Close calls: what two businesses learned from scam near misses

What can businesses learn from scam near misses?

Scam near misses can reveal gaps in everyday processes, not just technology. Verifying unexpected requests through a trusted channel, adding extra checks around payments and helping staff feel confident speaking up can make it harder for scammers to turn urgency into action.

The scale of the problem is hard to ignore. Australians reported $2.18 billion in scam losses in 2025, according to the National Anti-Scam Centre. For businesses, business email compromise scams remain a major threat, while the average reported cost of cybercrime for a medium-sized business reached $97,166 in FY2024–25.

Here, two CommBank business customers share the moments that helped redefine their security strategies. 

When fake urgency nearly worked 

Leadership coach Anjani Amriit considers herself highly vigilant. But a near-miss proved just how easily even the most tech-savvy leaders can be manipulated by a well-timed attack. “I had a close call recently,” says Anjani. The trap was classic: a spoofed email disguised as a notification from her social media scheduling platform.  

“The email looked completely legitimate. It used the company’s exact branding and logos and warned that my payment had failed. It claimed my account would be suspended and I’d lose years of client data unless I took  immediate action.”  

That “immediate action” is where the trap snaps shut. “My first reaction was pure panic,” she says. “I didn’t want to lose my data so I hovered over the link. But right then, a thought stopped me: ‘Wait, I haven’t checked the actual sender address.’” Anjani closed the tab, inspected the header and recognised the fraud. 

When authority almost overrode the process

For Kim Allen, CEO and  co-founder of CRA Construction, a false sense of urgency was  also the weapon used against  her team. “A new team member  had just processed a $27,000  invoice and uploaded it into our system for my approval,”  says Kim. “Simultaneously, an email arrived using my name, demanding the overdue invoice  be paid ASAP.” 

Driven by a desire to impress  a new boss and quickly resolve a  perceived crisis, the employee rushed to bypass the standard checks. It’s a commonly exploited vulnerability. Research from Macquarie University highlights that scammers routinely deploy social engineering techniques, like impending deadlines or rewards, to deliberately bypass our logical filters.

Turn scam near misses into team learning

James Roberts, executive general manager of fraud and scams at CommBank, notes that business vulnerabilities usually stem from two main psychological traps. “The first is optimism bias – the ‘it won’t happen to me’ mentality. The second is underestimating just how sophisticated these operations are, which leads to a lack of protocol.”  

Since her close call, Anjani says her team has changed tack. “We now talk about scams, not just as a cybersecurity issue but as a human awareness issue.” She’s also made it a priority to create a culture where staff feel empowered to pause when red flags emerge.  

“If something creates a sense of panic or urgency, I encourage people to take a breath, check the details, verify the source independently and to try not to make decisions from a place of pressure,” says Anjani. “But I’m also very aware that it’s not always easy to do in the moment.”

Build verification into everyday payments 

At CRA Construction, Kim has baked healthy skepticism directly into the operational workflow.  “My team now knows they need to review the senders in each email they receive,” she says. The business now promotes a culture of questioning everything – especially if money is involved. Invoices that are over a certain figure are always verified with department leaders. 

These built-in processes may be relatively simple but they ensure financial decisions are being cross-checked. 

Keep scam training current as AI evolves 

While many business owners have a solid understanding of the tactics scammers use, the goal posts are moving due to AI. 

It’s the reason Anjani’s business has renewed its focus on behavioural modifications as well as strengthening her tech safeguards. “The best defence is not just better software but also greater awareness in the team.” 

Anjani has rolled out regular training for staff, as well as clear reminders on what to look out for. She’s also encouraging the team to speak openly about near misses. “It’s critical that we train ourselves and our teams to recognise psychological manipulation. Scammers aren’t just hacking our computers – they’re hacking our emotions.” 

Learn how you can help build a culture of scam safety 

The data reinforces this approach. While AI capabilities can make it harder than ever to spot digital scams, training can hugely improve the ability of employees to respond to threats with a level head. Research by KnowBe4 in 2026, a company that measures the “phish-prone percentage” (PPP) of organisations, found that the average share of employees engaging with simulated phishing tests fell from 33.2% before training to 20.1% after 90 days, and 4.2% after 12 months of ongoing training and testing. 

As Roberts advises: “Make it a regular habit to check the latest fraud alerts and pass that knowledge down. A forewarned team is your best firewall.” 

Ultimately, security is a living business process.

Related articles

• Take our Business Masterclass to learn about phishing scams and how to protect yourself
• Learn more about business email comporomise and how to spot it
• How to help build a culture of scam safety in your business

Published: 23 October 2026