Protecting yourself against fake invoice scams

This short guide is a reference tool to help refresh your knowledge or practise what you have learned in the Protecting yourself against fake invoice scams online video course, including how to:

recognise how fake invoice scams work
spot the red flags before you pay
check an invoice is genuine
take action if you think you've been scammed.

Stop. Check. Protect.

Before paying for anything online, remember three steps that can help protect you and your money from one of Australia's most costly scams.

Stop and take a moment before giving your money or personal information to anyone.
Check to make sure the person or organisation you're dealing with is real.
Protect by acting quickly if something feels wrong.

How fake invoice scams work

Fake invoice scams, also known as payment redirection scams, can reach you by email, text message, WhatsApp, or even a letter in the post.

These scams can be hard to spot, as they don't always include a link or a payment button. Many simply provide a document with a BSB and account number, just like a real invoice. Others use a QR code that directs you to a fake payment page or ask you to call a number that connects straight to the scammer.

For security, don’t click on links or open attachments from an unknown sender. Scammers either compromise a legitimate business's email address or create a similar looking one, then send invoices with their own bank details. If you pay, the money goes straight to the scammer, and a fake payment page may also harvest your personal details for identity theft in the future.

Red flags to watch out for

There are several warning signs that can help you spot a fake invoice before you pay.

You weren't expecting an invoice or payment request. Legitimate organisations don't usually demand payment without prior contact.
The sender's email address looks almost right, but not quite. Even one extra letter or a different domain can reveal a scam.
There's pressure to pay immediately. Urgency is one of the most common scam tactics, so treat it as a reason to slow down.
A business that usually contacts you by email suddenly sends a payment request by WhatsApp or SMS.
You question a payment using the contact details on the invoice and get a fast, convincing reply. Scammers are prepared for your questions, so don't be reassured.

Protecting yourself

Scammers pretend to be from organisations you know and trust, but there are checks you can do to help ensure you're paying money to someone legitimate.

Check the product or service description on the invoice. If the purchase doesn't look familiar, the invoice may be fake.
Contact the business directly using a phone number or website address you find online yourself, not the contact details in their message.
If you're unsure the business is real, check its ABN for free on business.gov.au.
Check the full email address and investigate any links before you click. Lots of dashes or strange spellings of familiar words can point to a scam site.
Use a secure payment method such as PayPal or a credit card rather than a direct bank transfer. These provide customer protections if a payment turns out to be fraudulent.

If you're ever unsure, don't pay. If the invoice is genuine, the business will follow up through official channels.

What to do if you've been scammed

If you think you've paid a scammer, act straight away to protect your money and your personal details.

Call your bank or financial institution immediately, tell them what happened and ask them to stop the transaction if possible.
Change passwords and passphrases for any accounts that may have been compromised.
If personal information such as your name, address, account details or identity documents may have been compromised. Contact IDCARE (idcare.org) for free help to protect your identity.
Report the scam at scamwatch.gov.au/report-a-scam to help warn others.

Scammers can quickly make money disappear after they receive it, making it almost impossible to retrieve stolen funds. If you think scammers have stolen your money, contact your bank immediately.