Invoice and payment redirection fraud
4 min readReviewed October 2026 · Internet Safety Australia Editorial Team
In short
- Any email announcing new bank details gets verified by phone — on the number you already had.
- The email can be genuinely from the supplier (their account was hacked) — the sender is not proof.
- One verification habit, zero exceptions, saves the average loss of tens of thousands.
The setup: criminals hack or spoof a supplier’s email, watch the conversation, and at invoice time send “our bank details have changed”. Sometimes the email genuinely comes from the supplier’s real address — because the supplier was compromised. Your business pays the fake account, and the money is gone overseas within hours.
The controls that stop it
- Phone-verify every bank-detail change using the number in your existing records — never one from the email
- Two-person approval for payments above a set threshold
- PayID name-check on every new payee: read the registered name before confirming
- Treat “urgent” payment requests from executives as suspicious by policy — verify by a second channel
- MFA on all business email accounts, so your own account can’t be the one that’s hijacked
If you’ve paid a redirected invoice
Call your bank immediately — recalls within hours sometimes succeed. Report to ReportCyber (1300 CYBER1) and Scamwatch, and tell the supplier their email is likely compromised.
Common questions
Where to report this
Report to ReportCyber
Cybercrime: identity theft, online fraud, hacked accounts or devices, ransomware and online threats.
Go to ReportCyber (leaves our site — official service)Report to Scamwatch
All types of scams — phishing, investment, romance, shopping, impersonation. Reports help track and disrupt scam activity.
Go to Scamwatch (leaves our site — official service)Official sources for this guide
- cyber.gov.au — business email compromise (leaves our site — official service)
- Scamwatch — false billing (leaves our site — official service)
Reviewed October 2026 by Internet Safety Australia Editorial Team. Internet Safety Australia is independent and not a government website.