to a new bank account, posing as a supplier or a company executive.

Fake Invoice Scams

Scammers send invoices for goods or services that were never ordered. These invoices often look legitimate and may include realistic logos and branding to trick accounts payable staff into processing the payment.

Phishing and Spear Phishing

Phishing emails attempt to trick employees into clicking malicious links or entering credentials on fake login pages. Spear phishing is more targeted, using specific information about the business or individual to appear more convincing.

Technical Support Scams

A scammer calls or sends a pop-up warning claiming your computer is infected. They request remote access to your device or payment for unnecessary software to "fix" the problem.

How to Protect Your Business

Verify Payment Requests

1. Never action a request to change bank details based solely on an email.
2. Contact the supplier or colleague directly using a phone number you already have on file—not one provided in the suspicious email.
3. Implement a dual-authorisation process for all payments above a set threshold.

Strengthen Email Security

1. Enable multi-factor authentication (MFA) on all business email accounts.
2. Train staff to hover over links to check the actual URL before clicking.
3. Use

   spam filtering

   and email security gateways to block known malicious senders.

Secure Your Accounts

1. Use a password manager to generate and store unique, complex passwords for every service.
2. Avoid reusing passwords across personal and business accounts.
3. Regularly review user access permissions and remove accounts for former employees.

Consider implementing the Australian Signals Directorate (ASD) Essential Eight mitigation strategies to strengthen your business's cyber security posture.

What to Do If You Have Been Targeted

1. Immediately change the passwords for any compromised accounts.
2. Contact your bank to attempt to recall any fraudulent transactions.
3. Report the incident to Australian Cyber Security Centre (ACSC) via ReportCyber.
4. Report the scam to Scamwatch (run by the ACCC) to help warn other businesses.
5. Notify your staff so they can remain vigilant for follow-up attempts.

If you suspect your business email or network has been compromised, Open a Ticket with 220 Internet Services for immediate assistance.

Still Having Issues?