How invoice fraud costs Australian businesses millions

In 2024, the Australian Competition and Consumer Commission (ACCC) reported that businesses lost over $60 million to payment redirection scams alone. The real number is far higher — most losses go unreported because the business feels embarrassed, or the amount is "only" a few thousand dollars.

How the scam works

It starts with a compromised email account — usually a supplier's. The attacker silently reads the conversation, learns the invoicing rhythm, and waits for the right moment. When a real invoice is about to be sent, the attacker intercepts it, changes the bank account number by one or two digits, and forwards it to you. The invoice looks identical. The amount is correct. The ABN matches. Only the bank details are wrong.

You pay it. The money lands in the scammer's account and is gone within hours — moved through mule accounts or offshore. By the time the real supplier calls to ask why their invoice hasn't been paid, the money is unrecoverable.

Why it's getting worse

Three forces are converging:

• AI-generated emails — scammers now use AI to write convincing, grammatically perfect supplier emails. The old "spot the bad spelling" trick no longer works.
• Faster payments — PayID and Osko mean money moves in seconds. Banks can't recall it. The window between "sent" and "gone" has closed.
• Remote work — tradies and builders approve payments from their phone in the field. Nobody is walking back to the office to double-check a bank detail against a file.

The one question that stops it

Before you pay any invoice, ask: "Have these bank details ever appeared on a previous invoice from this supplier?" If the answer is no — or if you can't quickly check — that's your signal to verify before the money leaves.

This is exactly what RILLA Shield does automatically. Every invoice is scanned against the supplier's history. A bank-detail change triggers an instant alert before you pay. You don't have to remember to check — the system checks for you.

What to do right now

1. Never trust a "new" bank detail that arrives by email alone.
2. Call the supplier on a number you already have — not the one on the invoice.
3. Set up a pay-run check so a whole batch is scanned before it goes to the bank.
4. If you've already paid, contact your bank's fraud team within 24 hours. Speed matters.

RILLA Shield was built in Australia to stop this exact attack. It scans every invoice, flags bank-detail changes, and gives you a timestamped evidence pack for your bank or insurer. Start a free trial →