The invoice that changed: how payment redirection fraud works

It usually starts with a normal email. A supplier sends an invoice you were expecting, or a reply in an existing thread says their bank details have changed. The logo is right, the tone is right, and the amount matches. You pay.

A week later the supplier calls asking why they haven’t been paid.

This is business email compromise, often called payment redirection or invoice fraud. In the 2024–25 financial year it was one of the top cybercrimes reported to the Australian Signals Directorate by businesses. Business email compromise with a financial loss made up 15% of business reports, and email compromise without a loss made up another 19%.

How it actually happens

In most cases we investigate, nobody “hacked” a server. Someone got the password to a mailbox. That happened through a phishing page, a reused password or a login prompt that was approved without much thought.

Once inside, the attacker usually does three things:

• Watches. They read the mailbox quietly, sometimes for weeks, learning who pays whom, when and how.
• Hides. They create mailbox rules that move or delete replies, so the real owner doesn’t see the conversation.
• Strikes. When a payment is due, they send altered bank details from the real mailbox or from a lookalike address.

The compromised mailbox may be yours or your supplier’s. Working out which one is usually the first thing a forensic investigation answers.

Warning signs

• A request to change bank details, especially by email alone.
• Urgency or secrecy: “please process today”, “don’t call, I’m in meetings”.
• Small changes to a sender address, such as one letter different or a different domain ending.
• Replies in a thread that you don’t remember sending.
• Rules in your mailbox you didn’t create.

If you’ve already paid

Call your bank immediately. Tell them it is a suspected fraudulent payment and ask them to attempt a recall. The first hours matter most.

Don’t delete the emails. It’s tempting to clean up. But the messages, rules and sign-in records show how the attacker got in, what they saw, and whether personal information was exposed.

Secure the account without wiping it. Change the password, sign out all sessions and make sure multi-factor authentication is on. Leave the evidence in place.

Call the other party by phone. Use a number you already have, not one from the email.

Report it to the police via ReportCyber at cyber.gov.au. Your bank and insurer may ask for the report number.

Why an investigation helps

Your bank decides on recalls, and your insurer decides on claims. Both will ask the same questions. How did it happen? Was it your system or theirs? What else did the attacker see? Is it over?

A forensic investigation answers those questions with evidence. It also tells you whether personal information in the mailbox was exposed. That can trigger obligations under the Notifiable Data Breaches scheme.

Preventing the next one

• Verify bank detail changes by phone, using a number you already hold. Make it a rule with no exceptions.
• Turn on multi-factor authentication for every email account, and prefer app-based or hardware methods over SMS.
• Review mailbox rules and forwarding regularly, or have your IT provider alert on new ones.
• Train the people who pay invoices. They are the last line of defence, and attackers know it.

If it has happened to you, call Flare on 1300 027 401. The line is answered 24/7. Or read more about our business email compromise response.