Australians reported losing $554.1 million to scams in the first six months of 2026, according to the National Anti-Scam Centre. When a small business is the target, the aim is often the same: getting you to pay money into the scammer’s account.

That only works if the payment goes through without a second look, and in the lead-up to Christmas, second looks are in short supply.

Scammers count on you being busy

Mannu was building a granny flat when a payment link for the $20,000 construction deposit arrived. He’d been expecting it from his builder, so he paid. By the time he realised the link hadn’t come from them, the money was gone. His was one of four stories the National Anti-Scam Centre shared during Scams Awareness Week 2026.

“Being scammed is not a reflection of someone’s intelligence or judgement,” said Catriona Lowe, Deputy Chair of the ACCC.

Timing and a familiar name did most of the work in Mannu’s case. In a business, the payment requests you’re expecting pile up around tax time, and a fake one can slip through among dozens of genuine payments. If you stay organised for BAS through the year, there’s less to rush at the deadline and fewer payments get approved without a proper check.

Where small businesses are losing money

You might think your business is too small to interest a scammer, but one in four small and medium businesses fell victim to cybercrime in the past year, and the average incident reported by a small business in 2024–25 cost $56,600. These five scams come up again and again in reports from Australians and their businesses.

Payment redirection and business email compromise

“In a business email compromise attack, scammers get into your supplier’s emails,” says James Eling, Managing Director of IT managed services business Extreme Networks. “They know what you’re buying and what you owe.”

When a genuine invoice is due, they reply in the same thread with the same invoice and one change: the bank account. Because the email can come from your supplier’s real address, checking the sender won’t catch it.

Payment redirection cost Australians $166.8 million in 2025, up 9.3% on the year before and second only to investment scams, according to the National Anti-Scam Centre.

Watch for any change to a supplier’s bank details, however reasonable the explanation that comes with it. Scamwatch lists the other warning signs of business email compromise.

Fake invoices, listings and renewals

Some scams skip the hacking and simply send a bill. It might be for a business directory listing you never asked for, an award nomination with an entry fee, advertising that never ran, or a domain renewal from a company that isn’t your registrar.

False billing, which covers these invoices as well as payment redirection, was the scam type small businesses reported most to Scamwatch in 2025. These invoices rely on being paid on autopilot, so if you can’t match one to something you signed up for, hold it until you can.

Phishing and email account takeover

Phishing often starts with a convincing login page that hands a scammer your email password. From there they read your inbox, learn who you pay and when, and use your account to send fake invoices to your own customers.

The giveaway is a link that takes you to a sign-in page, even when it comes from someone you know. Type the address in yourself or use a bookmark, because looking the site up on a search engine isn’t always safe either: scammers pay for ads that sit above the real result and lead to fake login pages.

Government and bank impersonation

Around BAS time, scammers pose as the ATO, ASIC or your bank, often by phone and usually with a deadline attached: a debt to pay today, a registration about to lapse, an account about to be frozen.

Pressure plus a request to pay or log in through their link or number is the common pattern. Hang up and call back on a number you find yourself, from the agency’s website or a letter you’ve received before. The ATO keeps a list of current scam alerts showing what its impersonators are sending.

Fake customers and overpayments

A new customer places a large order, pays more than the invoice and asks you to send back the difference. The original payment is often made with a stolen card or account, so it’s later reversed, leaving you out of pocket for the refund you sent.

Sometimes no money arrives at all, and the scammer sends an email or screenshot that looks like it’s from their bank or PayID, claiming they’ve paid or overpaid. Some go further and ask you to pay a fee to upgrade to a business PayID before the money can be released, an upgrade that doesn’t exist.

Before you send a refund or release goods, check your own banking app to confirm the money has arrived and cleared. An email or screenshot isn’t proof of payment.

AI has removed the old warning signs

For years, scam advice leaned on spotting mistakes: bad spelling, generic greetings, a request that didn’t sound like the person sending it. Today, generative AI lets scammers write in fluent Australian English, match the tone of a supplier’s previous emails and produce a new version in seconds.

Voice is going the same way, and for a business, a cloned voice can be used to back up a request that arrived by email. “The owner” calls to confirm the new account details you’ve just been sent, or a supplier’s accounts manager rings to hurry a payment along.

“A phishing gang could automate the creation of an audio or video avatar by scraping content that’s already on the internet,” says James. “Setting your social media profiles to private makes it harder for them to get the source material.”

If a call from someone who’s meant to know you doesn’t feel right, James suggests asking a question only they could answer. “Something like, ‘When did we last place an order?’ That usually throws the AI model off.”

Whether the request comes by email or phone, ring back on a number you already have, so you end up talking to the real person.

Simple habits that make you a harder target

“The number one thing an SME owner can do before Christmas is put robust payment policies in place,” says James. “Teach your staff not to trust an invoice just because a supplier emailed it, and to watch for any urgent request for payment.”

Here’s what those policies can look like in practice, whether a request arrives by email, text or phone.

Verify with a contact you already had
Call the supplier on the number in your records or on their website, never the one in the email or invoice, as the National Anti-Scam Centre’s Stop. Check. Protect. campaign advises.
Treat changed bank details as unconfirmed
Don’t update a supplier’s details in your accounting software or banking until you’ve spoken to them. Once they’ve confirmed, consider waiting a day before making the first payment to the new account, which gives you time to catch anything that doesn’t add up.
Use two sets of eyes
Have a second person approve new payees and changed details. In a small team, that might be you and your bookkeeper.
Agree a call-back rule for urgent requests
Any urgent request to move money, including one that sounds like you or anyone else who approves payments, gets confirmed by calling back on a known number. Some businesses add a code word that only the team knows.
Lock down your email
Turn on multi-factor authentication for every account that handles invoices or payments. Our guide to cyber security measures for small businesses covers MFA, backups and software updates.
Brief your team before your busiest weeks
Casuals and new starters are the least likely to know how your business pays suppliers, so take five minutes to walk them through these rules.

Download this checklist as a PDF to share with your team.

What to do if you’ve been scammed

Your bank needs to hear about it first, and by phone, because a payment is easier to stop or recall the sooner it’s reported.

  • Call your bank’s fraud line and ask it to try to recall the payment.
  • Stop any other payments to the same account, and check for other invoices from the same fake supplier.
  • Secure your own email in case it was accessed too. Change the password, turn on MFA and check for forwarding rules you didn’t set up.
  • Let the real supplier know their name was used, so they can check whether their email has been hacked and warn their other customers.
  • If it was your email that was hacked, contact your customers too, as scammers may have sent them fake invoices from your address. Ask them to call you before they make any payment.
  • Lodge it with ReportCyber, which can refer cases to police, and with Scamwatch.
  • Contact IDCARE for free support if personal or business identity details were exposed.

If a card was involved, freeze it straight away. Many business accounts let you do this in their app, which is one of the features to look for when choosing a business account.

Keep the emails, invoices and call records. Your bank, the police and any insurer will ask for them.

Before your busiest weeks start, agree your payment rules with your team and tell your regular suppliers how you’ll confirm any change to their details.