Business Email Compromise

Here’s the classic version. A supplier you’ve paid for years emails to say their bank details have changed. It arrives in the same thread, with the same signature, because it came from their real account — a criminal has been quietly reading it for weeks. You update the details, pay the next invoice, and the money is gone.

It runs in reverse too. Your inbox gets taken over, and your clients receive “our new bank details” from you. Either way, nobody hacked a bank. They got into an inbox through phishing, or faked one with email spoofing.

Why it matters: email compromise and business email compromise fraud are among the most common cybercrimes Australian businesses report to ASD. Its 2024–25 report puts the average self-reported cost of cybercrime for a small business at $56,600. Once the money has moved on, getting it back is rare.

What to do: never change bank details on the strength of an email. Call the person on a number you already have — not one in the email — and confirm. Since July 2025, Australian banks have been rolling out Confirmation of Payee, a name check when you pay a new account; if it says the name doesn’t match, stop. Turn on two-factor authentication for every email account in the business, and set up DMARC so your domain is harder to fake.