How do payment redirection scams arrive?
Scamwatch describes fake invoices that come from a business's real email address, because scammers have accessed its systems, or from an address that has changed slightly. The fake invoice can carry the real logo and ABN and sit in the same conversation history as genuine emails. If you reply to ask about the new details, the scammer answers and explains the change. The ACSC's guidance on business email compromise describes the same pattern: criminals compromise a vendor's email account, edit the bank details on legitimate invoices and send them to customers, who pay the criminals thinking they are paying the vendor.
Which emails should trigger the verification process?
Set the trigger wide, because the warning signs look ordinary. The ACSC's list includes an unexpected change of bank details, an urgent payment request or threats of serious consequences, unusual payment requests from someone in authority, and an email address that does not quite match the supplier's name. Payroll is a second target. The ACSC describes criminals impersonating a staff member to request a change to that person's banking details, so the salary goes to their account. Treat any of the messages below as a verification case, whoever appears to send it.
- Any mention of new or updated bank, BSB or account details.
- An invoice whose payment details differ from the last one from that supplier.
- A staff member asking to change the account their pay goes to.
- Urgency or secrecy around a payment.
- A sender domain that differs from the usual one by a letter or a suffix.
What should the verification step involve?
Phone the supplier using a number you already hold, or one taken from their official website, never a number in the email or on the attached invoice. The ACSC recommends contacting the sender separately using contact details you have verified yourself. Speak to someone you have dealt with before where possible and ask them to read the new details back to you. Record the date, the person you spoke to, the number you called and what they confirmed. A second staff member then makes the change in your accounting system, so one compromised mailbox or one rushed person cannot redirect money alone.
Why can't AI verify these emails?
An AI model judges an email by its content and context. A message from a compromised supplier account has the right sender, the right thread history and believable wording, which are the signals a model relies on. The model cannot phone anyone or confirm that the person behind the mailbox is who they appear to be. If it replies in the thread to confirm the change, the reply goes to the scammer, and Scamwatch notes the scammer will answer with an explanation. Configure your email tools so payment-detail messages are labelled and routed, with drafting and sending switched off for that category.
What happens to payments while a change is checked?
Hold any payment to that supplier until verification is complete, and tell the person approving the pay run why it is held. If the call shows the request was fake, the supplier's own mailbox may be compromised, so tell them by phone as well. Keep the email as evidence instead of deleting it. If money has already been paid to the new account, contact your bank straight away and report the incident through the Australian Cyber Security Centre at cyber.gov.au. Then check which of your own accounts and mailboxes were involved.
How do you stop your own mailbox being used?
Criminals also use compromised business mailboxes to send fake invoices to that business's customers. The ACSC recommends multi-factor authentication for business email and systems, and describes it as one of the most effective controls against unauthorised access. Publish SPF, DKIM and DMARC records for your domain so receiving servers can recognise forged mail. Tell your customers in writing that your bank details will not change by email, and give them a number to call if they ever receive a request that says otherwise.