How to Spot
Fake Invoices
Fake invoices and “we’ve changed our bank details” emails are a common way criminals take money from Australian businesses. Here is how the scam works, the signs to look for, the checks that catch it and what to do if money has already gone.
- Warning signs
- Verify by phone
- What to do if you paid
of cybercrime reports from businesses in 2024-25 were business email compromise fraud with a financial loss (ASD).
Of business reports were email compromise
Were BEC fraud with a financial loss
Average cost per report, small business
A cybercrime is reported to ASD
How payment redirection fraud works
Business email compromise (BEC) is when a criminal uses email to pose as someone you trust, usually a supplier, a client or your own boss, and asks for money to go somewhere new. The figures above are from ASD’s Annual Cyber Threat Report 2024-25.
The convincing versions come from inside a real conversation. A criminal gets into a supplier’s mailbox, or one of yours, reads the email history, waits for an invoice to fall due and then sends “updated” bank details from the genuine address. They often add a mailbox rule that hides replies from the real owner, so nobody notices until the supplier asks why they haven’t been paid.
Hijacked mailbox
Sent from the real address, inside a real email thread.
Lookalike domain
One letter changed, or .com instead of .com.au.
Spoofed address
Your exact domain, faked. SPF, DKIM and DMARC help block it.
Fake bill
An invoice for goods or services nobody ordered.
Warning signs of a fake invoice
Any one of these is a reason to stop and check before paying.
Bank details have changed
The biggest warning sign. A new BSB and account number, often explained as a bank change or an audit.
The request is urgent
Pay today, the account will be frozen, the director needs it done before a flight.
It asks you to keep it quiet
Don’t call, don’t loop anyone else in, the deal is confidential.
The address is almost right
An extra letter, a swapped character or a different ending. Scamwatch warns scammers may add one extra letter or number.
Replies go somewhere else
The sender looks right, but pressing reply shows a different address.
You don't recognise the bill
An invoice for goods or services nobody in the business ordered.
The details don't match
Amounts, invoice numbers, logos or the ABN differ from earlier invoices from the same supplier.
It skips your usual process
A request to pay outside your normal approval steps, just this once.
Call on a number you already have
The most reliable protection is a simple habit: never accept new bank details by email alone. Call the supplier on a number from your own records, an earlier invoice you know is genuine or their official website, and ask them to confirm the change. Scamwatch gives the same advice.
Never use the phone number in the email asking for the change. If the mailbox is in a criminal’s hands, that number may ring them.
Confirmation of Payee
When you pay someone new, many Australian banks now check the account name against the BSB and account number and show whether it matches. Confirmation of Payee launched in July 2025 and is live with over 100 financial institutions. Treat a “no match” or “close match” as a reason to stop and call. A match on its own doesn’t prove an invoice is genuine.
Write it down and stick to it
- Bank detail changes are never accepted by email alone
- Every change is confirmed by phone on a number from your records
- A second person approves the change
- The call is noted against the supplier record
- The first payment to new details is double-checked
Could someone send email as your business?
Our free email security check tests your domain’s SPF, DKIM and DMARC in seconds. For a wider look, our free cyber security assessment is free, with no obligation.
The technical controls that reduce the risk
A phone call catches the fake request. These controls make it harder for a criminal to get into the conversation in the first place.
Multi-factor authentication
A stolen password alone won’t open the mailbox, and number matching stops staff approving prompts out of habit.
SPF, DKIM and DMARC
Help stop criminals sending email from your exact domain. They don’t stop lookalike domains, so the phone check still matters.
Mailbox rule alerts
An alert when someone creates a rule that forwards, hides or deletes email, often one of the first things an intruder does.
Sign-in monitoring
Alerts on sign-ins from unusual places or devices, with overseas sign-ins blocked by default on Microsoft 365.
Email filtering
Phishing links, fake login pages and spoofed senders filtered before they reach the inbox.
Staff training
Short training and simulated phishing, so the accounts team knows the warning signs.
We set these up and watch them on our managed plans. See cyber security services for the full list, and what MFA is for the sign-in side.
Paid a fake invoice? Act now
Speed matters. The sooner your bank knows, the better the chance of stopping the payment.
Call your bank straight away
Use the number on your card or the bank’s website. Tell them the payment was a scam and ask them to stop it.
Secure your email
Change passwords, sign everyone out, and look for mailbox rules and forwarding you didn’t set up. Call your IT provider to do this with you.
Report it
Report the cybercrime to police through ReportCyber at cyber.gov.au, or call ASD’s 24/7 hotline on 1300 CYBER1 (1300 292 371). You can also report the scam to Scamwatch.
Get support
IDCARE, the national identity and cyber support service, can help you plan your next steps for free on 1800 595 160.
Tell the people affected
Let the real supplier know. If your own mailbox was used, warn your clients not to pay to new details.
When criminals send fake invoices from your email
Sometimes the hijacked mailbox is yours, and it is your clients who are asked to pay new bank details. The risk is highest where large invoices, trust money or settlement figures travel by email, such as in accounting, legal and real estate.
The steps above still apply, with two additions. Find out how the criminal got in and what they could read, because client information in that mailbox may make it a notifiable data breach if your business is covered by the Privacy Act. And call your clients quickly to tell them your bank details haven’t changed.
Accounting and finance firms
How we protect firms that invoice clients and handle their money: accounting and finance IT support.
Law firms and real estate
Settlements and deposits are prime targets: law firm IT and real estate IT.
We protect our own inbox the same way
SEQ IT achieved SMB1001 Gold through CyberCert, and at Gold that includes SPF, DKIM and DMARC set to quarantine or reject. We run the same email controls for our clients.
SMB1001 Gold
Partner
Partner and Cloud Solution Provider (CSP)
Google Cloud Partner
Fake invoices: common questions
How can I tell if an invoice is fake?
Look for changed bank details, urgency, requests for secrecy, a sender address that is almost right, a reply address that differs, and amounts or invoice numbers that don’t match earlier invoices. The surest check is to call the supplier on a number from your own records, not one in the email, and confirm the details before paying.
What is business email compromise?
Business email compromise (BEC) is a scam where a criminal uses email to pose as a supplier, client or senior staff member and asks for money to be paid into their account. It often uses a real, hijacked mailbox. In ASD’s Annual Cyber Threat Report 2024-25, BEC fraud with a financial loss made up 15% of cybercrime reports from businesses.
What should I do if I paid a fake invoice?
Call your bank immediately and ask them to stop the payment. Then secure your email by changing passwords and checking for unknown forwarding rules, report the cybercrime to police through ReportCyber at cyber.gov.au or on 1300 CYBER1, report the scam to Scamwatch, and contact IDCARE on 1800 595 160 for free support.
Can the bank get my money back after invoice fraud?
Sometimes, but it is never certain, and the chances drop once the money has been moved on. Call your bank as soon as you suspect a problem, tell them it was a scam and ask them to stop the payment. Don’t wait until you are sure, and report the crime as well.
How do I verify a change of bank details from a supplier?
Call the supplier on a phone number you already hold, from an earlier genuine invoice, your accounts system or their official website. Never use contact details from the email asking for the change. Have a second person approve the change, note the call, and treat a Confirmation of Payee “no match” result as a reason to stop.
Does DMARC stop fake invoice emails?
DMARC, with SPF and DKIM, helps stop criminals sending email from your exact domain, which protects your clients from fakes that appear to come from you. It doesn’t stop lookalike domains, or email sent from a genuine mailbox that has been hacked. That is why you also need MFA, sign-in alerts and a phone check for bank detail changes.
How do criminals get into a business email account?
Usually with a stolen password, collected through a fake sign-in page, a data breach or a password reused on another site. Without multi-factor authentication, the password is all they need. Once in, they read past invoices, add rules to hide replies and wait for a payment to fall due. A free cyber security assessment shows where your accounts are exposed.
Where do I report invoice fraud in Australia?
Tell your bank first, because they can act on the payment. Then report the cybercrime to police through ReportCyber at cyber.gov.au, or call ASD’s hotline on 1300 CYBER1 (1300 292 371), which runs 24 hours a day, 7 days a week. You can also report the scam to Scamwatch, and IDCARE offers free support on 1800 595 160.
Related pages
Email security check
Test SPF, DKIM and DMARC for your domain.
Free cyber security assessment
Find the gaps before a criminal does.
Accounting and finance IT support
Security for firms that handle client money.
Cyber security services
The full set of controls we manage.
Cyber insurance readiness
Evidence for insurer questionnaires.
What is MFA?
The sign-in protection every mailbox needs.
Make your inbox a harder target
We’ll check your email security, sign-in protection and payment process, then set up the controls that help catch fake invoices before anyone pays.
- MFA and sign-in alerts on every mailbox
- SPF, DKIM and DMARC set up and monitored
- Alerts on suspicious mailbox rules
Prefer to talk? Call 1300 619 750, Monday to Friday.
Tell us what you need and we’ll get back to you.