Fundamentals
Payment redirection fraud: the payment controls official guidance describes
How payment redirection scams get businesses to pay a scammer's account, and the invoice checks Scamwatch, ASD and ASIC describe to catch them.
Where to start: the payment checks official guidance describes
These checks focus on how a payment change is verified, so a payment doesn't depend on someone spotting a fake email.
- Treat any change to bank details as a reason to stop and checkScamwatch's guidance is to "stop and check any changes to payee information on invoices", even when the email looks genuine.Verifying bank detail changes
- Phone the supplier on a number you found yourselfScamwatch describes phoning on a number sourced independently, not one in the email. ASD's guide gives the business's official website as one place to find it.What Scamwatch and ASD describe
- Write down a payment process and a second approverASD's guide describes a formal process for payment requests and bank detail changes. A 2018 Scamwatch alert suggested multi-person approval above a set dollar amount.Process and approvals
- Brief staff on urgency, secrecy and requests to skip the processASD's business email compromise guide lists urgent payment demands and unusual requests from senior people as warning signs, and describes a way for staff to report them.Warning signs ASD lists
- Turn on MFA for the business's own emailASD's business email compromise guide calls MFA "one of the most effective controls you can implement". A taken-over mailbox can send fake invoices to customers.Protecting your own email
- If money has gone, call the bank straight awayScamwatch and ASIC say to contact the bank immediately and ask it to stop transactions, then report the scam and contact IDCARE.Steps if a payment has gone
Based on Scamwatch's business email compromise page, a 2018 Scamwatch alert, ASD's small business and business email compromise guides, and ASIC's guidance for scammed businesses, checked October 2026.
Key points
- Scamwatch notes scammers sometimes add one extra letter or number to an email address so it looks like the real business.
- Scammers also impersonate businesses to their customers. ASIC describes warning customers prominently on the website, app and social media.
- ASIC explains that a small business or sole trader unhappy with its bank's response can complain to the bank, then to the Australian Financial Complaints Authority (AFCA).
Payment redirection fraud, often called a payment redirection scam, happens when a business is tricked into paying money into a scammer’s account, often through an email asking to “update” a supplier’s bank details. Business email compromise explains how the scam works. This guide explains the invoice and payment checks official sources describe for preventing it, and what they say to do if a payment has already gone. It’s an educational summary, not an audit or professional advice.
The idea behind these controls, as ASD’s guide to business email compromise puts it, is “a clear and consistent business process for workers to verify and validate requests for payment”, so a payment doesn’t depend on someone spotting a fake email.
Verifying bank detail changes
- Scamwatch advises people to “stop and check any changes to payee information on invoices” and to contact the business “by phone using a number you have sourced independently”.
- A 2018 Scamwatch alert on business email scams said businesses shouldn’t check changes “just by return email or using other contact details provided”, and suggested they “find older communications” or source contact details independently.
- ASD’s BEC guide describes contacting the person or organisation separately, using contact details verified independently, such as from their official website.
Scamwatch notes that “scammers will sometimes add one extra letter or number to the email address” so it looks like the real business. A fake email can look very close to the real thing, which is why official guidance focuses on how a change is verified rather than on spotting the email.
A formal process and more than one approver
- ASD’s small business guide describes introducing “a formal process for staff to follow when payment requests are received or bank details are changed”.
- The 2018 Scamwatch alert suggested businesses “consider a multi-person approval process for transactions over a certain dollar threshold”.
Urgency and seniority
ASD’s BEC guide lists urgent payment demands and unusual requests from people in authority as warning signs. It describes a reporting process for staff who receive threatening demands for immediate action, pressure for secrecy, or requests to bypass protective processes. The 2018 Scamwatch alert gave examples such as an email impersonating a chief executive asking the accounts team for an urgent transfer to an offshore account, and redirected salary or rental payments.
AI tools can imitate voices. Scamwatch explains this in its guidance on technology and AI; see deepfake and voice-cloning scams.
Telling staff about these scams
The 2018 Scamwatch alert said “all businesses should firstly be aware these scams exist” and that their staff should know about them too. ASD’s small business guide describes training that covers business-specific policies such as verifying invoices (see staff awareness in ASD’s small business guide). ASD’s BEC guide also describes limiting public access to staff contact details, especially in accounts, finance and HR.
Warning customers and suppliers if your business is impersonated
Scammers also impersonate businesses to their customers. ASIC’s guidance describes warning staff, clients and suppliers to look out for suspicious activity, such as “requests to change bank details or for large transfers”, and making warnings to customers “prominent across all your online channels, including your website, app and social media accounts”.
Protecting the business’s own email
If a business’s mailbox is compromised, it can be used to send fake invoices to customers.
- ASD’s BEC guide describes multi-factor authentication as “one of the most effective controls you can implement”, and SPF and DMARC as “controls designed to detect fake emails”.
- ASIC’s guidance lists deleting email forwarding rules the business doesn’t recognise, enabling MFA, and regularly reviewing login activity.
For businesses using Microsoft 365, see Microsoft 365 MFA methods compared. Also see suspicious inbox rules and SPF, DKIM and DMARC.
What Scamwatch and ASIC say to do if a payment has gone to the wrong account
- Contact the bank straight away to report it and ask it to stop transactions (Scamwatch, ASIC).
- Report it to Scamwatch, including any impersonation of the business, and report cybercrime through ReportCyber (ASIC).
- Warn staff, clients and suppliers (ASIC).
- Contact IDCARE, which ASIC notes can help make a plan, free for sole traders and small businesses (ASIC, Scamwatch).
- Secure email accounts, including changing passwords, enabling MFA, signing out of other sessions and deleting unrecognised forwarding rules (ASIC). The 2018 Scamwatch alert also mentioned considering professional IT advice.
These contacts can be recorded in advance in a one-page cyber incident response plan.
ASIC’s guidance also explains that if a business is unhappy with its bank’s response, it can complain to the bank first, and a small business or sole trader that is still unhappy can complain to the Australian Financial Complaints Authority (AFCA).
Common questions
How do I protect my business from payment redirection scams?
Official guidance focuses on how a payment change is verified, rather than on spotting a fake email. ASD’s small business guide describes “a formal process for staff to follow when payment requests are received or bank details are changed”, and Scamwatch’s check is a phone call on a number sourced independently. A 2018 Scamwatch alert also suggested multi-person approval above a set dollar threshold. See a formal process and more than one approver.
How do I check if a supplier’s bank details change is real?
Scamwatch’s guidance is to “stop and check any changes to payee information on invoices” and to contact the business “by phone using a number you have sourced independently”. ASD’s business email compromise guide describes using contact details verified independently, such as from the organisation’s official website. A 2018 Scamwatch alert said changes shouldn’t be checked just by return email. See verifying bank detail changes.
What are the warning signs of a payment redirection scam?
ASD’s business email compromise guide lists urgent payment demands and unusual requests from people in authority as warning signs. It also describes a reporting process for staff who face pressure for secrecy or requests to bypass protective processes. Scamwatch notes that “scammers will sometimes add one extra letter or number to the email address” so it looks like the real business. See urgency and seniority.
Can scammers send fake invoices from my business email?
Yes. If a business’s mailbox is compromised, it can be used to send fake invoices to customers. ASD’s business email compromise guide describes multi-factor authentication as “one of the most effective controls you can implement”, and SPF and DMARC as “controls designed to detect fake emails”. ASIC lists deleting unrecognised forwarding rules and regularly reviewing login activity. See protecting the business’s own email.
What do I do if my business paid a fake invoice?
Scamwatch and ASIC describe contacting the bank straight away to report it and ask it to stop transactions. ASIC’s guidance then lists reporting to Scamwatch and ReportCyber, warning staff, clients and suppliers, contacting IDCARE (free for sole traders and small businesses, ASIC notes) and securing email accounts. See what Scamwatch and ASIC say to do.
Can I complain to AFCA if my bank won’t help after a scam?
ASIC’s guidance explains that a business unhappy with its bank’s response can complain to the bank first. A small business or sole trader that is still unhappy can then complain to the Australian Financial Complaints Authority (AFCA). ASIC’s page on what to do if your business has been scammed sets out the official steps, summarised in what Scamwatch and ASIC say to do.
Where to get official help
- Your bank, on the number on its official website or card, if a payment has gone to the wrong account.
- ASIC’s what to do if your business has been scammed for the full official steps.
- Scamwatch to report the scam, including impersonation of your business.
- IDCARE’s small business line, 1800 595 170, per IDCARE’s contact page.
See where to report scams and cybercrime in Australia for how Scamwatch and ReportCyber differ.