Join or sign in
Sign in to save your progress and earn a certificate
'Stop. Check. Protect. Protecting yourself against fake invoice scams'. An invoice arrives in your inbox. It looks official, with a logo, a name you might recognise, an amount owing, and a warning that it's overdue. It could be from a business you've dealt with before or one you haven't. Either way, your first instinct might be to pay it and move on, but stop. It might be a fake invoice scam.
In this video, you'll learn three steps that can help protect you and your money from one of Australia's most costly scams. Stop. Check. Protect. Before paying for anything online, stop and take a moment before giving your money or personal information to anyone. Check to make sure the person or organisation you're dealing with is real. Protect by acting quickly if something feels wrong.
By applying Stop, Check, and Protect whenever you're asked to pay for something online, you can help recognise and manage the risk of scams. Fake invoice scams, also known as payment redirection scams, can reach you through email, text message, WhatsApp, even a letter in the post. These scams can be hard to spot as they don't always include a link or a payment button. Many simply provide a document with a BSB and account number, just like a real invoice. Others use a QR code that directs to a fake payment page or ask you to call a number that connects straight to the scammer.
For security, don't click on links or open attachments from an unknown sender. In other cases, scammers impersonate a business you've previously dealt with, such as a tradesperson, a store, or a service provider. Scammers either compromise legitimate email addresses or create similar-looking email addresses and send invoices, which contain their bank details, not those of the real business. The amounts are often small, just enough that it doesn't feel worth questioning, but sometimes the amounts aren't small at all. If you pay, the money goes straight to the scammer. Some fake invoices are after more than your money. A fake payment page may harvest your personal details, which can be used for identity theft long after the original scam.
There are several warning signs that can help you spot a fake invoice before you pay. If you weren't expecting an invoice or payment request, that's a warning sign worth paying attention to. Legitimate organisations don't usually demand payment without prior contact. A sender's email address that looks almost right, but not quite, is another red flag. To check the email address, hover over or tap the sender's name to reveal the full email address. Even a single extra letter, a dot in the wrong place, or a different domain can reveal a scam. Be wary if there's pressure to pay immediately. Urgency is one of the most common scam tactics. If the sender of the invoice insists you must pay right now or face serious consequences, that's a reason to slow down, not speed up.
Be suspicious if a business that usually contacts you via email, for example, sends a payment request through WhatsApp or SMS. If you question a payment using contact information on the invoice and get a fast, convincing reply, do not be reassured. Scammers are prepared for your questions, and the reply could also be part of the scam. Scammers pretend to be from organisations you know and trust, but there are checks you can do to help ensure you're paying money to someone legitimate.
First, check the product or service description on the invoice. Does the purchase look familiar to you? If not, that may indicate the invoice is fake. If you receive an unexpected invoice or a request to update payment details, contact the business directly using a phone number or website address you find online yourself. Never use the contact details provided in the suspicious email or message. If you're unsure if the business is real, check the ABN on business.gov.au. It's free and takes less than a minute to verify whether a company is legitimately registered in Australia.
Always check the full email address and investigate any links before you click on a link. If the address has lots of dashes or strange spellings of familiar words, it could be a scam site. Where you can, use a secure payment method such as PayPal or a credit card rather than a direct bank transfer. These offer greater protections if a payment turns out to be fraudulent. And if you're not sure, don't pay. If the invoice is genuine, the business will follow up through official channels.
If you think you've paid a scammer, act straightaway. Scammers want to get your money and your personal details, so you should focus on protecting these as quickly as possible. Call your bank or financial institution immediately. Tell them what happened and ask them to stop the transaction if possible. Even if the money has already gone, your bank needs to know so they can help protect your account. Scammers can quickly make money disappear after they receive it. This makes it almost impossible for you to retrieve stolen funds. If you think you've been scammed of money, contact your bank immediately.
You should also change passwords and passphrases for accounts that may have been compromised. If you think any personal information such as your name, address, account details, or identity documents may have been compromised, contact IDCARE right away. It's Australia and New Zealand's National Identity and Cyber Support Service and will give you free help to make a plan to protect your identity.
You should also report the scam to Scamwatch at scamwatch.gov.au/report-a-scam. Your report helps warn others and supports Australia's National Anti-Scam Centre in tracking and stopping these crimes.
Topic outline
- General
General