Email Scams
Most of us have had that email. It looks like it’s from a supplier you’ve dealt with for years, the invoice looks right, and it simply asks you to pay into a “new” bank account. It’s one of the most common ways Australian businesses lose money, and it’s getting more costly every year.
The numbers
Australians lost $2.18 billion to scams in 2025, up from $2.03 billion in 2024. Payment redirection scams made up $166.8 million of that, a 9.3% rise on the year before, and the second biggest scam loss after investment scams. The Australian Signals Directorate (ASD) received over 84,700 cybercrime reports in 2024-25, about one every six minutes. The average cost per report was $56,600 for small businesses and $97,200 for medium businesses, a hard hit for most to recover from.
How it happens
Most of these scams arrive by email and typically include requests to add or change payment details or approve transfers. Scammers are patient. They often get into an email account, watch the conversation, then strike at the right moment. These scams can be embedded in existing email trails and timed so they feel routine and normal and catch you off guard.
What to look out for
An invoice or email with different bank details to what you’ve paid before. Email addresses that are almost right, for example john.smith@supplier.com.au vs. jonh.smith@supplier.com.au.
Pressure to pay quickly, especially late in the day or before a weekend. Requests to confirm your login details.
What you can do
Pick up the phone. If you get a request to change payment details, call the supplier directly using the number from your records or the number from their website to verify the new details. Never use the number in the email.
Turn on multi-factor authentication. The ASD says it is one of the most effective controls you can implement to prevent unauthorised access.
Have a clear process. Establish a clear and consistent business process for workers to verify and validate requests for payment and sensitive information.
If it happens to you
- Call your bank straight away.
- Report it at cyber.gov.au/report and to Scamwatch.
- If your email was compromised, the ASD recommends you change your password.
- If you have cyber insurance, notify your insurer immediately using the incident response number in your policy, and let your broker know too.
- You can also contact the ASD Cyber Security Hotline on 1300 292 371.
Talk to your broker about cyber insurance today: www.mga.com
This article contains general information only and does not take into account your objectives, financial situation or needs. Before acting on it, consider whether it is appropriate for you and read the relevant Product Disclosure Statement or policy wording. MGA Insurance Brokers Pty Ltd ABN 29 008 096 277 AFSL 244601.
Sources: National Anti-Scam Centre, Targeting Scams Report 2025 (March 2026), ASD Annual Cyber Threat Report 2024-25, CBA research reported by AAP, ASD cyber.gov.au business email compromise guidance.
