How to Spot Fake e-Invoice and Peppol Payment Requests Targeting Australian Small Businesses

Summary

This guide helps you troubleshoot and resolve: How to Spot Fake e-Invoice and Peppol Payment Requests Targeting Australian Small Businesses. Follow the steps below to fix the issue.

Common Causes

Fraudsters are increasingly targeting Australian small businesses with fake e-invoices and fraudulent Peppol payment requests. These scams often mimic legitimate suppliers or use compromised email accounts to trick staff into transferring funds to criminal accounts. Because e-invoicing and Peppol are designed to automate payments, a single mistake can result in significant financial loss before the error is detected.

Quick Fix Steps

1. Verify the sender's email address by checking the full header, not just the display name.
2. Cross-check the ABN on the invoice against the abr.business.gov.au lookup tool.
3. Confirm payment details via a trusted phone number previously on file, not one listed on the suspicious invoice.
4. Do not click links or open attachments in unexpected invoice emails.
5. Report suspected fraud to your bank immediately and contact your IT support provider for assistance.

Detailed Instructions

Identifying Fake e-Invoices

Legitimate e-invoices sent through the Peppol network do not arrive as standard email attachments. They are delivered directly to your accounting software via an access point. If you receive an invoice as a PDF or Word document attached to an email claiming to be an e-invoice, treat it with suspicion.

1. Open your accounting software and check for the invoice within the system rather than relying on the email notification.
2. Inspect the sender's email address carefully. Scammers often use addresses that look similar to legitimate ones, such as replacing an m with an rn or using a free email provider instead of a business domain.
3. Look for urgent language demanding immediate payment or changes to banking details.
4. Compare the invoice layout, logo, and colour scheme with previous legitimate invoices from the same supplier.

Tip: Always verify changes to bank account details by calling the supplier on a phone number you have used previously, not a number provided in the email.

Verifying Peppol Payment Requests

Peppol uses unique identifiers such as ABNs to route documents between businesses. A genuine Peppol invoice will contain valid identification data that can be cross-referenced.

1. Visit the Australian Business Register at abr.business.gov.au.
2. Enter the ABN listed on the invoice to confirm it matches the organisation name.
3. Check that the Peppol ID or participant identifier corresponds to the registered business.
4. Log into your Peppol-enabled accounting platform and confirm the invoice appears in your inbox there.

Caution: Never transfer funds based solely on an email request. Always verify through a second, trusted channel before making payment.

Securing Your Email and Accounting Systems

Compromised email accounts are a common source of fake invoice scams. Strengthening your login security reduces the risk of attackers intercepting or sending fraudulent requests.

1. Enable multi-factor authentication on your email and accounting software accounts.
2. Use strong, unique passwords for each business service.
3. Review your email Sent Items and Deleted Items folders for any messages you did not send.
4. Check your email Rules or Filters settings for any forwarding rules you did not create.
5. Ensure your operating system and web browser are updated to the latest version.

What to Do If You Have Already Paid

1. Contact your bank immediately to request a recall of the funds.
2. Report the incident to ReportCyber at cyber.gov.au.
3. Change passwords for all affected email and accounting accounts.
4. Scan your devices for malware using your installed security software.
5. Contact your IT support provider so they can assist with securing your business systems.

If You Are Unsure About an Invoice

• Do not make the payment until verification is complete.
• Forward the suspicious email to your IT support provider for analysis.
• Contact the alleged sender using official contact details from their website, not the invoice email.

Still Having Issues?