It doesn’t take malware or a master hacker. The most expensive attacks on Australian businesses often start with a single, believable email — and one busy person paying an invoice that was never real. Here’s how business email compromise (BEC) works, and how to shut it down.

The numbers you should know

Australia’s national cyber agency (ASD) received a cybercrime report on average every 6 minutes in 2024–25 — over 84,700 reports for the year. Business email compromise is consistently among the top causes of financial loss for businesses.

Source: Australian Signals Directorate, Annual Cyber Threat Report 2024–25.

How the invoice scam works

Attackers watch or spoof an email conversation, then step in at the right moment: “Here’s our updated invoice — note our new bank details.” Because it looks like a supplier (or your boss) you already trust, it sails past suspicion. By the time anyone checks, the payment is gone.

Convincing email

Fake / altered invoice

Verify by phone

MFA everywhere

5 ways to spot a fake invoice

• Changed bank details — always confirm by phone on a number you already have, never one from the email.
• Urgency & secrecy — “pay today”, “keep this between us”, “I’m in a meeting” are classic pressure tactics.
• Look-alike domains — one swapped letter (comstel vs cornstel) is easy to miss at a glance.
• Details that are slightly off — logo, layout, wording or amounts that don’t match past invoices.
• Reply-to mismatch — the reply address is different from the sender’s display name.