Fake Invoices and Changed Bank Details: How to Stop Payment Redirection Scams
Payment redirection scams trick businesses into paying real invoices into a criminal's bank account. Learn how the scam works, the warning signs, and the simple processes and email settings that stop it.
Brandon Strangman6 min read
The email looks exactly like it came from your regular supplier. It is part of an existing conversation, it mentions the right job, and the invoice is for the right amount. The only difference is a short note: "We have changed banks, please use the new account details below."
That is a payment redirection scam, sometimes called business email compromise. It is one of the most financially damaging cyber crimes affecting Australian businesses, because the money moves quickly and is often gone before anyone notices.
How the scam works
Most of these scams follow the same pattern:
- The attacker gets into an email account. Usually a supplier's, a client's or yours, typically through a phishing email that steals the password.
- They watch quietly. Sometimes for weeks, learning who pays whom, how invoices look and when large payments are due.
- They intervene at the right moment. They send a real-looking invoice or a bank detail change from the compromised account, or from a lookalike domain that differs by a single character.
- They hide the evidence. Inbox rules move replies out of sight so the real account owner never sees the conversation.
Because the email genuinely comes from a real account, or from an address that looks identical at a glance, spam filters and staff training alone often do not catch it. Process is what stops it.
The warning signs
- A request to change bank details, especially with urgency or a plausible excuse
- A new or slightly different email address or domain, such as an extra letter or a different ending
- Pressure to pay quickly, or a request to keep the change confidential
- An invoice arriving outside the normal channel, or from a different contact than usual
- A reply-to address that differs from the sender address
The process that stops it
1 Verify every bank detail change by phone
When anyone asks you to change the account you pay them into, call them on a number you already have on file, not a number in the email. Make this a firm rule with no exceptions for urgency or seniority.
2 Require two people for new payees and large payments
One person sets up or changes a payee, a second person approves it. Most business banking platforms support dual authorisation. Turn it on.
3 Tell your clients how you will contact them
Put a line on your invoices and email signature: "We will never change our bank details by email. If you receive a request that appears to come from us, call us on our listed number before paying." It protects your clients and your cash flow.
4 Check payee name matching
Many Australian banks now show whether the account name matches the BSB and account number you entered. Treat a mismatch warning as a reason to stop and call.
Write your bank detail verification process down, make sure everyone who pays invoices knows it, and test it occasionally. The scam relies on someone being rushed or wanting to be helpful.
The technical controls that help
Process is the most important defence, but these controls make the scam much harder to pull off:
- Multi-factor authentication on every email account, so a stolen password alone is not enough
- SPF, DKIM and DMARC on your domain, so criminals cannot easily send email that appears to come from you
- Impersonation and lookalike domain protection in your email filtering, which flags messages from domains that closely resemble yours or your suppliers'
- Alerts on new inbox rules and external forwarding, which are strong signs an account has been compromised
- An "external sender" banner on email from outside your organisation, so a message pretending to be from your director stands out
Our Microsoft 365 security checklist covers how to set these up.
If you have already paid
Act immediately. The chance of recovering funds drops quickly with time.
- Call your bank now and ask them to attempt a recall of the payment
- Report it through ReportCyber at cyber.gov.au
- Secure your email by resetting passwords, signing out all sessions, checking inbox rules and forwarding, and enabling MFA
- Warn the supplier or client whose identity was used, by phone
- Call your cyber insurer if you have one
If you are not sure whether the compromise started in your own account, assume it might have and get it checked. Our guide on what to do after a cyber attack covers the next steps.
Protect your business before it happens
Defy IT sets up the email security, multi-factor authentication and monitoring that make payment redirection scams far harder to pull off, and we can help you put a simple verification process in place for your team. Learn more about our cyber security services, or call us on (07) 3521 8515 to check your business email setup.
Quick Reference Summary
Written byBrandon StrangmanNeed Help with Your Business IT?
Ready to implement these strategies? Our expert team at Defy IT can help you build a resilient, secure IT environment tailored to your specific business needs.
Contact Us TodayReading up on cybersecurity? Explore our Cyber Security services or see how we help law firms, accounting firms and financial services businesses.