How to Spot Fake Email Invoice Payment Requests from Suppliers Targeting Australian Small Businesses

Summary

This guide helps you troubleshoot and resolve: How to Spot Fake Email Invoice Payment Requests from Suppliers Targeting Australian Small Businesses. Follow the steps below to fix the issue.

Common Causes

Business Email Compromise (BEC) scams are one of the most common cyber threats facing Australian small businesses today. In these scams, cybercriminals impersonate a trusted supplier or contractor and send a fake invoice email requesting payment to a new bank account. Because the email often looks legitimate and references real invoices or projects, many businesses transfer funds before realising it is a fraud. This guide explains how to spot fake invoice payment requests and verify them before sending money.

Quick Fix Steps

1. Do not reply to the suspicious email or use any phone numbers listed in the message.
2. Contact your supplier directly using a phone number or email address you already have on file.
3. Verify any request to change bank account details before processing payment.
4. Check the sender's email address carefully for subtle misspellings or unfamiliar domains.
5. Report suspected scam emails to your IT support provider or Open a Ticket.

Detailed Instructions

1. Check the Sender's Email Address

Scammers often use email addresses that look similar to your supplier's real address but contain small changes. Look for:

• Extra characters or numbers in the address (for example, [email protected] instead of [email protected])
• Public email domains such as @gmail.com, @outlook.com, or @yahoo.com.au when your supplier normally uses a business domain
• Display names that match your supplier but are paired with an unrelated email address

2. Look for Urgent or Unusual Language

Fake invoice emails often create pressure to act quickly. Be cautious of messages that:

• Claim the supplier has changed banks and payment is overdue
• Ask you to update payment details immediately
• Use threatening language about suspended services or late fees
• Request payment to an account you have never used before

3. Verify Bank Account Changes Separately

Never use contact details provided in the suspicious email. Instead:

1. Open your existing records, past invoices, or the supplier's official website.
2. Call the supplier using a phone number you have previously verified.
3. Ask them to confirm whether they sent the invoice and whether their bank details have changed.
4. Only update your accounting software or payment records after verbal confirmation.

4. Inspect Attachments and Links Before Opening

Fake invoice emails may contain malicious attachments or links designed to steal login credentials. Before opening anything:

• Hover over links to see the actual destination URL without clicking
• Be wary of unexpected PDF, Word, or Excel files claiming to be invoices
• Do not enable macros or enter passwords to view documents sent by email

5. Review Payment Requests Against Purchase Orders

Match every invoice against an approved purchase order or service agreement. If there is no matching purchase order, treat the request as suspicious until verified.

What to Do If You Suspect a Scam

1. Do not reply to the email or forward it to colleagues.
2. Do not click any links or open attachments.
3. Delete the email from your inbox and deleted items folder.
4. If you have already transferred funds, contact your bank immediately to request a recall.
5. Open a Ticket so we can help secure your email account and review for compromise.

Still Having Issues?