Email invoice scams are becoming increasingly sophisticated, and they don’t just target businesses. Recently, a Summerland Bank customer lost more than $25,000 after paying what appeared to be legitimate Xero invoices. Criminals had altered the bank account details before the invoices were received. By the time the fraud was identified, the funds could not be recovered.
These scams are known as Business Email Compromise (BEC), and they can affect anyone who receives and pays invoices.
How these scams happen
Criminals use email to pose as trusted businesses, suppliers, or service providers. The emails often look genuine and can be difficult to detect.
There are two common methods.
1. Invoice or payment fraud
Criminals intercept genuine invoices, change the bank details, and resend them. The invoice appears legitimate, but the payment is redirected to a fraudulent account.
2. Business impersonation
Scammers send emails pretending to be well-known organisations. They may use stolen logos or create email addresses that look almost identical to the real ones. For example, replacing letters in a name such as “Summerland” with something similar, like “Sumrnerland”. They often request urgent payment or advise that bank details have changed.
Red flags to watch for
Be cautious if you notice:
- Unexpected changes to bank account details
- Urgent or pressuring payment requests
- Amounts that differ from previous invoices
- Email addresses that look slightly different from earlier correspondence
Even small inconsistencies can be warning signs.
How to protect yourself
- Verify any change to bank details by contacting the business using the details you already have on file
- Visit official websites directly rather than clicking links in emails
- Avoid opening unexpected attachments
- Carefully check email addresses against previous legitimate emails
A quick verification step can prevent significant financial loss.
To read more about current scams, visit Scamwatch or cyber.gov.au, and if you experience cybercrime, you can lodge a report at the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), where it will be referred to the appropriate law enforcement agency. If you’re unsure about a payment or think you may have been targeted, contact us as soon as possible. We are always happy to help. Acting quickly gives the best chance of limiting the impact.
