Scams targeting small business in Australia right now
Got a strange invoice or text? Check it against our live list of current scams. Our free plan also sends plain-English scam alerts filtered by your country, bank and industry.
A strange invoice is worth five minutes. Here is how to spend
Most scams aimed at small businesses depend on one thing: you acting before you check. A short pause is usually all it takes.
Before you pay, click or reply, look at who really sent it. Compare the account details with an invoice you have paid before.
If anything looks different, contact the sender using a phone number you already have, not one in the message.
Then look it up on our live scam list. If it matches something we are already tracking, you will see the warning signs and what to do next.
Photo by Jan Andrea Lievens on Wikimedia Commons (Public domain)
Four scams targeting small business in Australia, and their warning signs
Pick the one that looks like the message in front of you. Each tab covers what to look for and what to do.
Invoice and payment redirection
Warning signs: an email saying a supplier has new bank details, an invoice that looks right but carries a different BSB or account number, or pressure to pay today. The sender address may be one letter off the real one. What to do: do not pay yet. Call the supplier on a number from your own records and confirm the details. Check them against an earlier invoice. If you have already paid, call your bank straight away.
Bank or ATO impersonation
Warning signs: a text or email saying your account is locked, a payment failed or you owe tax, with a link to sign in. Threats of penalties and requests to pay with gift cards or cryptocurrency are strong warning signs. What to do: do not use the link. Open your banking app yourself, or type ato.gov.au or my.gov.au into your browser. To speak with your bank, use the number on its website or the back of your card.
Fake suppliers
Warning signs: an invoice for goods you never ordered, a directory listing or domain renewal you did not ask for, or a new supplier whose ABN does not match their business name. What to do: match every invoice to a real order before paying. Look the supplier up on ABN Lookup at abr.business.gov.au. If something does not line up, put the invoice on hold until you have spoken to the supplier.
Phishing logins
Warning signs: an email asking you to sign in to Microsoft 365, Xero or a shared document, a mailbox-full warning, or a login page with an unusual web address. What to do: close the email and go to the service directly. If you typed your password into a link, change it now and turn on multi-factor authentication. Check your mailbox for forwarding rules you did not set up.
Set up free scam alerts in a few minutes
No software to install. You choose what applies to your business and we do the watching.
Create a free account
Sign up on the free plan. Scam alerts are included, along with website uptime checks, due-date reminders and a weekly digest.
Choose your country, bank and industry
These three settings decide which scams you hear about. Your bookkeeper or office manager can set it up for you.
Read alerts in plain English
When a scam aimed at businesses like yours appears, the alert explains what happened, why it matters and what to do next.
Look back when you need to
Your alert history stays available for 90 days, so you can check whether that odd invoice matches something we warned about.
Questions owners ask about business scams
Frequently Asked Questions
- What scams are targeting small businesses in Australia right now?
- The list changes week to week, so we keep it live on our scams page. Most fall into four shapes: invoice and payment redirection, bank or ATO impersonation, fake suppliers and phishing logins. The tabs above cover the warning signs for each.
- Are scam alerts really free?
- Yes. Scam alerts for your country, bank and industry are part of the free plan. Paid add-ons, from a few dollars a month, cover other things such as lookalike domains and supplier ABN changes. Prices are on our pricing page.
- How do you decide which alerts I get?
- You choose your country, your bank and your industry when you set up your account. We only send scam alerts that match those settings, so a café is not sent warnings meant for accountants.
- Can scammers send email that looks like it comes from my business?
- They can if your email security records are missing or weak. Our email spoofing page explains how to check SPF, DKIM and DMARC with our free email security checker, and what to fix.
- What is the difference between phishing and business email compromise?
- Phishing tricks someone into clicking a link or entering a password. Business email compromise uses a real or lookalike business email address to ask for payments to a new account. Our glossary explains both.
- Should I report a scam if I did not lose any money?
- Yes. Scamwatch accepts reports whether or not you lost money, and every report helps warn other businesses. It only takes a few minutes at scamwatch.gov.au.