How to Spot Fake PayID and Osko Payment Scams Targeting Australian Small Businesses

Summary

This guide helps you troubleshoot and resolve: How to Spot Fake PayID and Osko Payment Scams Targeting Australian Small Businesses. Follow the steps below to fix the issue.

Common Causes

Real-time payment scams targeting Australian small businesses are on the rise. Scammers use fake PayID and Osko requests to trick business owners into transferring funds to fraudulent accounts. Because Osko payments are processed almost instantly, recovering stolen money is often impossible. This guide explains how to spot the warning signs and protect your business.

Common Warning Signs

Look for these red flags before authorising any payment:

• Unexpected invoices from suppliers with changed bank details
• Urgent requests to pay via PayID instead of standard EFT
• Emails or SMS messages from suppliers claiming their account details have changed
• Payment requests from free email addresses (e.g., Gmail, Outlook) instead of a business domain
• Pressure to transfer funds immediately to avoid service interruption
• Slight misspellings in email addresses or business names

How to Verify a PayID or Osko Request

1. Contact the supplier using a phone number you already have on file. Do not use any contact details provided in the suspicious email or SMS.
2. Ask the supplier to confirm the PayID, BSB, and account number directly over the phone.
3. Check the PayID details in your banking app before confirming the transfer. Ensure the name displayed matches the intended recipient.
4. Compare the invoice against previous legitimate invoices from the same supplier. Look for changes in formatting, logos, or payment terms.
5. Log into your business internet banking through your bank's official website or mobile app. Never click links in unexpected emails or text messages.

Protecting Your Business

Establish Payment Verification Processes

• Require two staff members to approve any new or changed payment details.
• Implement a policy that all supplier bank detail changes must be verified by phone using previously known contact information.
• Limit the number of employees authorised to make business payments.

Secure Your Email Accounts

• Enable multi-factor authentication on all business email accounts.
• Use strong, unique passwords for each account.
• Regularly analyse email forwarding rules to ensure no unauthorised rules have been created.
• Train staff to recognise phishing emails that attempt to steal login credentials.

Tip: Register a PayID for your business using your ABN or email address. This makes it easier for customers to verify they are paying the correct entity.

Caution: If you suspect you have already sent money to a scammer, contact your bank immediately. The sooner you report it, the better the chance of stopping the transaction.

Reporting a Scam

If you believe your business has been targeted by a PayID or Osko scam:

• Contact your bank immediately to report the fraudulent transaction.
• Report the incident to Australian Cyber Security Centre via ReportCyber.
• Report the scam to Scamwatch to help warn other Australian businesses.

Final Checklist

• Verify all payment detail changes via a known phone number.
• Confirm recipient names in your banking app before transferring funds.
• Enable multi-factor authentication on all business email accounts.
• Report suspicious activity to your bank and Scamwatch immediately.

Still Having Issues?