Scams Awareness Week runs from 24 to 28 August, and this year’s theme is “No one’s just a number”. The campaign message is Stop, Check, Protect. Stop before sending money. Check the person is who they say. Protect yourself by reporting quickly. It is good advice, and it is aimed squarely at individuals. The scam most likely to take money out of a small business account works differently. Payment redirection scams are not stopped by being more careful.
Payment redirection scams are the ones aimed at businesses
The mechanics are simple. Somebody gets into an email conversation between a business and one of its suppliers, or forges one convincingly. Then an invoice arrives, or a follow-up to one you were already expecting, with a note that the bank details have changed. The work is real. The supplier is real. The invoice often is too. Only the account number is wrong.
Scamwatch puts redirection scams at $166 million in reported losses over the last full year. For comparison, the same page cites romance scams at $139 million and phishing at $97 million. The category built around business payments is the largest of the three. It barely features in public campaigns, because there is no emotional story to tell about a changed BSB.
Why “be alert” does not work here
Alertness catches things that feel wrong. This is engineered to feel routine.
Think about who actually pays your invoices. In most small businesses it is a bookkeeper, an office manager, or the owner doing a batch on a Thursday afternoon. They are processing thirty or sixty payments. They are not the person who has the relationship with that supplier, so they have no baseline for what is normal. A changed account number carries no signal at all.
Telling that person to be more vigilant is asking them to detect something invisible. It also puts the blame in the wrong place when it eventually goes wrong. That is the part of scam advice I find hardest to defend.
The defence is a record, not a reflex
Your suppliers’ banking details are master data. Most businesses do not treat them that way. They live wherever they were first typed, and nobody knows when they were last confirmed. Ask whether the details have changed and there is no answer, because nothing recorded what they were before.
Fixing that is not complicated. Two rules do most of the work.
- A change to banking details is never actioned from the message that requested it. Call the supplier on the number you already held, not one in the email. This single rule defeats the entire scam.
- Record the details and the date they were verified. A column in a spreadsheet is enough. The point is that the details become something with a history, rather than a field that quietly changes.
Your bank now helps as well. Confirmation of Payee checks that the account name matches the account number before a payment goes through. The Australian Banking Association reports it live across more than eighty institutions and over 140 million accounts. The rollout is still completing. A “no match” result is a stop sign. But be clear about the limit: it confirms a name matches an account. It does not confirm that the account belongs to the supplier you think you are paying.
What you can find in your own data
This is the part most scam advice skips. It is where a small business has more of an advantage than it realises. Redirection leaves traces in the ledger. These are questions you can put to your accounting system:
- Which supplier bank details changed in the last ninety days? Most packages keep a contact change history. Almost nobody reads it.
- Was any payee created and then paid within a few days? Legitimate suppliers usually have a quote or a purchase order behind them first.
- Are there invoices sitting just under an approval threshold? If everything needs sign-off above $5,000, an unusual cluster at $4,800 is worth a look.
- Has a regular supplier started invoicing from a slightly different email domain, or with a different invoice number format?
None of these prove anything on their own. Together they are a short monthly exercise that turns an invisible risk into a list you can actually check. It is the same principle as any other report worth having. You are not trying to be clever. You are trying to make one specific question answerable.
What to do this week
While the campaign is running and it is on your mind:
- Write down the rule about verifying account changes by phone, and tell whoever pays your invoices. Ten minutes.
- Check whether your accounting package logs changes to supplier details, and whether anyone has ever looked at that log.
- Confirm your bank has Confirmation of Payee switched on for your business accounts. Make sure the person paying knows what a “no match” means.
- Agree who has authority to approve a change of banking details. In most small businesses the honest answer today is anyone with the login.
Reporting matters too. Scamwatch only sees what gets reported, which is part of why business losses are almost certainly understated. Could you say today where your supplier and payment records actually live, and where they disagree with each other? If not, that is the groundwork a data health check covers. It is worth more here than any amount of extra vigilance.