What invoice fraud looks like
Scamwatch calls this a business email compromise scam. The scammer pretends to be a business you have dealt with. They send an invoice with new payee details. The aim is to make you redirect a real payment into their account. You think you are paying for goods or services you ordered. You are not.
The scam can arrive in the same email thread as your last real chat with the supplier. Scammers can also copy logos and ABNs. That makes the email feel safe. These scams can hit any large payment, from a trade invoice to a deposit on a vehicle or a house.
Warning signs of a fake supplier email
Most fake invoices give themselves away in a few small ways. Look for these before you pay.
- A supplier's payment details change, and nobody told you first.
- You get a bill for goods or services you never ordered.
- The email address or website has a spelling error, or is slightly different from the usual one.
- The email is urgent, or it asks you to keep the change quiet.
- A request asks you to skip your normal approval steps.
Scamwatch notes that scammers sometimes add one extra letter or number to an email address. Read the sender address letter by letter, not just the display name. The Australian Cyber Security Centre (ACSC) lists similar tricks with web addresses, such as removed letters, swapped letters, an added hyphen or a different ending like .net instead of .com.au.
How the scammer gets in
Sometimes the scammer never touches your supplier. They register a web address that looks almost the same and send mail from it. This is called a lookalike domain.
In other cases, the scammer breaks into a real email account. The ACSC says that once someone has access to an inbox, they can read private messages and send emails pretending to be you. That is why a message from a known contact can still be fake.
The ACSC also reported that self-reported losses from business email compromise were $81.45 million in the 2020-21 financial year. That is a large sum for what is, at heart, a trick with one email.
The call-back check before you pay
The best defence is simple. Pick up the phone. Both Scamwatch and the ACSC give the same core advice: confirm any change by speaking to the business, using contact details you already trust.
- Stop. Do not pay the invoice yet, however urgent it sounds.
- Find a phone number you already hold, such as one from an old contract or the official website. Do not use the number in the suspicious email. A criminal may control it.
- Call and speak to a person. Ask them to confirm the new bank details out loud.
- Do not confirm by replying to the same email.
- Write down who you spoke to and when. Then update your records.
If the supplier says they did not send the change, do not pay. Tell them straight away, because their email may have been hacked.
Simple habits that stop invoice fraud
One careful person can miss a fake. A short process makes the whole business safer.
- Add an approval step for any request to change payment details or make a large transfer.
- Give staff clear guidance to verify account details and to think before acting on unusual requests.
- Set up a way for staff to report pressure for urgent payment, secrecy or skipping the normal process.
- Turn on multi-factor authentication for your email accounts. It adds a second step to every login.
- Renew your domain names, and think about registering lookalike names that could confuse your customers.
- Ask your email provider about SPF, DKIM and DMARC. These records help stop others from faking your address.
The ACSC also suggests training staff to be careful with requests for money, especially if urgent or overdue, and with any bank account change.
What to do if you already paid
Act fast. Scamwatch says to contact your bank or card provider right away, ask them to stop any transactions, and report the scam to Scamwatch. The sooner you call, the better the chance that the bank can act.
Then protect your accounts. Change the passwords on your email and online banking, and warn the real supplier and your other contacts. The ACSC also runs a hotline for cyber incidents on 1300 CYBER1 (1300 292 371).
The limit of this advice: a call-back only works if you use a number you already trust. A number taken from the invoice or the email proves nothing.