Business invoice redirection
Hacked email thread where a 'supplier' changes their bank details.
How it works
A scammer compromises a supplier's email and replies in an existing thread with 'updated' bank details. The invoice looks identical, and the next payment goes to the criminal's account.
Common scenarios to watch for
This scam shows up in several different shapes. Recognise the pattern, not just one message.
Supplier email compromise
A real supplier's mailbox is hacked and a reply in an existing thread updates bank details. The next payment goes to the criminal.
"Hi, please note our bank has changed. New BSB 064-xxx Acc 1234xxxx. Use these for all future invoices."
Red flags to spot
- Did the bank details change unexpectedly in an existing email thread?
- Is the new account name slightly different from the supplier's real name?
- Are you being rushed to use the new details for an urgent payment?
- Can you verify the change by calling the supplier on a known number?
Lookalike-domain spoof
Email comes from a near-identical domain (e.g. acme-co.com vs acme.com). Signature, logo and PDF all look right.
"Updated remittance attached — please action by COB to avoid late fee."
Red flags to spot
- Is the sender domain slightly different from the real company (extra hyphen, different TLD)?
- Does the email create urgency around a payment deadline?
- Are the attached invoice details identical to previous ones except bank details?
- Can you verify by contacting the company through their official website?
Conveyancer / settlement redirect
During a property settlement, scammers spoof the conveyancer's email with 'new trust account details' the day before settlement.
"Final settlement details — please transfer the balance to our updated trust account by 10am tomorrow."
Red flags to spot
- Did the trust account details change close to settlement day?
- Is the request coming through email rather than a secure portal?
- Are you being rushed with a tight deadline ('by 10am tomorrow')?
- Can you verify the account directly with your conveyancer via phone?
Red flags
- 🚩Late-stage change of bank details by email
- 🚩Reply-to address differs subtly from the real domain
- 🚩Urgency around end of month / quarter
- 🚩Slight wording change in the email signature
What to do
- 1Always confirm new bank details by phone using a number you already have.
- 2Set a rule: any bank-detail change requires a callback before payment.
- 3Report to your bank and Scamwatch immediately if paid.
Who's targeted
- Small businesses, bookkeepers and accounts-payable teams.
- Companies that pay suppliers by EFT without callback verification.
Why it works
- The hijacked email thread already has trust and history.
- End-of-month pressure encourages quick payment.
Common variations
Different shapes of the same scam — recognise the pattern.
- 1Compromised supplier email replying with 'new bank details'.
- 2Spoofed-domain look-alike (.co vs .com.au).
- 3CEO-fraud email asking for an urgent vendor payment.
If you've already been scammed
- 1Call your bank's fraud team within hours — recall is possible early.
- 2Notify the real supplier — their email is likely compromised.
- 3Report to ReportCyber and ACSC, and trigger your cyber insurance.
Frequently asked
How do I prevent this?▾
Mandatory phone callback for any bank-detail change, using a known number.
Are we covered by insurance?▾
Sometimes — many policies require MFA and callback proof to pay out.
Whose fault is it legally?▾
Usually the paying party loses the funds. Prevention is much cheaper than recovery.
Questions people ask about this scam
- How does the business invoice redirection work?
- A scammer compromises a supplier's email and replies in an existing thread with 'updated' bank details. The invoice looks identical, and the next payment goes to the criminal's account.
- What are the warning signs of a business invoice redirection?
- Watch for: Late-stage change of bank details by email; Reply-to address differs subtly from the real domain; Urgency around end of month / quarter; Slight wording change in the email signature.
- How can I tell if this is a scam?
- Stop and verify independently. Contact the organisation using details you look up yourself, never the ones in the message, and don't act on urgency. You can also paste the message into the ScamShield AI scam checker for a risk assessment — it gives guidance, not a guarantee.
- What should I do if I clicked the link or replied?
- Stop all contact, change the password on any account you logged into and turn on two-factor authentication, and watch your accounts for changes you didn't make. Always confirm new bank details by phone using a number you already have. Set a rule: any bank-detail change requires a callback before payment. Report to your bank and Scamwatch immediately if paid.
- What should I do if I already sent money?
- Contact your bank immediately and ask about stopping or recalling the payment, keep all evidence, then report the scam. Be wary of anyone who later offers to recover your money for a fee.
- Where should Australians report this scam?
- Report scams to Scamwatch (National Anti-Scam Centre), report cybercrime to ReportCyber, forward scam texts to 7726, and contact IDCARE if identity details were exposed. Contact your bank first if money is involved.
General scam awareness information. ScamShield AI cannot guarantee that every scam will be detected or that a message is legitimate.