Security
The Scam That Actually Targets Small Business Is an Invoice
Most cyber security advice aimed at small business is about passwords and antivirus. The scam that takes the most money from businesses goes around both.
In 2025, payment redirection scams cost Australians $166.8 million — second only to investment scams (ACCC Targeting Scams, published 30 March 2026).
It does not look like a scam. It looks like an invoice from a supplier you already use, inside an email thread you are already replying to.
Key Takeaways
- Australians lost $2.18 billion to scams in 2025 across 481,523 reports, of which 274,577 involved financial loss.
- Payment redirection accounted for $166.8 million — the second largest loss category after investment scams ($837.7 million).
- Phishing was the most-reported type, with 65,361 reports and $97.6 million in losses.
- The usual way in is taking over one side's mailbox, or spoofing the address by changing as little as one letter.
The total is down 29.7% from the 2022 peak of $3.1 billion, but 2025 was still 7.8% higher than 2024. Interception is working at scale; it is not yet working at the scale of one business.
Where the Money Actually Goes
Reading the loss categories is useful for one reason: the largest ones are not technical attacks. They are abuses of a process that is running normally.
Investment scams lead at $837.7 million. Payment redirection is second at $166.8 million. Romance scams are $139.9 million and phishing $97.6 million. The top five categories account for around 60% of all losses.
For a business that pays supplier invoices every week, the second category is the one that matters.
How It Works
As Scamwatch describes it, the scammer impersonates a business or one of its employees by email, then asks for an upcoming payment to be redirected to a different account (Scamwatch).
There are two ways in. One is taking over the mailbox on either side, then reading quietly until a large enough payment is due. The other is spoofing the address, changing as little as one letter so a glancing eye does not catch it.
What makes it work is the timing. The payment is real, the supplier is real, the job is real. Only the account number is new.
This is why antivirus does not stop it. There is no malicious file. There is one changed line of text.
How we build processes with an audit trail
Four Checkpoints That Stop It
These sit inside your payment process, not inside software.
1. Bank details change by phone only
Any change of bank details gets confirmed by a call to a number you already held — never the number in the email that asked. Make this a rule, not a suggestion.
2. Two people on a large payment
Set an amount, and above it a second person approves. The exact threshold matters less than having one.
3. Match to the order, not to the email
The invoice should match a purchase order or a job record in your own system. If it only matches an email, you are verifying against the thing that may already be compromised.
4. Two-factor on the mailbox
Most of these begin with a compromised mailbox. Two-factor authentication on email costs close to nothing, and it closes the door most of these come through (ASD guidance).
The first three cost nothing. They cost the effort of writing them down and agreeing on them.
Common blockers in SME operations
When This Is Not Your Biggest Risk
If your business barely pays supplier invoices — a retail operation taking cash and card with few inbound costs, say — your risk profile is different. Phishing aimed at staff and customers deserves the attention instead.
And one thing worth saying plainly: none of the checkpoints above requires you to buy anything. If someone is selling you a product for this before those four are in place, the order is backwards.
Frequently Asked Questions
Can the bank recover the money if we have already paid?
Sometimes, and the chance is highest in the first few hours. Call the bank the moment you suspect it, before you start working out what happened. Report it to Scamwatch afterwards.
We are small. Why would a scammer bother with us?
Because they did not pick you first. They take a mailbox, then read it to see what is worth taking. The size of the business is not the filter — the size of the next payment is.
The Short Version
The scam that takes the most money from small businesses defeats no technical control. It walks through your payment process at the moment that process is running normally. Fix the process first, then think about tools.
Holdrix handles the tech, you focus on growth.
Want your payment process looked over? Book a consultation.
Is your payment process secure enough?
Talk to the Holdrix team for advice and find the right solution for your business.