The old warning signs aren’t enough any more

Just a few years ago, a fake or altered invoice might have given itself away with a mismatched font, an email address that didn’t seem right, or even two account numbers left on the page.

CommBank’s Fraud and Scams Industry, Intelligence and Disruption Senior Manager Shannon Brown said those visual clues are becoming less reliable. As with many scam types, scammers are using AI tools and deepfake audio, photos and video to make their contact look more legitimate.

A $60,000 near miss 

For CPR Facade Upgrade Specialists, a family business in western Sydney, one fake invoice almost cost $60,000.

“Invoicing and payments is just a daily operation for us,” said office manager Carmen Khung-Smith.

The contractor invoice looked like it came from the same supplier, in the same format, but with different bank details.

CommBank contacted the business to flag the payment, and the business then checked the details with its supplier. That check confirmed the scam. 

“The thought of losing that sum of money for any small and medium business is really quite frightening,” Khung-Smith said. “It really triggered us to look into our processes.”

How payment redirection scams work

An invoice arrives that looks genuine. It might be from a supplier you’ve paid many times before, or from someone new. Sometimes the logo, the layout and even the amount can all look right, and the only difference may be the bank account details.

That’s one way a payment redirection scam can work. These scams are also sometimes called business email compromise (BEC), false billing or false invoicing scams. 

“These scams can play out in a number of different ways,” Brown said. “It might be compromised email accounts, altered invoices, fake requests from staff members - ultimately it’s about getting money moved to an account that is being controlled by criminals.”

How scammers can trick businesses

Brown said there are different ways these scams can begin.

One is through a genuine email account that has been compromised. 

Scammers may use phishing, malware or other techniques to gain access to an email account, then quietly watch communications over time.

“They wait and watch communications back and forth to see how the business works,” Brown said. “In some cases, they might monitor invoices for months before acting, and when they do act – they know exactly how to write a convincing email with an invoice attached that now has new bank account details.”

“It feels very normal for the person who’s receiving that invoice.”

Another method is impersonation. 

Here the email comes from an address that looks almost identical to a genuine one, perhaps with a letter or two swapped so it passes at a quick glance.

For more on these methods, see CommBank’s guide to scams that target businesses.

The biggest red flag 

Scammers will sometimes create urgency by asking businesses to update payment details immediately but Brown said that isn’t always the case, particularly if they’ve spent time watching conversations first. 

“They are often able to slip in unnoticed without having to add that urgent language because it feels like a normal process or a normal relationship with someone,” she said.

That means one warning sign matters more than almost any other.

“Really, the trick is picking up that change in account detail,” Brown said. “That is a red flag. If you see a change in bank account details or something seems at all different, call the person or company you are paying on a trusted number you already use or have independently sourced – not the one on the invoice – and be sure to verify the specific payment details.” 
 
It’s also important to check payment details over the phone every time you’re paying someone new, Brown said. 

Stop. Check. Reject.

CommBank’s advice is to always stop, check and reject.

• Stop. If an invoice or email asks you to pay a new account or update bank details, take a breath so you can think clearly before you act
• Check. Verify the request by calling the supplier or colleague on a number you already use or have sourced independently, not the one included in the email or invoice
• Reject. If something doesn’t add up, don’t make the payment and report it to your bank 

Brown also recommends:

• Using a payment approval process with more than one approver
• Turning on multi-factor authentication for email accounts as well as banking 

Find out more about scam and cyber security protection for your business.

What to do if your business is caught out

Brown’s advice is to contact your bank straight away if you’ve made a payment you are concerned about.

• CommBank business customers can call 13 1998 and select option 4, or message CommBank in the app. 
• CommBank can’t guarantee funds sent to a scammer can be recovered, but reporting it as soon as possible may help.
• If you think your email account has been compromised, change your passwords.

Learn more about how to report a scam and check the latest scam alerts.