5 red flags that signal a fake supplier email

Most supplier email fraud follows a pattern. If you know the pattern, you can spot it in seconds — before the money leaves your account. Here are the five red flags that show up again and again.

1. The bank details changed

This is the number one signal. If a supplier you've paid before suddenly sends an invoice with different BSB or account numbers, treat it as fraud until proven otherwise. The change might be legitimate — suppliers do switch banks — but you must verify it through a channel other than email.

The trap: The email will often say "Please note our new bank details" or "We've changed banks, update your records." It sounds reasonable. That's the point.

2. The email came at an unusual time

Scammers send invoices on Friday afternoons, public holidays, or late at night. They know the accounts person is rushing to finish before the weekend or is less vigilant. A real supplier rarely emails an invoice at 9 PM on a Sunday.

3. The reply-to address is slightly different

The display name says "John from ABC Plumbing" but the actual email address is john@abc-plumbing-au.com instead of john@abcplumbing.com.au. On a phone screen, the difference is invisible. Always tap the sender name to reveal the full address.

4. There's urgency or pressure

"Please process this today or our team can't start on Monday." "This is overdue and we need payment immediately." Urgency is a social engineering tool designed to make you skip verification. Real suppliers follow up politely. Scammers create a crisis.

5. The ABN or GST amount looks right, but something feels off

Scammers often copy a real invoice and only change the bank details. Everything else — the ABN, the GST, the line items, the totals — matches perfectly. If your only verification is "does the ABN look right," you'll miss the fraud. The ABN was never the problem. The bank account was.

How RILLA Shield catches all five

• Bank-detail change detection — flags any BSB or account number that differs from the supplier's history.
• Sender verification — checks the email domain against known-good records.
• Timing analysis — flags invoices sent outside the supplier's normal pattern.
• Urgency detection — AI flags pressure language in the email body.
• Full document scan — 21 detection layers check every field, not just the ABN.

You don't have to memorise these flags. RILLA Shield checks them automatically on every invoice. Try it free →