How to Spot Fake Invoice Redirection Emails Targeting Australian Small Businesses

Summary

This guide helps you troubleshoot and resolve: How to Spot Fake Invoice Redirection Emails Targeting Australian Small Businesses. Follow the steps below to fix the issue.

Common Causes

Invoice redirection scams—also known as business email compromise (BEC)—are one of the most costly threats facing Australian small businesses. In these attacks, cybercriminals impersonate a trusted supplier and request that future payments be sent to a new bank account. Because the email often looks legitimate and comes from a compromised or spoofed address, staff may unknowingly redirect funds to fraudsters. This guide explains how to spot these emails and what to do if you receive one.

Quick Fix Steps

1. Do not reply to the email or use any contact details provided in the message.
2. Verify the request using a phone number you already have on file for the supplier.
3. Check the sender’s email address carefully for subtle misspellings or unexpected domains.
4. Never update bank account details based on an email alone.
5. Report suspicious emails to your IT provider or open a ticket via Open a Ticket.

Detailed Instructions

Check the Sender’s Email Address

Scammers often use addresses that look similar to a real supplier but contain small changes. Look for:

• Extra characters, such as [email protected] instead of [email protected]
• Different domains, such as @supplier-services.com instead of @supplier.com.au
• Public email domains like @gmail.com or @outlook.com claiming to be a business

In Outlook or Gmail, click the sender’s name to reveal the full email address. Do not trust the display name alone.

Look for Urgent or Unusual Language

Fake invoice emails often create pressure to act quickly. Be suspicious of phrases such as:

• “We have changed our bank account details.”
• “Please update your records immediately.”
• “Urgent payment required to avoid service interruption.”
• “Kindly transfer funds to the new account below.”

Inspect Attachments and Links Before Clicking

Hover your mouse over any links to see the actual destination URL. Do not click if the link:

• Does not match the supplier’s known website
• Uses an IP address or unfamiliar domain
• Prompts you to log in to view an invoice

Be cautious of unexpected PDF, Excel, or ZIP attachments, even if they appear to come from a known contact.

Verify Through a Trusted Channel

1. Call the supplier using a phone number from your existing records, not one in the email.
2. Ask to speak to the accounts payable or billing contact you normally deal with.
3. Confirm whether they sent the invoice and whether their bank details have changed.
4. If they did not send the email, advise them their email may have been compromised.

What to Do If You Suspect a Scam

1. Do not make any payment or update banking details in your accounting software.
2. Do not forward the email to other staff members.
3. Take a screenshot of the email, including the sender address and any links.
4. Delete the email from your inbox and deleted items folder.
5. Report the incident to ReportCyber and Scamwatch, and consider notifying your bank if any funds have been transferred.
6. Contact your IT support provider or Open a Ticket so we can check your email security settings and help protect your organisation.

Prevent Future Attacks

• Enable multi-factor authentication (MFA) on all business email accounts.
• Train staff to verify payment detail changes by phone using known contact numbers.
• Implement a two-person approval process for new or changed supplier bank details.
• Keep operating systems, browsers, and email clients updated with the latest security patches.
• Review your email security settings with your MSP to block spoofed and phishing messages.

Still Having Issues?