The biggest red flag is a change of bank details — especially by email, especially with urgency. Fake invoice scams often come from a real supplier's hacked mailbox or a lookalike address, so the invoice can look perfect. The single most effective control is simple: verify any new or changed bank details by phoning the supplier on a number you already have, never one in the email.
What it depends on
The full answer depends on your specific circumstances. Here’s what matters.
Where the email came from
Lookalike domains (one letter different) and compromised genuine mailboxes are both common. A genuine sender address does not prove the request is genuine.
Your payment process
A written rule that bank-detail changes need call-back verification and a second approver stops most payment redirection losses.
How fast you act
If you have paid a scammer, contact your bank immediately and report to ReportCyber (cyber.gov.au). Recovery odds fall quickly with time.
The last 10%
What a qualified professional can add
The answer above covers the general position. Here’s where professional judgement — applied to YOUR specific situation — makes the difference.
- Checking whether your mailbox or a supplier's was compromised
- Setting up email authentication (SPF, DKIM, DMARC) and MFA
- Designing payment controls that staff will actually follow
Questions to ask before you engage one
If you decide to engage a professional, these questions help you evaluate whether they’re right for your situation.
Is multi-factor authentication enabled on every email account we use?
Is our domain protected with DMARC so others cannot spoof it?
What is our written process for changing supplier bank details?
What should we do in the first hour if we pay a fake invoice?
Did this answer your question?
General Advice Warning
The information on this page is general in nature and does not take into account your personal objectives, financial situation or needs. It is provided by Global Mutual Funds Pty Ltd (ABN 20 090 555 436, AFSL 222640) and should not be relied upon as a substitute for professional advice. Consider whether the information is appropriate before acting on it. Read our Financial Services Guide.