Melbourne CBD, Victoria · Operating Australia wide
Invoice fraud and payment redirection protection
Payment redirection is one of the most financially damaging scams hitting Australian businesses: a criminal sends an invoice or 'updated bank details' email that looks like it comes from a real supplier — or from you, to your clients. The fix is mostly process, not expensive technology, and it can be in place within days.
Who this is for
- Businesses that pay supplier invoices — especially trades, construction, and professional services
- Firms whose clients pay them by bank transfer (accountants, agencies, conveyancers, real estate)
- Anyone who has already received a suspicious invoice or near-miss
What's included
- A payment-change verification procedure tailored to how your business actually pays invoices
- Email authentication (SPF, DKIM, DMARC) so your own invoices are harder to fake
- Mailbox compromise checks: forwarding rules, MFA coverage on finance inboxes
- Client-facing wording: how you will (and never will) communicate bank details
- Staff walkthrough of the red flags: urgency, secrecy, changed details
What's not included
- Bank-side fraud controls (your bank configures those — we help you ask for them)
- Recovery of funds already lost (contact your bank immediately, then ReportCyber)
- Insurance against fraud losses
Pricing
Included in the Quick Cyber Risk Review ($1,500) and implemented hands-on in the 14-Day Protection Sprint ($7,500). Standalone scoping available.
Prices are in AUD. GST treatment to be confirmed; your written quote states the exact amount payable.
Get a written quoteCommon questions
What is the single most effective control?
A compulsory verification call, on a number you already had on file, before any change to a payee's bank details — no exceptions, especially for urgent requests. It defeats most payment redirection attempts regardless of how convincing the email is.
What if we've just been hit?
Call your bank's fraud line immediately — recall chances drop fast. Preserve the scam emails, then report via cyber.gov.au/report and Scamwatch. Our free invoice fraud checklist covers the first steps.
Can criminals really send email as our business?
If SPF, DKIM, and DMARC aren't configured on your domain, usually yes — receiving mail servers have little basis to reject impersonations. We check this from public records in every review.
Protect your payments
Book a free 20-minute discovery call with Sam, or start with a 48-hour Quick Cyber Risk Review. No fear-based sales pressure, no inflated reports.
Or call Sam directly on 0435 315 894.