Payment redirection scams target the moment money changes hands. A scammer sends an email that looks like it comes from a supplier, customer or staff member. It asks for an invoice to be paid into a new bank account. Once the money lands, it can be very hard to get back.
Online businesses rely on email for orders, invoices and supplier updates. That makes them an obvious target for this kind of fraud. This guide explains how the scam works and the warning signs to watch for. It also covers simple habits that make a payment much harder to steal.
What a payment redirection scam is
The Australian Cyber Security Centre calls this business email compromise. It describes it as a form of targeted phishing, also known as spear phishing. Criminals pretend to be business representatives or use the hacked email accounts of real employees. Their goal is to get money or goods, or to trick staff into sharing sensitive business information.
A common version involves bank details. An email arrives saying a supplier has changed banks and asks you to update their details. The next invoice then gets paid straight to the scammer. Because the email can come from a real account that has been hacked, it may look completely normal.
How the scam usually plays out
A scammer with access to a hacked inbox can read past emails. That shows them how a business writes, who it pays and when invoices are due. They can then send a request that matches the tone and timing of real invoices. A busy staff member may not look twice.
The centre shares a small business case study about a construction firm. The firm received an email that appeared to come from its supplier with new bank details. Staff paid the invoice without phoning the supplier to check. Another employee paid the same invoice again the next day, and the supplier’s email turned out to have been hacked.
Warning signs to watch for
The Australian Cyber Security Centre lists several signs that could point to business email compromise. Some show up in your own inbox. Others come from people you deal with. Treat any of the following as a reason to stop and check.
- A supplier, customer or colleague says they got an email from you that you did not send.
- An email asks for an invoice payment or a change to bank details.
- Messages warn of strange login activity or password resets you did not expect.
- Emails have been deleted or moved to other folders without your action.
Any payment request that pushes for speed also deserves a second look. A real supplier will understand a short delay while you confirm details. Nobody on your team should be blamed for checking. Make that clear so staff feel safe to pause a payment.
Check bank detail changes by phone
One of the simplest habits is to confirm any change of bank details through a separate channel. Call the supplier on a number you already have on file, not one in the email. Ask them to confirm the new details directly. The firm in the case study skipped this step and paid twice.
Write this check into your payment process so it never depends on memory. Require a second person to approve any new payee or change of details. Keep a record of who called and when. These small steps take minutes and can stop a large loss.
Lock down the email accounts that handle money
Many of these scams start with a hacked email account. The centre recommends turning on multifactor authentication, starting with your most important accounts. It means you need two or more steps to verify your identity before you can log in. Email, banking and accounting logins are good places to start.
Your email provider can help as well. The centre lists your email provider among the places to contact after an email compromise. Your bank, ReportCyber and Scamwatch are on that list too. Save these contacts in your response plan so nobody has to hunt for them under pressure.
Give each staff member their own login rather than sharing one account. Shared accounts make it hard to track activity or spot an intruder. Limit access to only the systems each role needs. Remove access as soon as someone leaves the business.
Outside contractors need care as well. Agencies, bookkeepers and developers may hold logins to your systems. If you are weighing up hiring a digital marketing agency, agree early on how access will be given and removed. Keep a simple list of who can reach what.
Train your team
The centre describes staff as the first line of defence. Training should cover common threats, how to protect the business and how to respond to an attack. It should happen regularly and be part of every new staff induction. A short session on payment scams fits easily into a team meeting.
Written workplace policies make training stick. Put the bank detail check in writing alongside your other staff rules. Many employers already set rules on conduct matters such as employee drug testing, so payment checks can sit in the same handbook. Review the policy once a year.
Have a plan for when something goes wrong
The centre recommends an emergency response plan for cyber incidents. It should cover likely threats, their impact on the business and how you will respond. Include who to contact and how you will keep trading. Keep a hard copy in case your systems go offline.
If you think a payment has gone to a scammer, act quickly. Contact your bank straight away and ask what can be done about the transfer. Then tell the real supplier so they can check their own accounts. Get help from an IT professional or a trusted adviser to secure your systems. You can also report it through ReportCyber, which is run by the Australian Cyber Security Centre.
Protecting your website and customers too
Scammers can also pose as your business to fool your customers. Protect your website login with multifactor authentication or a strong password. Update your website systems and plugins regularly and keep backups. Years of organic SEO work can lose value fast if a scammer takes control of your site.
Your website is also where customers check that they are dealing with the real business. Keep your payment details and contact page accurate and easy to find. Many of the SEO friendly features that help a site rank also help visitors trust it. Clear, consistent details make a fake message easier to spot.
Frequently asked questions
What is business email compromise?
It is a type of targeted phishing where criminals pose as a business or use a hacked staff email account. The aim is to get money, goods or sensitive information. Payment redirection is one form of it.
How can I tell if a bank detail change is real?
Call the supplier on a number you already have on file. Do not use contact details from the email asking for the change. Only update your records once they confirm.
Does multifactor authentication really help?
The Australian Cyber Security Centre recommends turning it on, starting with your most important accounts. It adds an extra step before anyone can log in. That makes a stolen password far less useful on its own.
Who should be trained?
Everyone who handles email, invoices or payments. The centre recommends regular training and including it in new staff induction. Short refreshers keep the topic front of mind.