Tư vấn công nghệ
Fake Supplier Emails: Why Businesses Should Call Back to Verify
When a fake supplier email arrives claiming the supplier has changed its bank account, a small business should phone the supplier on the number it already has on file before sending any money. It takes very little time, yet it breaks most versions of this scam.
This type of fraud is targeting small businesses right here in Melbourne. Scammers don't need to hack a computer or your accounting software. All they need is a convincing email, a plausible reason to hurry, and an accounts person who is used to acting on emails. Plenty of Vietnamese-Australian workshops, restaurants, shops and accounting practices pay suppliers exactly that way.
Key Takeaways
- In late October 2026, a furniture business in Melbourne's Bayside area nearly lost $118,000 to an email impersonating one of its suppliers.
- Victoria Police say they have received 107 reports of this type of scam since July 2026.
- According to the Australian Signals Directorate (ASD), small businesses report an average self-reported loss of $55,400 per cybercrime incident.
- A payment approval process that includes a verification call means one fake email can't cause major damage on its own.
Key points
How does a fake supplier email work?
According to SmartCompany, in late October 2026 a family-run furniture business in Bayside received an email impersonating a supplier it knew well. The email said the supplier had changed bank accounts and asked for an urgent transfer. The amount involved was $118,000.
SmartCompany reported that the business ultimately recovered the $118,000. Not every business is that lucky, though, because money that has already been transferred is often very hard to get back.
Victoria Police say they have received 107 reports of this scam since July 2026. They note that scammers don't only target businesses but also their suppliers. In those cases, the supplier's own mailbox may be compromised and used to send the fake emails.
Fake emails usually share three features:
- Right context: they mention the correct contact name, invoice number or order that is awaiting payment.
- Time pressure: they demand payment the same day, citing an audit, a change of bank or goods about to be held back.
- Only one detail changes: everything stays the same except the bank state branch (BSB) number and the account number.
How costly is this for a small business?
The ASD's Annual Cyber Threat Report 2025-26, summarised by business.gov.au on 28 October 2026, puts the average self-reported loss at $55,400 for small businesses and $141,300 for medium-sized businesses. The report also notes that losses have risen by 45%.
For a small business, $55,400 can equal several months of profit. The Bayside case shows that a single wrong transfer can far exceed that average.
Beyond the money itself, businesses also carry costs that are easy to overlook:
- The debt remains: the real supplier hasn't been paid, so the invoice is still owing.
- Time to respond: dealing with the bank, reporting to police, and reviewing mailboxes and records.
- Disrupted supply: orders may be held while both sides reconcile what happened.
- Business relationships: if your mailbox is used to deceive your customers, your reputation can suffer.
Keep in mind that the ASD figures are self-reported, so they only reflect incidents that were reported. Many businesses don't report near misses or small losses, so actual losses may differ from the published numbers.
What should you check when an email asks to change bank details?
As a general rule, when you receive an unexpected request to change payment details, stop and verify before you transfer anything. Specific checks include:
- Call a saved number: use the number from your contract, an older invoice or your contacts list, never the number in the email you just received.
- Speak to someone you know: talk to the person who usually deals with your business, not just the name given in the email.
- Check the sender's address: compare the domain character by character, as fake addresses often differ by a single letter.
- Match the account name: the new account holder's name should match the supplier's legal name or Australian Business Number (ABN).
- Don't reply to the email to verify: if the supplier's mailbox has been taken over, the scammer will answer for them.
Example (a hypothetical scenario with assumed figures): a restaurant receives an email from its meat supplier announcing a change of bank, with an invoice in the usual format. The bookkeeper phones the saved number and the supplier confirms it hasn't changed accounts at all. A call of around five minutes spares the restaurant from a mistaken transfer.
Why isn't telling staff to be careful enough?
Vigilance depends on each person's memory and mood. At the end of the month, when invoices pile up, the person making payments can easily miss something unusual.
A clearly written process, on the other hand, doesn't depend on whether someone remembers. The Holdrix team often suggests three layers of protection:
- Payment approval rule: every change to account details requires a verification call and sign-off from a second person.
- Approval threshold: any transfer above an amount your business sets needs two approvers.
- Email system review: check two-factor authentication, unfamiliar mail forwarding rules and domain anti-spoofing settings.
That said, no process removes risk entirely. The goal is to make sure a fake email can't, on its own, lead to a large transfer.
Holdrix technology consulting services
How Holdrix works with clients
Where should your business start?
- Build a supplier list: record verified phone numbers and bank details in a separate place, apart from your email.
- Write a one-page rule: state clearly that payment details are never changed without a verification call.
- Set a two-approver threshold: apply it to large transfers.
- Review your mailboxes: turn on two-factor authentication and check for forwarding rules from unknown sources.
- Tell your suppliers: let them know you will always phone to verify any request to change bank details.
When don't you need to invest in more tools yet?
If you only pay a few familiar suppliers each month, the owner makes the transfers personally and always calls to verify, you probably don't need dedicated payment approval software yet. Once invoice volumes grow or several people can authorise transfers, a more structured process and supporting tools become worthwhile.
Frequently Asked Questions
How can you spot a fake supplier email?
A common sign is a request to change bank details combined with pressure to pay urgently. A more reliable approach is to phone the supplier on a saved number rather than judging the email by how it looks.
What should you do if you've transferred money to a scammer's account?
Contact your bank straight away and ask it to block or recall the payment, then report the incident to police. The sooner you report, the better the chance of recovering funds.
Are small businesses really targeted?
Yes. The October 2026 case involving a Bayside furniture business in Melbourne shows that scammers are willing to target family-sized businesses for large sums.
In summary
A fake supplier email does damage when a business trusts the email over a verification call. A clear payment approval process and reviewed mailboxes can significantly reduce that risk.
Holdrix handles the tech, you focus on growth.
Are you paying supplier invoices by email without a verification call? Book a consultation
Is a payment approval process right for your business?
Talk to the Holdrix team for advice and find the right solution for your business.
Where should your business start?
Talk to the Holdrix team for advice and find the right solution for your business.