The invoice scam costing South West businesses thousands

A trusted supplier emails to say their bank details have changed. You update them, pay the next invoice — and the money is gone. This is a payment-redirection scam (also called business email compromise), and Australian businesses lost around $167 million to it in 2025. It’s one of the most expensive threats facing local businesses right now.

How the scam works

Scammers quietly break into an email account — often a supplier’s, not yours — and watch. When a real invoice is due, they send one that looks identical, with only the bank account changed. Because it comes from a genuine-looking address and matches a payment you were expecting, it sails straight through.

Sometimes they intercept a real invoice in transit and alter the account details before it reaches you. Either way, nothing looks “hacked” — that’s what makes it work.

The warning signs

• A sudden change to a supplier’s bank details, especially with an urgent tone.
• A reply-to address or domain that’s slightly off (an extra letter, .co instead of .com.au).
• Pressure to pay quickly or skip your normal approval step.
• New details sent only by email, never confirmed any other way.

The one habit that stops it

Before changing any payment details or paying a new account, verify by phone — using a number you already have on file, not one from the email. A 30-second call to a known contact defeats almost every version of this scam. A Bendigo and Adelaide Bank customer, a construction firm, was recently saved from a near-$900,000 loss exactly this way.

Build it into how you pay

• Make “call to confirm any bank-detail change” a written rule everyone follows.
• Add a second approver for payments over a set amount.
• Turn on MFA across email so attackers can’t get into your inbox in the first place.
• Brief anyone who handles invoices — this is a staff-awareness problem as much as a technical one.

If you’d like us to review how your business handles payments and lock down your email, book a security review. We’ll set up sensible safeguards without slowing your team down.