An email arrives from a supplier you deal with all the time. It’s polite, it looks completely normal, and it simply says their bank details have changed — please use the new account for the next invoice. You do. And the money is gone, into a criminal’s account, often before anyone realises. This is a payment redirection scam, and it’s quietly one of the most costly frauds hitting Australian businesses, accounting for enormous losses each year. The defence, thankfully, is simple — once you know how it works.
This guide explains what payment redirection scams are, how they work, why they succeed, and the simple habits that stop them — written in plain terms for Australian trades, construction and professional-services owners.
WHAT IS A PAYMENT REDIRECTION SCAM?
A payment redirection scam is where a fraudster tricks you into sending a payment to their bank account instead of the genuine recipient’s. They do it by impersonating someone you’d normally pay — a supplier, a subcontractor, or even a staff member — and asking you to update the bank details on file.
It’s also known as business email compromise. The essence of a payment redirection scam is that everything looks legitimate; you think you’re paying a real invoice to a real business, but the account number has been quietly swapped.
HOW THESE SCAMS WORK
The classic version starts with a compromised or spoofed email account. The scammer either hacks into a real email account or creates one that looks almost identical, then watches for an opportunity — an invoice due, a big payment coming up.
At the right moment they send a message asking to update payment details, often with a plausible reason like “we’ve changed banks”. Because the request comes from a familiar name and fits something you were expecting to pay anyway, it rarely raises suspicion — which is exactly why payment redirection scams are so effective.
WHY THEY SUCCEED SO OFTEN
Payment redirection scams work because they exploit trust and routine rather than technology. The request comes from someone you know, about a payment you were already going to make, phrased in a completely ordinary way — so nothing feels wrong. There’s no dodgy link to spot or obvious red flag to catch. AI has made this worse, producing flawless, professional messages without the spelling errors that once gave scams away, and even mimicking a person’s writing style. The busier you are, the more likely you are to action a routine-looking payment request without a second thought. That’s the scam’s real weapon: it doesn’t look like an attack, it looks like Tuesday.
THE SIMPLE HABITS THAT STOP THEM
1. Verify every change of bank details
Treat any request to change payment details as suspicious until proven genuine. This single habit stops the overwhelming majority of payment redirection scams.
2. Call a known number, not the one in the email
Confirm the change by phoning the supplier on a number you already have, never one from the email requesting the change. Scammers supply their own “verification” number.
3. Slow down on payment requests
Be wary of urgency, which scammers manufacture deliberately. A moment’s pause to verify is far cheaper than the payment you’d lose.
4. Set a clear internal rule
Make it standard that any bank-detail change is verified by phone, and that anyone can pause a payment to check without being questioned. Process beats vigilance alone.
5. Secure your email
Protect your own email with multi-factor authentication, since a compromised account is how many of these scams begin. Securing email protects your customers too.
THE ONE RULE THAT MATTERS MOST
If you take nothing else from this, take this: never change a payment based on an email alone. Every payment redirection scam depends on you trusting a request to alter bank details that arrived electronically. Break that chain with one unbreakable rule — any change to payment details, from anyone, for any reason, is verified by a phone call to a number you already hold, before a cent moves. It costs a two-minute call and occasionally a slightly awkward “just confirming this is really you”. That minor friction is nothing against the loss of a major payment that is extremely difficult to recover once it’s gone. Make this rule non-negotiable across everyone who can make payments, and you close off the fraud almost entirely.
PAYMENT REDIRECTION SCAMS IN CONSTRUCTION
Construction and trades are prime targets, because the industry runs on exactly the conditions these scams exploit — frequent invoices, large progress payments, deposits, and a web of subcontractors and suppliers whose details change from time to time. A fraudster impersonating a subbie or supplier asking to update banking details before the next progress payment can divert a very large sum in a single hit. The busy, deadline-driven nature of site work makes a quick, routine-looking payment change easy to action without checking. The fix is the same simple discipline: no change to payment details is ever actioned from an email, only after a call to a known number confirms it, no exceptions even when everyone’s flat out.
COMMON PAYMENT REDIRECTION MISTAKES TO AVOID
- Trusting the email alone. Acting on a bank-detail change without a phone check is how the money is lost.
- Calling the number in the email. That number reaches the scammer; use one you already hold.
- Rushing under urgency. Manufactured urgency is the pressure that stops people verifying.
- No clear rule. Relying on individual vigilance instead of a standard verification step eventually fails.
Building fraud-proof habits into how you pay is core ACS Consulting work. The Operations & Process Improvement service builds payment-verification steps into your invoicing and accounts process so checking becomes automatic, while the SME Data Analysis & Power BI service helps you monitor and control payments, and the Strategy & Business Planning service treats fraud as a business risk worth managing. The free Perth SME Operational Audit Checklist helps you find gaps in your payment controls. For authoritative guidance, the National Anti-Scam Centre (Scamwatch), the Australian Cyber Security Centre, and the Australian Government’s cyber security resources are the references to use.
FREQUENTLY ASKED QUESTIONS
What is a payment redirection scam?
A payment redirection scam is where a fraudster tricks you into paying their bank account instead of the genuine recipient’s, by impersonating a supplier, subcontractor or staff member and asking you to update the bank details on file. It’s also called business email compromise.
How do payment redirection scams work?
A scammer compromises or imitates a familiar email account, waits for a payment to be due, then requests a change of bank details with a plausible reason. Because it comes from a known name about an expected payment, it rarely raises suspicion.
How can I protect my business from payment redirection?
Verify every change of bank details by phoning the supplier on a number you already hold, never the one in the email. Slow down on urgent requests, set a firm internal rule that all detail changes are phone-verified, and secure your email with multi-factor authentication.
What should I do if I’ve paid a scammer?
Contact your bank immediately, as fast action occasionally allows funds to be stopped or recovered, then report it to the National Anti-Scam Centre. Recovery is difficult once money has moved, which is why prevention through verification matters so much.
CONCLUSION
Payment redirection scams are among the most costly frauds facing Australian businesses, but they rely on a single weakness: trusting a bank-detail change that arrived by email. Verify every change by phone to a known number, slow down on urgency, set a firm rule, and secure your email.
Make “never change a payment on an email alone” an unbreakable rule, and you shut down payment redirection scams almost completely — protecting the payments your business can’t afford to lose.
Need expert guidance for your business?
ACS Consulting
Website: acsconsulting.com.au
Email: zoey@acsconsulting.com.au
Phone: 0452 665 021
Contact ACS Consulting today to discuss your business goals and discover practical solutions that drive measurable results.