An invoice arrives from a supplier you know. The logo is right, the amount looks reasonable and the email appears to have come from the usual contact.
There is just one difference. The bank account details have changed.
Would someone in your business notice before the invoice was paid?
Fake invoices and payment redirection scams can be difficult to identify because the invoice itself may look completely legitimate. Criminals can impersonate a supplier, use an email address that closely resembles the real one or gain access to a genuine email account. In some cases, they can insert themselves into an existing email conversation.
The risk is significant for Australian businesses. In the 2024 to 2025 financial year, business email compromise involving financial loss accounted for 15 per cent of the top self reported cybercrime threats affecting Australian businesses. The average reported cost of cybercrime for a small business was $56,571.
Having the right checks around invoices, supplier information and payments can help reduce that risk.
Your First Class Accounts bookkeeper already works with the financial records and processes behind many of these transactions. They can help you review how invoices and supplier information are handled and identify areas where stronger financial controls may be appropriate.
Why a fraudulent invoice can be difficult to spot
A common form of invoice fraud is payment redirection.
A criminal may gain access to a supplier’s email account or create an email address that closely resembles it. They then send an invoice or payment request containing different bank details.
The business receiving the invoice believes it is paying a genuine supplier. By the time anyone discovers the supplier has not received the payment, the money may already have been transferred elsewhere.
Scamwatch warns that fake invoices can contain genuine business logos and ABNs and may even appear within an existing email conversation.
This is why relying on an invoice looking familiar is not enough.
It is also why invoice checking should form part of an established financial process. Speak with your First Class Accounts bookkeeper about how supplier invoices currently move through your business and whether there are points in that process that deserve an additional check.
Changed bank details should trigger another check
A supplier advising that their bank account details have changed deserves particular attention.
Scamwatch recommends checking payment details directly with the business using independently sourced contact information rather than relying on the contact details contained in the email requesting the change.
The important part is making sure your business has an agreed process for what happens when supplier payment information changes.
Who updates the details?
Who confirms that the request is genuine?
Is there a record showing that the change was checked?
Who can then approve the payment?
Your First Class Accounts bookkeeper can help you review how supplier details are currently maintained within your bookkeeping system and discuss an appropriate process for recording and verifying changes before payments are processed.
Who can create, change and approve payments?
The way financial responsibilities are allocated within a business can also affect the level of protection around payments.
If the same person can create a new supplier, alter supplier information, prepare a payment and approve that payment without another person reviewing the transaction, there may be fewer opportunities for an unusual change to be identified.
The appropriate approval process will depend on the size and structure of the business. Some businesses may require additional approval for larger transactions, new suppliers or payments where bank information has recently changed.
This does not need to mean adding unnecessary administration to every invoice. The objective is to have controls that reflect how your business operates and the level of risk associated with different transactions.
Your First Class Accounts bookkeeper understands how financial information moves through your business. Ask them to review your current bookkeeping and payment processes with you and discuss whether responsibilities and approval points are appropriately structured.
Review access to your accounting software
Your accounting software contains important financial information about your customers, suppliers and transactions.
Over time, it is easy for user access to become outdated. Employees change roles, people leave the business and external advisers may no longer require the same level of access.
Permissions should reflect what each person actually needs to do.
Individual user accounts are also preferable to shared logins because they make it easier to control permissions and understand which user completed a particular action.
Multifactor authentication provides another layer of protection for important business accounts. At First Class Accounts, we always recommend multifactor authentication as an important measure for protecting business systems and accounts.
You do not need to work through your accounting software permissions alone. Your First Class Accounts bookkeeper can help you review who has access to your bookkeeping system, whether those permissions remain appropriate and which accounting software security features are available to your business.
Make suspicious transactions easier to question
People involved in processing invoices and payments need to know what should receive additional attention.That may include:
- A supplier advising that their bank account details have changed.
- An unexpected invoice from a familiar supplier.
- A payment request that differs from the supplier’s usual arrangements.
- An email address that looks slightly different from the one normally used.
- A request to make an unusually urgent payment.
- An unexpected request from an owner or manager to transfer funds.
- An invoice that does not match a purchase, order or service the business was expecting.
Scamwatch’s current guidance for small businesses identifies invoices and business email compromise among the common scams businesses should watch for.
The important part is having a process that gives employees permission to stop and check before proceeding.
If several people are involved in accounts payable, your First Class Accounts bookkeeper can help you establish a consistent bookkeeping process so everyone understands what information should be checked and when something should be referred for further verification.
Keep supplier records accurate
Accurate supplier records make it easier to identify information that does not match what your business already holds.
Duplicate suppliers, outdated contact details or inconsistent information can make that more difficult.
Your bookkeeping system should provide a reliable financial record of the businesses you deal with and the transactions associated with them.
This is an area your First Class Accounts bookkeeper can manage with you. Regularly maintaining supplier information, reviewing duplicate records and keeping bookkeeping data current can make it easier to identify unusual changes when they occur.
Scamwatch also recommends businesses consider electronic invoicing as one way to reduce exposure to fake invoice scams. Electronic invoicing allows invoices to move directly between compatible accounting systems rather than being sent as attachments through email.
If you are interested in electronic invoicing, speak with your First Class Accounts bookkeeper about whether your accounting software supports it and whether it is suitable for your business.
What if you think a fraudulent invoice has already been paid?
If you believe money has been transferred as the result of a fraudulent invoice, acting quickly is important.
Contact your bank or financial institution immediately and explain what has happened.
The genuine supplier should also be contacted using independently verified contact details, particularly if there is a possibility that their email account or your own business email has been compromised.
The incident can also be reported through Scamwatch and ReportCyber.
Would your current payment process catch it?
A fraudulent invoice may not look fraudulent.
It could carry the right logo, use familiar language and arrive at exactly the time you were expecting to receive it.
That means protecting your business also depends on what happens before the payment is approved.
Who can change supplier details? How are those changes checked? Who reviews invoices? Who approves payments? Who has access to your accounting software?
These are important financial processes, and they are worth reviewing before a problem occurs.
Speak with your local First Class Accounts bookkeeper about your current bookkeeping, supplier and payment processes. They can help you identify where additional financial controls may be appropriate and ensure the systems supporting your day to day bookkeeping are working the way your business needs them to.
