Supplier changed their bank details by email? Call before you pay.

An email lands from a supplier you've paid a dozen times. The invoice looks right. The logo is right. The only difference is a short note: "Please note our bank details have changed." You pay it. Two weeks later the real supplier rings to ask where their money is, and yours is long gone. This is a payment redirection scam, and it is one of the most common ways small businesses lose money.

The numbers

Scamwatch's Targeting Scams Report puts Australian losses to invoice and payment redirection scams at $166.8 million in 2025. That is not a figure made up of a few giant companies. Sole traders, tradies, cafes, clinics and small offices are hit because they pay invoices by bank transfer, move fast, and don't have anyone whose job is to double-check.

How the scam works

There are two common versions, and they look almost identical from your side of the screen.

1. A fake or spoofed email. The scammer sends an invoice from an address that looks like your supplier's. It might be one letter off (`[email protected]` with a capital I instead of an l) or it might use the same display name as the real contact, so on a phone it looks genuine.

2. A hacked email account. This is the nastier one. The scammer breaks into your supplier's email, or yours, and reads the real conversations. They wait until an invoice is about to go out, then step in with a perfect copy of the genuine invoice and their own bank details. The email comes from the right address, because it really is the right account. They may also set up a hidden rule that deletes your replies so the real supplier never sees your questions.

In both cases the goal is the same: get you to send a payment to an account the scammer controls. Once a bank transfer has gone, getting it back is difficult and often impossible.

Warning signs

• New bank details sent by email. This is the big one. A genuine change of bank account is rare, and it should never be accepted from an email alone.
• Urgency. "Please pay today to avoid a late fee" or "our old account is being closed."
• A sender address that is slightly off, or a reply-to address that differs from the sender.
• The account name doesn't match. Many banks show the account name when you enter the details. If you're paying "Smith Plumbing" and it comes up as a personal name or a company you've never heard of, stop.
• A tone shift. A supplier who normally writes casually suddenly sounds formal, or the other way around.
• Different payment method. A cheque customer suddenly asked to pay by transfer, or a request to pay into a personal account.

Three habits that protect your business

1. Never trust new bank details sent by email alone

If any invoice arrives with different bank details, pick up the phone and call the supplier on a number you already have: from an old invoice, your contacts, or their website typed in by hand. Do not use the phone number in the email, because the scammer can put their own number there too. Ask them to confirm the new details out loud, then record in your notes who you spoke to and when.

It takes two minutes. It is the single most effective control against this scam, and it costs nothing.

2. Look closely at the sender's address

Don't just read the name in the "From" field. Check the full address, and on a phone tap the name to reveal it. Look for swapped or added letters, a different domain ending, or an address that doesn't match earlier emails in the same thread. One wrong letter is a big red flag.

3. Turn on two-step sign-in for your business email

Many of these scams begin with a stolen email password. With two-step sign-in (also called 2FA or multi-factor authentication), a password on its own is no longer enough to get in, because the login also needs a code from your phone. It is free on Microsoft 365, Google Workspace and most other email providers, and it stops the large majority of account takeovers. Turn it on for yourself and for anyone on your team who uses business email.

Small extra habits worth adopting

• Pay by a process, not by a mood. Where you can, have one person enter bank details and another approve the payment.
• Keep a supplier list. Record each regular supplier's bank details and a verified phone number, and treat any difference as a reason to call.
• Check your email rules. In Outlook or Gmail, look for forwarding rules or filters you didn't create. Hackers use these to hide their tracks. Our guide to what to do when your email has been hacked walks through it.
• Make sure your team knows. The person who processes invoices is the target. A short chat once a year, and again whenever someone new starts, makes a real difference.

If you've already paid

Time matters. Do these in order:

1. Call your bank straight away and ask them to contact the receiving bank about a recall. The sooner they hear about it, the better the chance of recovering some of the money.
2. Report it to Scamwatch at scamwatch.gov.au, and to ReportCyber if it involved a business email account being compromised.
3. Secure the email accounts involved. Change the password from a different device, sign out of all sessions, check for forwarding rules and turn on two-step sign-in.
4. Tell your supplier, so they can check whether their email has been compromised too.

How Afford IT can help

If you're a sole trader or a small team without an IT department, email security is usually the thing nobody has time to set up. Our Brisbane techs can check your email accounts, turn on two-step sign-in, look for hidden forwarding rules and set you up with sensible habits, and you don't need a contract to get it done. See our Business IT support pages, including cybersecurity, or grab our free cyber security checklist to see where you stand.

Call 1800 851 816 or get in touch.

Related guides

• Your email has been hacked. Do these things in this order. — the clean-up steps if a scammer got into an account.
• That "Microsoft" popup is lying to you — another scam that tries to make you act before you think.
• Print our one-page scam checklist for the office wall.

Source: Scamwatch, Targeting Scams Report (2025 data), scamwatch.gov.au.