Business Email Compromise: Protecting Your Payments

How Business Email Compromise Scams Work

BEC scams often start with fraudsters gaining unauthorised access to an email account, either yours, a supplier's, or a client's. They then subtly monitor communications, waiting for a high-value transaction, such as a construction payment, a property settlement, or an invoice from a regular supplier. During this crucial period, they step in.

The scammer will typically send an email, often from an address almost identical to the genuine sender (e.g., changing 'company.com' to 'company.co'), or even from the compromised legitimate account itself. This email will contain new payment instructions, usually requesting funds be transferred to a different bank account. Because the email looks so convincing and fits into an ongoing conversation, victims often don't question the legitimacy of the request until it's too late.

Who is Being Targeted?

While large corporations can be targets, BEC scams increasingly prey on Australian small businesses, tradies, property buyers, and even families managing significant expenses. For tradies, it might be a scammer intercepting an invoice from a materials supplier or sending a fake invoice to a client. For families, it could involve fraudulent communication from a conveyancer requesting final settlement funds, or a builder asking for progress payments to a new account.

The common thread is the payment of a substantial sum of money to a party with whom there's an existing, trusted relationship. This trust is then exploited, making these scams particularly insidious and hard to detect without careful verification.

What To Do if You've Paid a Fake Invoice

If you suspect you've been a victim of a payment redirection scam, immediate action is crucial. Time is of the essence in attempting to recover funds. The longer you wait, the less likely it is that your money can be retrieved.

Here's a step-by-step guide:

Immediately contact your bank: Explain what happened. Ask them to recall the payment or freeze the recipient account. Provide them with all transaction details, including the recipient's bank account number, amount, and time of transfer.

Gather evidence: Keep all suspicious emails, bank statements, and any other relevant communications. This evidence will be vital for your bank and for reporting the incident.

Report to ReportCyber: This is the Australian government's service for reporting cybercrime. The information you provide helps authorities track and disrupt cybercriminals.

Change all passwords: If you believe your email account was compromised, change the passwords for that account and any others that share the same credentials. Enable multi-factor authentication (MFA) everywhere possible.

Inform affected parties: If you're a business, notify your clients or suppliers whose communication might have been compromised. Alert them about the scam and advise them to verify payment details for future transactions.

The Role of Banks in Recovery

Australian banks will act quickly once a fraudulent payment is reported. They will attempt to contact the recipient bank to freeze the funds. However, the success of recovery depends heavily on how quickly the report is made and whether the funds have already been moved or withdrawn by the scammer.

It's important to understand that banks generally cannot guarantee fund recovery. If the money has been transferred overseas or withdrawn, it becomes significantly harder to retrieve. While banks will do their best, they are not typically liable for funds lost due to a customer's authorisation of a fraudulent transaction, even if it was based on a sophisticated scam. This is why prevention and rapid response are so critical.

If your bank is unable to recover the funds, you might consider contacting AFCA (Australian Financial Complaints Authority) if you believe your bank did not follow appropriate procedures. However, in many BEC cases, the issue stems from the deceptive nature of the scam, rather than a banking error.

Protecting Yourself and Your Business

The best defence against BEC scams is vigilance and robust security practices. Always verify changes to bank details, especially for large payments. A simple phone call to a known, verified number (not one provided in a suspicious email) can prevent significant financial loss. Implement two-factor authentication on all your email accounts.

Educate your staff and family members about these types of scams. Foster a culture of scepticism when it comes to financial requests via email. If something feels even slightly off, question it. Remember, it's always better to be safe than sorry when dealing with payments. When something goes wrong online and you need urgent support, KNOMI is who you call for expert guidance and calm assistance.

Frequently asked questions