Fake Invoice Scams and Cyber Insurance: What Small Businesses Should Know
One of the most common scams aimed at Australian businesses doesn't rely on sophisticated hacking. A convincing email arrives, apparently from a regular supplier, saying their bank details have changed. You pay the next invoice to the new account, and the money is gone.
These scams are often called business email compromise or payment redirection scams. They target businesses of every size, from sole traders to large companies, and they're worth taking seriously.
How fake invoice scams work
The details vary, but common patterns include:
Changed bank details: an email that looks like it's from a supplier, contractor or landlord asks you to update their account details.
Hijacked email accounts: a scammer gains access to a real email account (yours or a supplier's), watches the conversation, then sends a fake invoice at the right moment.
Lookalike addresses: the sender's email address is one letter off the real one, or uses a slightly different domain.
Fake urgency: a message from someone posing as the boss asking for an urgent payment or gift cards, often when they're "in a meeting" or travelling.
Fake overdue notices: invoices for services you never ordered, such as directory listings or domain renewals.
Builders, manufacturers, transport and logistics businesses and anyone paying large supplier invoices can be particularly exposed, because big, regular payments are what scammers are looking for.
Simple steps to protect your business
Verify any change to bank details
This is the single most useful habit. If a supplier asks to change their bank details, call them on a number you already have on file, not one from the email, and confirm before paying.
Use two-step approval for payments
Where you can, have one person set up a payment and another approve it, particularly for new payees or changed details.
Turn on multi-factor authentication
Use multi-factor authentication for email, banking, accounting software and cloud storage. It makes it much harder for someone to log in with a stolen password.
Train your team
Make sure everyone who handles payments or email knows what these scams look like, and that it's fine to slow down and check.
Keep systems updated
Install software updates, use reputable security software, and back up your data regularly.
Use trusted resources
The Australian Signals Directorate's Australian Cyber Security Centre (cyber.gov.au) publishes free guidance for small businesses, and Scamwatch (scamwatch.gov.au) tracks current scams.
If you think you've been scammed
Contact your bank immediately. The sooner you report it, the better the chance of stopping or recovering a payment.
Report it through ReportCyber at cyber.gov.au.
Secure your accounts. Change passwords and check email rules or forwarding settings that may have been added.
Tell us if you have cyber insurance. Many cyber policies require prompt notification and provide access to incident response help. See our claims page.
Keep records of emails, invoices and payment details.
What cyber insurance can cover
Cyber insurance is designed to help businesses respond to and recover from cyber incidents. Depending on the policy, cover may include:
Access to incident response specialists, IT forensics and legal advice
Costs to restore data and systems
Business interruption losses after a cyber event
Costs of notifying affected customers after a data breach
Liability claims from third parties whose data was compromised
Cyber extortion, such as ransomware
The important catch: cyber crime and funds transfer fraud
Not every cyber policy covers money lost to a fake invoice or payment redirection scam. This type of loss is often dealt with under a separate section, sometimes called cyber crime, social engineering or funds transfer fraud, and it may be optional, sub-limited or subject to conditions such as verifying bank detail changes by phone.
Some businesses may also find related cover under a crime section of a management liability policy. Because the wording varies so much between insurers, it's worth checking exactly what your policy says before you rely on it.
How we help
We arrange cyber insurance for small businesses Australia-wide, by phone and email, including IT businesses, professional services firms and general businesses. We'll explain what each policy covers, point out any sub-limits or conditions for social engineering losses, and help you compare options.
Talk to us about cyber cover
To review your cyber risk and insurance, call us on (03) 9078 6473, email info@mminsure.com.au or contact us.
General advice warning: General advice only. This information is general in nature and doesn't take into account your objectives, financial situation or needs. Before deciding to buy or continue to hold any insurance product, consider whether it's right for you and read the relevant Product Disclosure Statement (PDS) and Target Market Determination (TMD), available from us or the insurer. Cover is subject to the terms, conditions, limits and exclusions of the policy.
M & M Insurance Services Pty Ltd ABN 54 664 837 138 is an Authorised Representative of Ausure Pty Ltd ABN 94 096 971 854 | AFSL 238433.
