How To Avoid Email Scams Small Business Australia

Summary

This guide helps you troubleshoot and resolve: How To Avoid Email Scams Small Business Australia. Follow the steps below to fix the issue.

Common Causes

Fake invoice scams are one of the most common threats facing Australian small businesses. These scams typically arrive via email and appear to come from a trusted supplier, contractor, or service provider. The goal is to trick your business into paying money into a fraudulent bank account by claiming that the supplier's payment details have changed. Because these emails often look professional and reference real transactions, they can be difficult to spot without careful verification.

Identifying Fake Invoice Scams

Fake invoice emails often share several warning signs. Recognising these indicators is the first step in protecting your business.

• Unexpected changes to bank account or payment details
• Urgent language demanding immediate payment
• Sender email addresses that look similar to, but not exactly the same as, your supplier's real address
• Invoices attached as PDFs or images rather than standard documents
• Requests to pay to a new account or a different bank than usual
• Poor grammar, spelling mistakes, or unusual formatting
• Emails sent outside normal business hours

Quick Fix Steps

1. Do not click any links or open attachments in the suspicious email.
2. Check the sender's email address carefully for subtle misspellings or extra characters.
3. Compare the invoice against previous legitimate invoices from the same supplier.
4. Contact the supplier using a phone number or email address you already have on file—never use contact details provided in the suspicious email.
5. If the payment details have changed, verify the change directly with a known contact at the supplier's organisation.
6. Do not process any payment until the invoice has been independently verified.

Detailed Instructions

Verifying Sender Addresses

Scammers often use email addresses that closely resemble legitimate ones. For example, they might replace a letter with a number or add an extra word to the domain.

1. Open the suspicious email without clicking any links or attachments.
2. Click on the sender's name to reveal the full email address.
3. Compare the domain (the part after the @ symbol) with previous emails from the same supplier.
4. Look for subtle changes such as @supplier-au.com instead of @supplier.com.au, or @supplier1.com instead of @supplier.com.
5. If anything looks different, treat the email as suspicious and verify through another channel.

Verifying Payment Detail Changes

A request to update bank account details is the most common tactic in fake invoice scams. Always treat these requests with caution.

1. Do not reply to the email asking about the change.
2. Call your supplier using a phone number from their official website, a past invoice, or your business records.
3. Ask to speak to the accounts or billing department.
4. Confirm whether they have changed their bank details and whether they sent the invoice.
5. If they did not send the invoice, advise them that their email may have been compromised.

Checking Invoice Documents

1. Save any attached invoice to your computer without opening it if possible.
2. Check the file extension—be wary of .exe, .scr, or .zip files disguised as invoices.
3. Open PDF invoices only in a secure viewer such as Adobe Acrobat Reader or your web browser's built-in PDF reader.
4. Look for inconsistencies in logos, formatting, or ABN details compared to previous invoices.
5. Verify the ABN on the Australian Business Register if you are unsure about the organisation.

What To Do If You Have Been Scammed

If your business has already made a payment to a fraudulent account, act quickly to minimise the damage.

1. Contact your financial institution immediately and request a stop payment or recall of the funds.
2. Provide your bank with all details of the transaction, including date, amount, and recipient account details.
3. Change passwords for any email accounts that may have been compromised.
4. Enable multi-factor authentication on your email and banking accounts if it is not already active.
5. Report the incident to Scamwatch via the ACCC website.
6. Report the incident to ReportCyber through the Australian Cyber Security Centre.
7. Inform your staff so they can be on alert for follow-up scam attempts.

Reporting Scams

Reporting scams helps authorities track trends and warn other businesses. You can report fake invoice scams to:

• Scamwatch (run by the ACCC)
• ReportCyber (Australian Cyber Security Centre)
• Your financial institution's fraud department

If you need assistance securing your business email or reviewing a suspicious message, Open a Ticket with our support team.

If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?