Here's a scam that doesn't feel like a scam, which is exactly why it works. Your bookkeeper gets an email that appears to come from a supplier you pay every month. The logo's right, the invoice looks normal, the tone is familiar. The only difference — buried in the payment section — is a new bank account number, with a line like "please note our updated banking details." She updates it, pays the invoice, and the money lands in a criminal's account. Nobody clicked a dodgy link. Nobody typed a password into a fake website. Somebody just paid an invoice, which is their job.
This is a payment redirection scam, and it is not a fringe problem. According to the National Anti-Scam Centre, payment redirection cost Australians $166.8 million in 2025 — the second-largest category of scam losses in the country, behind only investment scams, in a year where total reported losses hit $2.18 billion. The ACCC has named construction as one of the industries criminals target most, alongside real estate and legal, for the simple reason that these are trades that move large sums between businesses regularly enough that a redirected invoice doesn't stand out. If you run a trade business that pays suppliers and gets paid by clients, you are in the target profile.
How the money actually disappears
There are two versions of this scam, and a trade business can get hit by either.
In the first, you're the one who pays. A scammer either spoofs a supplier's email address — a near-identical address you'd never notice unless you were looking letter by letter — or, worse, has actually broken into the supplier's real email account. From there they send a genuine-looking invoice with their own bank details, or a short note saying the supplier has "changed banks." You pay in good faith. The real supplier never sees a cent, and eventually chases you for an invoice you thought you'd already paid.
In the second, your customer pays the scammer instead of you. If a criminal gets into your email account, they can watch for an invoice you've sent, then email your customer from your real address with a polite correction: "apologies, please disregard the account on the last invoice, here are our updated details." Because it comes from your genuine account, your customer has almost no way to tell. They pay, the money's gone, and now you're in the ugly position of having to ask a client to pay twice for the same job.
Both versions turn on the same weak point: a change of bank details, communicated by email, actioned by a human who was just trying to get through their to-do list.
The one habit that stops nearly all of it
You do not need expensive software to shut this down. You need a rule, applied without exception: no bank account detail is ever created or changed on the strength of an email alone.
Any time an invoice carries new payment details, or an email asks you to update a supplier's account, someone picks up the phone and confirms it verbally — and this is the part that matters — using a number you already had on file, never a number from the email itself. Scammers put their own "accounts department" phone number right there in the fraudulent message, so calling the number in the email just connects you to the criminal, who will happily confirm their own fake details.
Gold nugget. Write down your suppliers' phone numbers now, while nothing's wrong — in your accounting software, on the supplier card, wherever your team will actually look. The whole scam depends on you verifying a bank-detail change using contact information the scammer controls. If your team's instinct when an invoice says "new account" is to ring the number on that invoice, you've built the fraud a front door. If their instinct is to ring the number you saved back when you first onboarded the supplier, the scam dies on the first phone call. That's the entire defence, and it costs nothing.
The controls worth adding around it
The phone-verification rule is 80 per cent of the protection. The rest is making it harder to get into the accounts in the first place, and harder for a single mistake to cost you.
Lock down your email with multi-factor authentication on every account, especially anyone who sends or receives invoices — most business email compromise starts with a password that leaked or got guessed, and MFA stops the login even when the password is known. For larger payments, require two people to approve — a dual-authorisation rule on anything over a set threshold means one distracted person can't move serious money alone. And treat "urgent, pay today, details changed" as a red flag by definition, not a reason to hurry; urgency is the scammer's main tool, because a person in a rush skips the phone call. These sit naturally alongside the other foundations in your service business tech stack — the systems that quietly protect the business are as important as the ones that grow it.
If it's already happened
Speed is everything, because the money moves fast but the banks can sometimes freeze it if you're quick. Call your bank immediately and tell them it's a scam payment — ask them to attempt a recall. Report it to Scamwatch and, if an email account was compromised, to the Australian Signals Directorate at cyber.gov.au. Then check whether the breach is still open: if a scammer was in your email, change the password and force everyone out of active sessions, or they'll simply do it again next week. The ACCC's own framing is worth keeping on the office wall — stop, think, protect: don't rush to act, verify independently, and if money's gone, contact your bank straight away.
The uncomfortable truth is that this scam works best against businesses that are busy and trusting, which is most good trade businesses. The same instinct that makes you reply fast and win the job — act quickly, don't leave people waiting — is the exact instinct a payment redirection scam exploits. The fix isn't to become slow or paranoid. It's to build one small, boring rule into how money leaves the business, so that speed everywhere else doesn't cost you.
If you're not confident the way money moves through your business is protected — who can approve payments, how bank details get changed, where the gaps are — that's part of what the Trade Business Health Check looks at: a fixed-price review of your systems, your numbers and your cash cycle, with a written plan of what to tighten first. Better to find the gap in a review than in your bank statement.