The invoice that changed banks: anatomy of a payment-redirection scam
Payment redirection scams explained: how criminals swap a supplier's bank details via a hacked inbox, the six stages, and the checks that stop invoice fraud.
No malware, no ransom note, no drama — just an invoice with new bank details, paid without a second thought. Payment redirection is the quietest way Australian businesses lose six figures. Here's exactly how it unfolds.
The Australian Signals Directorate's threat reporting consistently ranks business email compromise among the costliest cybercrimes for Australian business — self-reported losses in a recent year came in at almost $84 million, and payment redirection is its signature move. What makes it dangerous is how ordinary every step looks. Walk through the anatomy and you will see why process, not just technology, is the fix.
How does a payment redirection scam work?
A payment redirection scam is invoice fraud in which a criminal, working from a hacked or spoofed email account, changes the bank details on a genuine payment so your money lands in their account instead of your supplier's. It unfolds in six ordinary-looking steps, starting weeks before any money moves:
One mailbox falls.
A phished password, no MFA — often not even your mailbox, but a supplier's or a conveyancer's. The attacker logs in quietly and does nothing conspicuous.
They read, and wait.
For weeks the attacker studies the mailbox: who invoices whom, for how much, in what format, with what sign-off. An inbox rule quietly forwards or hides relevant threads so the owner notices nothing.
They pick the moment.
The best moment is a genuine, expected, large payment — a settlement, a deposit, a project progress claim. The victim is already intending to pay.
The switch.
A real invoice is intercepted and re-sent with one change: the bank details. Or an email "from" the known contact — the real thread, the real style, sometimes the real mailbox — advises the account has changed.
The money moves, then vanishes.
Funds land in a mule account and are dispersed within hours. Recovery is possible only if the bank is alerted almost immediately — after a day or two, it is largely gone.
Discovery comes weeks later.
The supplier chases the unpaid invoice; both sides realise the payment went elsewhere; and two businesses that did "nothing wrong" begin an argument about who wears the loss.
Why do smart people fall for it?
Because nothing in the scam looks unusual. The email comes from a real thread with a real history at a plausible moment. There is no dodgy link and no attachment — nothing for spam filters or instincts to catch. And when the attacker does write a fresh message, AI now makes it word-perfect, which is why the old spot-the-typo advice no longer works. Deepfake voice, which we covered in the $25M phone call, is now used to "confirm" changes when victims do try to check. The defence has to assume the email channel itself is compromised.
How can a business stop invoice fraud?
Process stops it. For any Australian business that pays suppliers by bank transfer, Key IT recommends a short list of unbreakable habits, backed by technical safeguards that catch a compromised mailbox early:
Out-of-band verification, without exception.
Any change to a supplier's bank details is confirmed by phone on a number you already had — never one from the email. One habit, most of the risk gone.
MFA on every mailbox
yours and, contractually, your key suppliers'. The scam starts at the weakest inbox in the chain, which is exactly why MFA is a core Essential Eight control.
Mailbox-rule monitoring.
New forwarding rules and sign-in anomalies are the early fingerprints of a compromised account — exactly what 24/7 SOC monitoring is designed to catch.
Email authentication (DMARC)
makes your domain hard to spoof, protecting your clients from "you" asking them to pay elsewhere.
Two-person payment approval
over a set threshold — a second pair of eyes at the exact moment it matters.
Staff who know the pattern.
A free phishing simulation demo shows how your team responds to a convincing fake, and a free dark web scan reveals which work email addresses have already turned up in known breaches — leaked passwords are a common way a mailbox falls.
Frequently asked questions
Is payment redirection the same as business email compromise?
Not quite. BEC is the broader crime: a criminal hijacks or impersonates a business email account. Payment redirection is its classic payday — the "our bank details have changed" message that diverts a real payment. Lock down every mailbox in the chain and you take away the attacker's favourite tool.
How do we spot a fake change of bank details email?
Any request to change where you pay is the first red flag, especially just before a large payment. Others: pressure to pay today, a request to keep it quiet, an account in a different name or at a different bank, a sender address one character off, or replies going somewhere unfamiliar. One flag is enough to pick up the phone.
If we pay a fraudulent invoice, can the bank recover it?
Only if you act immediately — call your bank the moment the fraud is suspected, and report via ReportCyber. Recovery odds fall from possible to poor within about 48 hours.
What should we do straight after a redirected payment?
Phone your bank's fraud line and lodge a ReportCyber report at cyber.gov.au, then turn to the mailbox that let it happen: reset the password, sign out every session and delete any rogue forwarding rules. Tell the real supplier by phone and keep every email as evidence. Our incident response team can lead the clean-up.
Who legally wears the loss — us or the supplier?
It is genuinely messy and often litigated: courts weigh whose systems were compromised and who failed to verify. Assume you cannot rely on recovering from the other party — prevention is the only clean answer.
Would our insurance cover a redirected payment?
Social-engineering fraud cover exists but is often a sub-limited optional extra with verification conditions attached — check the policy wording now, not after. Our renewal checklist covers what insurers expect.
What's the one process change to make this week?
Write the rule into your payments procedure: bank detail changes are only actioned after voice confirmation on a known number, and staff are praised — never hurried — for holding a payment to check.
Does Confirmation of Payee stop payment redirection?
Not on its own. Rolled out from July 2025 and now live at participating Australian banks, Confirmation of Payee checks the name you enter against the account when you add a new payee or edit one. Treat "no match" as a hard stop, whatever excuse comes with it, and still ring the supplier on a number you already had.
Tighten the chain
We harden the whole path — mailboxes, monitoring, DMARC and payment process — for Melbourne finance and legal firms especially, because that is where the largest payments live. If your business moves big money on email instructions, talk to us before someone else's email does. And if you are not sure where your own chain is weakest, a cybersecurity health check will show you in plain English.
More insights
The $25M deepfake phone call
AI voice cloning lets scammers fake your voice to authorise payments. Here's how Melbourne…
Read article →PrivacyAustralia's new privacy tort
Australia's statutory privacy tort lets people sue any business, however small, over a serious…
Read article →AISearchLeak: the one-click Microsoft 365 Copilot flaw
SearchLeak (CVE-2026-42824) was a one-click Microsoft 365 Copilot vulnerability that could leak…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.