Business email compromise

The invoice is real. The bank details are not.

Business email compromise does not need malware. It needs one email account, a few weeks of reading your mail, and one person who pays a changed invoice. Here is how it works, the controls that stop it, the first hour if money has gone, and a check to run before you pay.

Figures from ASD and the ACCC. Checked 30 October 2026.

Book a BEC review Check a payment 07 3114 2808

How BEC unfolds
Controls that stop it
Pre-payment check

Reviewed by Blake Bath, General Manager, on 30 October 2026.

An accounts officer in a busy back office makes a phone call with one hand on a printed supplier invoice. — **The call that stops it**Changed bank details get a call to a number you already had. Never the number in the email.

The pattern

How a business email compromise unfolds.

Almost every case follows the same four steps. Break any one and the attack fails.

Research

Your website, LinkedIn and the ABN register show who pays the bills and who you buy from.

Less public detail
Staff aware
Finance roles protected

Pre-payment check

Got a request to pay or change bank details?

Answer five questions about the request. You get a stop or proceed answer and the steps to take, ready to copy into the invoice record.

Got a request to pay or change bank details? Answer five questions before you touch the banking.

Does it change bank details, or pay someone for the first time?

Did the request only come by email, text or message?

Is there pressure to pay quickly or keep it quiet?

Anything different: sender address, tone, amount, timing?

Is the amount above your approval threshold?

Stop and verify

2of 5 warning signs

Call the supplier on a number you already had, from an old invoice, the contract or their website. Never use a number in the email.
Ask them to confirm the BSB and account number back to you. Do not read the new details out to them.
Check the Confirmation of Payee result in your banking app before you send. A no match means stop.
Note who you called, when, and on what number, against the invoice.

Already paid? Call us

The numbers

How often it happens here.

Measure	Figure	Source
Email compromise, share of business cybercrime reports	19%	ASD Cyber Threat Report 2024-25
BEC fraud with financial loss, share of business reports	15%	ASD Cyber Threat Report 2024-25
Payment redirection scam losses, 2025	A$166.8 million	ACCC
Confirmation of Payee checks in its first year	More than 150 million	Australian Payments Plus

These are reported figures. Many losses are never reported.

What to look for

Red flags your team should know on sight.

Changed bank detailsOn a known supplier, especially by email and especially near month end.
A sender address that is almost rightOne letter swapped, an extra hyphen, or a different ending such as .com instead of .com.au.
Pressure or secrecyPay today, keep this between us, I am in a meeting so just do it.
Reply-to different to FromReplies quietly go to a different address.
Inbox rules nobody madeForwarding, mark as read or delete rules on finance mailboxes.
MFA prompts nobody asked forSomeone has the password and is trying to get in.

What stops it

The controls that break the chain.

Two are about process and cost nothing. The rest are settings in Microsoft 365 and your email domain.

Control	What it stops	Where it lives
Call-back on a known number for any bank change	The payment, even if email is fully compromised	Finance policy
Second approver above a threshold	One person being rushed	Finance policy and banking
Passkeys or other phishing-resistant MFA	Stolen passwords and sessions being used	Microsoft Entra ID
Conditional Access	Sign-ins from unmanaged devices and odd places	Microsoft Entra ID
Alerts on new inbox rules and external forwarding	Weeks of quiet reading	Microsoft 365 and Defender
Identity threat detection and response	A hijacked account staying open	Monitoring service
SPF, DKIM and DMARC at reject	Scammers sending as your domain	Your DNS

If money has gone

If money has already left, the first hour.

Call your bank nowAsk for an urgent recall of the payment. Then call the receiving bank if yours advises it.
Lock the accountReset the password, sign out all sessions, check MFA methods, inbox rules and app consents.
Keep the evidenceDo not delete the emails. Keep headers, sign-in logs and a timeline.
Tell your insurerPolicies set a notification window. Late notice can affect cover.
Report itReportCyber at cyber.gov.au. Warn the supplier or customer whose name was used.
Check privacy obligationsIf personal information was accessed and serious harm is likely, the Notifiable Data Breaches scheme may apply.

Our view

The phone call beats every product.

Every control we sell helps, but the one that stops the money leaving is a rule that any change of bank details gets a phone call to a number you already had. Write it down, tell your suppliers you do it, and back the person who holds up a payment to make the call.

On the technical side, phishing-resistant sign-in for finance staff and alerts on new inbox rules catch most cases before an invoice is ever touched.

The order

Making BEC hard for an attacker, in five steps.

Step 1Write the payment rule
Call-back on a known number, second approver above a threshold.
Step 2Protect finance first
Passkeys and Conditional Access for anyone who can pay or change suppliers.
Step 3Watch the mailboxes
Alerts on inbox rules, forwarding and risky sign-ins.
Step 4Lock your domain
SPF, DKIM and DMARC at reject.
Step 5Brief the team
What the scam looks like and who to call.

Related guides

BEC starts with one account. Here is how to protect them.

Sign-in, email security and the first hour of an incident.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about business email compromise.

What is business email compromise?

A scam where someone uses a hacked or lookalike email account to get your business to pay a fake invoice, change a supplier's bank details, or send money or data. There is usually no malware, so antivirus does not see it.

How common is it in Australia?

In ASD's 2024-25 threat report, email compromise was 19% of cybercrime reports from businesses and BEC fraud with a financial loss was another 15%. The ACCC recorded A$166.8 million lost to payment redirection scams in 2025.

How do I know if our email has been compromised?

Look for inbox rules nobody created that forward, hide or delete messages, sign-ins from places your staff are not, sent emails nobody wrote, and MFA prompts nobody asked for. Suppliers asking about an email you did not send is another sign.

We paid a fake invoice. What do we do first?

Call your bank straight away and ask them to recall the payment. Then reset the account's password and sign it out everywhere, check for inbox rules, keep the evidence, tell your insurer, and report it at cyber.gov.au. Speed matters most with the bank.

Does Confirmation of Payee stop BEC?

It helps. Banks now check the account name against the BSB and account number for new payees and show a match, close match or no match. A no match is a reason to stop. But scammers can open accounts in names that look right, so a phone call on a known number is still the main check.

Does cyber insurance cover BEC?

Many cyber policies cover some BEC losses, often with a sub-limit for funds transfer fraud, and usually with conditions such as MFA on email and a set notification window. Read your policy or ask your broker before you need it.

Do we have to report it?

Report it to ReportCyber at cyber.gov.au. If personal information was accessed and serious harm is likely, organisations covered by the Privacy Act must notify the OAIC and the people affected. This is general information, not legal advice.

Next step