Social engineering
Business email compromise explained
What business email compromise (BEC) is, why fake invoice emails look genuine, the warning signs Scamwatch lists and the payment checks it describes.
How to protect against business email compromise: what official guidance lists
The checks Scamwatch, ASD and ASIC describe focus on the moment money moves, and on protecting your own mailbox.
- Stop and check any change to payee detailsScamwatch's guidance is to "stop and check any changes to payee information on invoices" before paying.What official sources say about checking
- Call the business on a number you found yourselfScamwatch says to contact the business by phone using a number you have sourced independently, not one in the email.How the check works
- Set a formal process for payment requests and bank-detail changesThe ACSC's small business guide describes a formal process for staff to follow when payment requests arrive or bank details change.Payment redirection controls
- Turn on multi-factor authentication for emailASD's BEC guide describes MFA as "one of the most effective controls you can implement".Protecting your own email
- Remove forwarding rules you don't recognise and review loginsASIC's guidance lists deleting unrecognised email forwarding rules and regularly reviewing login activity.How to check inbox rules in Microsoft 365
- If you've paid, contact your bank straight awayScamwatch and ASIC both list contacting the bank or card provider first, to report it and ask them to stop transactions.The full steps after paying
Based on Scamwatch's BEC page, ASD's BEC guide and Small business cyber security guide, and ASIC's guidance for scammed businesses, checked October 2026.
Key points
- Scamwatch describes business email compromise as scammers impersonating a business you've dealt with and sending an invoice with new payment details, so a legitimate payment goes to them.
- A convincing email isn't proof. Scamwatch notes scammers may copy logos and ABNs, use look-alike addresses and reply in an existing email thread.
- If a business's own mailbox is compromised, criminals can use it to scam that business's customers, which is why official guidance covers email security as well as payment checks.
Business email compromise (BEC) is a scam where criminals pose as a business you already deal with. Scamwatch explains that scammers send an invoice with new payment details, and that the goal is to have you redirect a legitimate payment to them. This guide explains how it works and what official sources say about it.
How business email compromise works
BEC works because the message can look entirely normal. Often the only thing that changes is the bank account.
- Existing threads. Scamwatch notes that a fake email may appear “in the same message thread as the last communication that took place with the real business”.
- Look-alike addresses. Scamwatch warns that scammers may add a single extra letter or number to an email address. See how to check an email’s real sender address.
- Copied details. Scamwatch says scammers may copy logos and ABNs, so a convincing letterhead isn’t proof an invoice is genuine.
A fictional example
A small business has paid a regular supplier, Example Supplies (examplesupplies.example), for years. An email arrives in the usual thread: “Please note our bank account has changed. Use the details below for this invoice.” The tone is right and the invoice number matches. The business pays. Weeks later the real supplier asks why the invoice hasn’t been paid.
Warning signs Scamwatch lists
- “You receive bills unexpectedly for services or products you haven’t ordered.”
- “A vendor or supplier’s payment details change without notice.”
- “The email address or website has a spelling error, or is slightly different to what you normally see.”
ASD’s guide to protecting against BEC adds urgent payment demands, unusual requests from people in authority, and pressure for secrecy or to bypass normal processes. For how AI-generated voices and video are used to impersonate people, see deepfake and voice-cloning scams.
How to check a payment request
- Scamwatch advises people to “stop and check any changes to payee information on invoices”, and to contact the business “by phone using a number you have sourced independently”, not one in the email.
- The ACSC’s small business guide describes introducing “a formal process for staff to follow when payment requests are received or bank details are changed”, and says “the most effective mitigation is to call the sender to confirm they are legitimate”, using contact details from a trusted source rather than the email.
- ASD’s BEC guide describes establishing a process to “verify and validate requests for payment and sensitive information”.
For how businesses turn this guidance into a process, see payment redirection controls for checking invoices.
How to protect your own mailbox
If a business’s mailbox is compromised, criminals can use it to scam that business’s customers.
- ASD’s BEC guide describes multi-factor authentication as “one of the most effective controls you can implement”, and describes SPF and DMARC as “controls designed to detect fake emails”.
- ASIC’s guidance lists deleting any email forwarding rules you don’t recognise, enabling multi-factor authentication and regularly reviewing login activity.
If you use Microsoft 365, see suspicious inbox rules and SPF, DKIM and DMARC. BEC is one form of impersonation; see impersonation scams for others.
If you’ve already paid
Scamwatch’s BEC page and ASIC’s guidance for businesses describe these steps:
- Contact the bank or card provider straight away to report it and ask them to stop transactions (Scamwatch, ASIC).
- Change passwords on devices and online accounts such as banking, email, government and shopping (Scamwatch).
- Get help from IDCARE, which can help make a free plan to limit the damage. ASIC notes it’s free for sole traders and small businesses (Scamwatch, ASIC).
- Report it (see below).
- Warn staff, clients and suppliers to watch for suspicious requests, such as changes to bank details or large transfers (ASIC).
ASD’s BEC guide adds that if email accounts were compromised, the passwords should be changed and affected parties notified. If a mailbox has been taken over, see what to do if an account has been hacked.
Common questions
What is a business email compromise scam?
It’s a scam where criminals pose as a business you already deal with. Scamwatch explains that scammers send an invoice with new payment details, and that the goal is to have you redirect a legitimate payment to them. The email can look entirely normal, and often the only thing that changes is the bank account. See how business email compromise works.
How can I tell if an invoice email is a scam?
A convincing email isn’t proof either way. Scamwatch notes scammers may copy logos and ABNs, use look-alike addresses and reply in an existing email thread. Its warning signs include unexpected bills, a supplier’s payment details changing without notice, and an email address or website that’s slightly different to what you normally see. See warning signs Scamwatch lists.
Should I pay an invoice if the supplier says their bank details have changed?
Scamwatch’s guidance is to “stop and check any changes to payee information on invoices” first. It describes contacting the business “by phone using a number you have sourced independently”, not one in the email. The ACSC’s small business guide also describes a formal process for staff to follow when payment requests are received or bank details are changed. See how to check a payment request.
How do I protect my business email from BEC?
ASD’s BEC guide describes multi-factor authentication as “one of the most effective controls you can implement”, and describes SPF and DMARC as controls designed to detect fake emails. ASIC’s guidance lists deleting email forwarding rules you don’t recognise and regularly reviewing login activity. See how to protect your own mailbox.
What do I do if I’ve paid a fake invoice?
Scamwatch and ASIC both list contacting the bank or card provider straight away to report it and ask them to stop transactions. Their other steps include changing passwords, getting free help from IDCARE, reporting the scam, and warning staff, clients and suppliers to watch for suspicious requests. See if you’ve already paid for the full list.
Where do I report a business email compromise scam in Australia?
The official services are Scamwatch, which takes reports of scams including impersonation of your business, and ReportCyber, which ASIC’s guidance says passes reports to the relevant police jurisdiction. IDCARE offers free support to make a recovery plan (individuals 1800 595 160, small business 1800 595 170). See where to report.
Where to report
- Scamwatch: report the scam, including impersonation of your business.
- ReportCyber: ASIC’s guidance lists reporting cybercrime through ReportCyber, which passes reports to the relevant police jurisdiction.
- IDCARE: free support to make a recovery plan (individuals 1800 595 160, small business 1800 595 170).
Where to report scams and cybercrime in Australia explains each service. For a wider check of a business’s settings, the small business security checklist is a starting point.