How to spot a fake invoice or bank-change email before you pay

Business email compromise (BEC) is a scam where a criminal pretends to be someone you trust, such as a supplier, a staff member or your boss, to get you to pay an invoice into their account or change the bank details you have on file. The email often looks perfect. Sometimes it really does come from your supplier's address, because the criminal has broken into that mailbox and is replying inside a real conversation.

That is why spotting the fake by looking at the email alone is unreliable. The protection that works is a simple rule: any change to payment details gets checked by phone, using a number you already trust, before a single dollar moves.

Warning signs to watch for

The Australian Signals Directorate (ASD) lists several red flags. Train everyone who pays bills or approves payments to stop when they see any of these:

• An unexpected change of bank details. "We've changed banks" or "please use our new account" is the classic BEC line.
• Urgency or threats. A demand to pay today, or a warning of serious consequences if payment is late.
• An unusual request from someone senior. An email that seems to come from the owner or a director, asking for a quick transfer and often asking you to keep it quiet.
• A sender address that is slightly wrong. One letter changed, an extra word, or a domain that doesn't match the supplier's company name. Compare it with earlier emails from the same supplier.
• A request to skip your normal process. "No need to wait for the purchase order" or "just this once, pay it before approval".

Other things that should make you pause: a reply-to address that differs from the sender, an invoice that looks slightly different from the supplier's usual layout, or new bank details that appear in a PDF attached to an otherwise normal-looking invoice.

Why these emails look so convincing

When a criminal gets into a mailbox, they can read months of conversation. They learn who pays whom, what invoices look like and when payments are due. They then send a fake invoice or a bank change notice at exactly the right moment, sometimes from the genuine account. A spelling check of the address will not catch that. A phone call to a number you already hold will.

A verify-by-phone process anyone can follow

ASD advises contacting the person or organisation separately, using contact details you have verified yourself, and setting a consistent business process for checking payment requests. Here is a process you can adopt today:

1. Never use the contact details in the email. Phone numbers and addresses in a fake email lead straight to the criminal.
2. Call a number you already trust. Use the number in your accounting system, on a past invoice you know is genuine, or on the supplier's website that you type in yourself.
3. Ask open questions. Ask "Can you read me the BSB and account number you want us to use?" Do not read the new details to them and ask them to confirm.
4. Get a second person to approve. Any new payee or changed bank details needs sign-off from someone other than the person who received the request.
5. Record the check. Note who you spoke to, the number you called, the date and time. Keep it with the supplier record.
6. Treat pressure as a warning. If the caller or emailer pushes back on your checks, stop and escalate.

Write this down as a one-page policy and give it to everyone who handles money, including bookkeepers and part-time office staff. Tell your suppliers that you will always call to confirm changes. Genuine suppliers will appreciate it.

The same rule for internal requests

Apply the process to requests that seem to come from inside the business. If the owner emails asking for an urgent transfer or gift cards, call them on their known mobile number. ASD also recommends giving staff a clear way to report threats, pressure for secrecy, or requests to bypass protective processes, so they feel safe saying no.

Make your business a harder target

• Turn on multi-factor authentication for every email account, so a stolen password alone is not enough to get in.
• Limit public contact details for staff in accounts, finance and HR. ASD notes that publishing these makes targeting easier.
• Check mailbox rules regularly. Microsoft lists inbox rules that forward mail to unknown addresses, or move messages to the Notes, Junk Email or RSS Subscriptions folders, as signs of a compromised account. Criminals use these rules to hide replies from the real owner.
• Use your accounting system's payee controls so changes to supplier bank details need a second approver.

In a free risk check with Shane, mailbox rules and payment approval steps are two of the first things we look at.

If you have already paid

Speed matters. Work through these steps straight away:

1. Contact your bank immediately. ASD's advice is to contact your bank immediately if you have sent money or banking details to a scammer. Use the number on your card or the bank's website, and ask them to try to recall or freeze the payment.
2. Report it to ASD through ReportCyber at cyber.gov.au. ASD asks Australians to report cybercrime, including BEC, through ReportCyber. For help, call the 24/7 Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).
3. Call the real supplier on a known number to tell them their account may be compromised, or that someone is impersonating them.
4. Secure your own email if it was involved. Change passwords, notify affected parties and consider a warning notice on your website, as ASD recommends. Ask your IT provider to check for unknown forwarding and inbox rules, sign out all sessions and review sign-in logs.
5. Keep everything. Do not delete the emails. Save the invoice, the email headers and your payment records for the bank and the report.
6. Think about personal information. If the criminal had access to a mailbox holding customer or staff details, you may need to assess whether it is a notifiable data breach. This is a plain-English summary, so check with the OAIC or your adviser about your obligations.

Summary checklist

• Any change of bank details is checked by phone, using a number you already hold.
• Ask the caller to read the details to you, never the other way around.
• A second person approves new payees and bank changes.
• Urgency, secrecy and "skip the process" requests are red flags.
• MFA is on for every mailbox, and inbox rules are reviewed.
• If money has gone: bank first, then ReportCyber, then the supplier and your IT provider.