The Invoice That Wasn't
Payment redirection cost Australians $166.8 million in 2025. It arrives as a real invoice from a real supplier with one line changed. One phone call stops it.
The thing that gets small businesses is not a hacker in a hoodie. It is an email from a supplier you have paid forty times before, with the same logo, the same signature block, the same slightly formal tone, saying the accounts have moved to a new bank and here are the new details. And you pay it, because why wouldn't you. It looks exactly like every other invoice, because it very often is exactly the last invoice with one line changed.
That is payment redirection, and in 2025 it took $166.8 million off Australians, up 9.3 per cent on the $152.6 million the year before (National Anti-Scam Centre, 2026). It sits second only to investment scams for money lost.
Why it works on careful people
Every other bit of security advice you have read assumes something looks wrong. A dodgy link. A misspelled domain. An urgent tone. This one doesn't look wrong, because usually nothing about it is fake except the account number.
Here is the mechanic. Somebody gets into an email account - your supplier's, your bookkeeper's, sometimes yours, sometimes an account nobody remembered was still open. They don't do anything dramatic. They sit there and read. They learn who invoices whom, on what cycle, in what tone, with what attachments. Then at the right moment they send the real invoice, from the real mailbox, with the banking line edited. The Australian Signals Directorate's 2024-25 figures put business email compromise resulting in financial loss at 15 per cent of all self-reported cybercrime from businesses, with a further 19 per cent reporting email compromise that didn't cost them money (ASD, 2025). Put those together and a third of what businesses report is somebody in a mailbox.
The money is real. ASD puts the average self-reported cost of cybercrime for a small business at $56,600 per report, up 14 per cent in a year. That is not a rounding error on a small business. That is a ute, a quarter's wages, or the difference between a good year and a bad one.
I have sat with people after this has happened. The dominant emotion is not fear. It's embarrassment, and then a sort of disbelief, because they are careful people and they did not click anything stupid. They just paid an invoice. That's the trap: the behaviour being exploited is competence, not carelessness.
One rule, and it is not technical
Any change to bank details gets verified by voice, on a number you already had, before the payment goes out.
Read that again, because two words are doing all the work. Already had. Not the number in the email. Not the number in the signature block. Not the number on the invoice. The number you have been ringing that supplier on for two years, which lives in your phone, or on the contract, or on their website that you navigated to yourself.
The people running this know you might ring. So they change the phone number in the email too. If you call the number they gave you, a pleasant person confirms the new account, and you will have done everything right and lost the money anyway.
That is the entire control. It is free, it takes ninety seconds, and it defeats the mechanism completely, because the one thing the attacker cannot do is answer your supplier's real phone.
Make it a rule rather than a judgement call. Judgement gets tired at 4:50 on a Friday. A rule does not. And the rule has to survive pressure - if the email says the payment is urgent and the account changed this morning, that is the moment you ring, not the moment you make an exception. Urgency is the tool. Treat it as the tell.
There is a second half nobody mentions. Tell your customers the rule as well. Put a line on your own invoices saying your bank details never change by email, and that anyone who receives such a message should ring you on the number they already have. You are as likely to be the impersonated party as the victim, and the fraud only completes if the person on the other end trusts an email. You cannot secure their mailbox. You can arm their scepticism.
The part that is technical, and it is small
Your domain has a set of records that tell the rest of the world which servers are allowed to send email as you, and what to do with mail that fails the check. That last part is DMARC, and its whole value is in the instruction: monitor only, quarantine, or reject.
When we scanned 150 Australian small business domains for the Red Bridge Cyber SMB Posture Baseline, 83 per cent published a DMARC record and only 43 per cent set it to actually do anything*. That gap is the whole story of small business email security in one number. The record is there, so a checklist somewhere got ticked, and it is set to watch a forgery go past and take no action.
Getting from published to enforcing is a job for whoever runs your email, and it is measured in hours, not weeks. Start by reading what your SPF record actually says, then work up to enforcement. It will not stop the compromised-mailbox version of this scam, because that mail is genuinely from your supplier. It stops the cheaper version, where somebody simply forges your address, and there is no reason to leave that door open.
Turn on multi-factor authentication on every mailbox in the business while you are there. Not because it is fashionable advice, but because the entire attack starts with somebody reading email they should not be able to read, and a long passphrase on its own will not stop a stolen one being reused.
What to do if it has already happened
In order, and the order matters. ASD publishes a step-by-step recovery guide for exactly this (ASD, 2026), and the short version is:
- Ring your bank. Immediately, before anything else, and by phone rather than email. ASD's guidance is to contact your bank straight away if you have transferred funds to fraudulent account details, because they may be able to stop the transaction.
- Report it through ReportCyber and to Scamwatch. That is what feeds the national picture, and it is also what your insurer will ask whether you did.
- Tell the supplier whose invoice was used. There is a decent chance their mailbox is the one standing open and nobody has told them.
- Change the password and check the rules on every mailbox involved. Whoever was reading may have left a forwarding or filing rule behind so they keep reading after you have locked the door.
Then, when the adrenaline has gone, go back and put the rule in place. Nearly everyone I have met who does this properly started the week after it cost them something.
What is the largest payment your business could make this week on the strength of an email alone? And who would have to be having a bad day for that to go wrong?
Sources
- National Anti-Scam Centre, Targeting scams: report on scams data and activity 2025 - retrieved 5 August 2026, https://www.accc.gov.au/about-us/publications/serial-publications/targeting-scams-reports-on-scams-activity/targeting-scams-report-of-the-national-anti-scam-centre-on-scams-data-and-activity-2025
- Australian Signals Directorate, Annual Cyber Threat Report 2024-25 - retrieved 5 August 2026, https://www.cyber.gov.au/about-us/view-all-content/reports-and-statistics/annual-cyber-threat-report-2024-2025
- Australian Signals Directorate, Recover from business email compromise - retrieved 5 August 2026, https://www.cyber.gov.au/report-and-recover/recover-from/business-email-compromise
- Red Bridge Cyber SMB Posture Baseline, June 2026: /research/smb-posture-baseline
- Red Bridge Cyber, guide: What an SPF check result actually means
- Red Bridge Cyber, perspective: Who Still Has the Keys?
- Red Bridge Cyber, perspective: Th@ts!s3cure: Why Complex Passwords Aren't Strong Passwords