No malware, no ransom note, no drama — just an invoice with new bank details, paid without a second thought. Payment redirection is the quietest way Australian businesses lose six figures. Here's exactly how it unfolds.
The Australian Signals Directorate's threat reporting consistently ranks business email compromise among the costliest cybercrimes for Australian business — self-reported losses in a recent year came in at almost $84 million, and payment redirection is its signature move. Scam reports point the same way: payment redirection drew $166.8 million in reported losses during 2025, more than any scam type except investment scams, according to the ACCC's release on the National Anti-Scam Centre's Targeting Scams Report. What makes it dangerous is how ordinary every step looks. Walk through the anatomy and you will see why process, not just technology, is the fix.
How does a payment redirection scam work?
A payment redirection scam is invoice fraud in which a criminal, working from a hacked or spoofed email account, changes the bank details on a genuine payment so your money lands in their account instead of your supplier's. It unfolds in six ordinary-looking steps, starting weeks before any money moves:
One mailbox falls
A phished password, no MFA — often not even your mailbox, but a supplier's or a conveyancer's. The attacker logs in quietly and does nothing conspicuous.
They read, and wait
For weeks the attacker studies the mailbox: who invoices whom, for how much, in what format, with what sign-off. An inbox rule quietly forwards or hides relevant threads so the owner notices nothing.
They pick the moment
The best moment is a genuine, expected, large payment — a settlement, a deposit, a project progress claim. The victim is already intending to pay.
The switch
A real invoice is intercepted and re-sent with one change: the bank details. Or an email "from" the known contact — the real thread, the real style, sometimes the real mailbox — advises the account has changed.
The money moves, then vanishes
Funds land in a mule account and are dispersed within hours. Recovery is possible only if the bank is alerted almost immediately — after a day or two, it is largely gone.
Discovery comes weeks later
The supplier chases the unpaid invoice; both sides realise the payment went elsewhere; and two businesses that did "nothing wrong" begin an argument about who wears the loss.
Why do smart people fall for it?
Because nothing in the scam looks unusual. The email comes from a real thread with a real history at a plausible moment. There is no dodgy link and no attachment — nothing for spam filters or instincts to catch. And when the attacker does write a fresh message, AI now makes it word-perfect, which is why the old spot-the-typo advice no longer works. Deepfake voice, which we covered in the $25M phone call, is now used to "confirm" changes when victims do try to check. The defence has to assume the email channel itself is compromised. Texts are no safer: scammers copy genuine business sender names so their fakes land in the same thread as real messages, which is why, since 1 July 2026, texts from names not on Australia's SMS Sender ID Register show as ‘Unverified’.
How can a business stop invoice fraud?
Process stops it. For any Australian business that pays suppliers by bank transfer, Key IT recommends a short list of unbreakable habits, backed by managed email security and other technical safeguards that catch a compromised mailbox early:
Out-of-band verification, without exception
Any change to a supplier's bank details is confirmed by phone on a number you already had — never one from the email. One habit, most of the risk gone.
MFA on every mailbox
Yours and, contractually, your key suppliers'. The scam starts at the weakest inbox in the chain, which is exactly why MFA is a core Essential Eight control.
Mailbox-rule monitoring
New forwarding rules and sign-in anomalies are the early fingerprints of a compromised account — exactly what 24/7 SOC monitoring is designed to catch.
Email authentication (DMARC)
Makes your exact domain hard to forge, protecting your clients from "you" asking them to pay elsewhere. It won't stop a hijacked mailbox, whose mail genuinely passes, so pair it with the habits above; SPF, DKIM and DMARC explained covers the setup.
Two-person payment approval over a set threshold — a second pair of eyes at the exact moment it matters.
Staff who know the pattern
A free phishing simulation demo shows how your team responds to a convincing fake, and a free dark web scan reveals which work email addresses have already turned up in known breaches — leaked passwords are a common way a mailbox falls.
Frequently asked questions
Is payment redirection the same as business email compromise?
Not quite. BEC is the broader crime: a criminal hijacks or impersonates a business email account. Payment redirection is its classic payday — the "our bank details have changed" message that diverts a real payment. Lock down every mailbox in the chain and you take away the attacker's favourite tool. Our plain-English cyber security glossary defines both terms, along with DMARC and MFA.
How do we spot a fake change of bank details email?
Any request to change where you pay is the first red flag, especially just before a large payment. Others: pressure to pay today, a request to keep it quiet, an account in a different name or at a different bank, a sender address one character off, or replies going somewhere unfamiliar. One flag is enough to pick up the phone.
If we pay a fraudulent invoice, can the bank recover it?
Only if you act immediately — call your bank the moment the fraud is suspected, and report via ReportCyber. When the Australian Federal Police reported in September 2023 that it had returned $45 million to Australian businesses targeted by cyber criminals over three years, it said the victims who got some or all of their money back had contacted ReportCyber and their bank as soon as they realised, usually within 24 hours.
What should we do straight after a redirected payment?
Phone your bank's fraud line and lodge a ReportCyber report at cyber.gov.au, then turn to the mailbox that let it happen: reset the password, sign out every session and delete any rogue forwarding rules. If it's a Microsoft 365 mailbox, our first-hour checklist for a hacked Microsoft 365 account covers the steps people miss, such as hidden inbox rules and attacker-added MFA methods. Tell the real supplier by phone and keep every email as evidence. Our incident response team can lead the clean-up.
Who legally wears the loss — us or the supplier?
It is genuinely messy and often litigated: courts weigh whose systems were compromised and who failed to verify. From 31 March 2027, most Scams Prevention Framework obligations on banks, telcos and digital platforms take effect, but as our small business guide to the Scams Prevention Framework explains, it is not a refund guarantee and email isn't one of the covered sectors. Assume you cannot rely on recovering from the other party — prevention is the only clean answer.
Would our insurance cover a redirected payment?
Social-engineering fraud cover exists but is often a sub-limited optional extra with verification conditions attached — check the policy wording now, not after. Our renewal checklist covers what insurers expect.
What's the one process change to make this week?
Write the rule into your payments procedure: bank detail changes are only actioned after voice confirmation on a known number, and staff are praised — never hurried — for holding a payment to check.
Does Confirmation of Payee stop payment redirection?
Not on its own. Rolled out from July 2025 and now live at participating Australian banks, Confirmation of Payee checks the name you enter against the account when you add a new payee or edit one. Treat "no match" as a hard stop, whatever excuse comes with it, and still ring the supplier on a number you already had.
Tighten the chain
We harden the whole path — mailboxes, monitoring, DMARC and payment process — for Melbourne finance and legal firms especially, including conveyancing practices handling settlements, because that is where the largest payments live. If your business moves big money on email instructions, talk to us before someone else's email does. And if you are not sure where your own chain is weakest, a cybersecurity health check will show you in plain English.
Would your team spot the next one? A free phishing simulation demo shows, safely, how many of your team would click.
Request the Free Demo