Emerging risks: AI scams and fraud.

Payment redirection: What payment redirection is

Payment redirection is when a criminal gets a business to pay money into the wrong bank account. The usual trick is a message that looks like it comes from a supplier, a boss or a colleague and says: "our bank details have changed". The money leaves your account and lands in the criminal's account. The usual name for the wider problem is business email compromise, or BEC.

There are two common ways in. In the first, the criminal breaks into a real email account, such as a supplier's, and edits real invoices. The customer thinks they are paying the supplier, but the bank details are the criminal's. In the second, the criminal makes a fake address that looks almost the same as a real one. In both cases the first sign of trouble is often a real supplier asking why they have not been paid.

Payment redirection: Why it works so well

Criminals do homework. Spain's cybersecurity institute (INCIBE) reports that attackers often sit inside a mailbox for several weeks, learning how payments work, and then pick their moment: a big invoice is due, there is a new customer, or the manager is on holiday. They add pressure ("this is urgent", "keep this between us") so the person paying does not stop to ask anyone.

The Australian Cyber Security Centre points to the same things from the staff side: a sudden change of bank details, an urgent request, threats if payment is late, or an unusual request from someone senior. Notice that none of these needs clever technology. They work because people want to be helpful and fear letting the boss down. A calm, written process takes that pressure off the person at the keyboard.

Payment redirection: The numbers, with dates and sources

Australia: in 2025 people reported combined scam losses of $2.18 billion (Australian dollars), up 7.8% from 2024, according to the National Anti-Scam Centre. Payment redirection was the second-largest scam type by loss, at $166.8 million. The same report says false billing was the most reported scam type for businesses, and that small businesses reported more scams and higher losses than medium and large ones.

United States: the FBI's 2025 report ranks business email compromise second for reported losses, after investment fraud, at about US$3.05 billion. These are figures that people reported, not a count of every case. Scam types and countries are counted in different ways, so do not add or compare these numbers directly. Your course adds the figures and reporting bodies for your own country.

Payment redirection: A real-style case: $17,000 after one email

Scamwatch describes a case, with the names removed, where an accounts clerk received an email late on a Friday that appeared to come from a regular overseas supplier. It said the supplier's bank details had changed. The clerk updated the details in the system and, a few days later, paid $17,000 to the new account. Two weeks later the goods had not arrived, and the real supplier said it had never asked for a change. The business estimated its total loss at over $30,000, once missed orders were counted.

Look at what went wrong: one email changed the bank details, nobody else saw the change, and nobody phoned the supplier. Each of those is a gap you can close. The next modules show how.

Fake invoices: A fake invoice can look exactly right

Scamwatch says fake supplier emails often copy the real supplier's logo and message format, and may link to convincing copies of the real homepage. The sender address can be a near-twin of the real one: a character added, removed or changed. The warning is plain: if you look closely you can usually spot the fake, but only if you look.

Our advice: compare any new address with the one on your last genuine invoice, letter by letter. The Australian Cyber Security Centre gives the same tip, to compare the sender's domain with previous correspondence. Better still, do not rely on your eyes alone, because a tired person on a busy afternoon will miss a swapped letter.

Fake invoices: Look-alike domains and copied websites

A look-alike domain is a web address built to resemble a real one. The Australian Cyber Security Centre lists the tricks: remove a letter, add one, swap two, add a hyphen, use a different ending (such as .net instead of .com), or replace a letter with a similar-looking number or symbol.

Scamwatch adds that scammers now use AI tools to build perfect copies of real websites, with working contact forms, and can have them live within hours of a real company launching a new service. A website that looks right is therefore not proof. For your own business, consider registering look-alike domains of your own name and ask your IT provider about SPF and DMARC, which help detect fake emails pretending to be you.

Fake invoices: Invented companies and goods that never get paid for

Sometimes the fake is not an invoice but a whole company. The Australian Cyber Security Centre describes criminals who register a domain very close to a large, trusted organisation, then email suppliers asking for a quote on expensive goods such as laptops. They ask for delivery to an address they choose, before payment. The goods arrive with them, and the invoice goes to the real organisation, which never ordered or received anything.

If you sell goods, the risk is yours: you may ship stock and never be paid. Our advice: check that a new, large order really comes from the company it names, by phoning a number from that company's real website, before you ship to an address that is not on file.

Fake invoices: Checks that catch fake invoices

Scamwatch's rule for any unexpected request about money: do not act on it until you are sure it is real. Its practical steps are: have a clearly defined process for verifying and paying accounts and invoices, phone the supplier on contact details you already hold, never use a number from the suspicious email, and consider a multi-person approval for payments over a set amount.

Our advice: write the process on one page. For example, "a change of bank details is accepted only after a callback to the number in our supplier file, recorded on the change form, and approved by a second person who did not take the call". Then the checking does not depend on anyone's memory or mood.

Voice clones and deepfakes: How big is it? An emerging risk, with numbers

Voice cloning and deepfake video are real, and the official bodies warn about them, but they are still a small part of the picture. Scamwatch says scammers can use a few seconds of a voice recording to make an AI clone, and that they use AI to make fake videos and audio that look and sound real. The FBI's 2025 report counts more than 22,000 complaints that mention AI in some way, with adjusted losses above US$893 million, and says businesses reported over US$30 million in losses to BEC scams involving AI.

To keep that in proportion: the same report puts all BEC at about US$3.05 billion. On our own arithmetic, US$30 million is roughly 1% of US$3.05 billion, so in that report the BEC scams that mention AI are a small share of all BEC losses. That does not mean AI voices can be ignored: they are cheap to try, and the checks in this course (call back, second person, slowing down) defeat them as well as the ordinary tricks.

Voice clones and deepfakes: How an attack can sound

INCIBE defines a deepfake as a fake video, manipulated with AI tools that can swap faces in images and change the voice. The Australian Cyber Security Centre describes vishing as a voice scam that uses voice cloning, deepfake technology or fake caller IDs to sound real. It can be harder to detect because a familiar voice makes you more likely to trust the caller, the phone creates urgency, and caller ID and voices can be faked. The US Federal Trade Commission notes that a call that sounds like your boss asking for bank account numbers makes you more likely to act, and that a scammer needs only a short audio clip, which can come from content posted online.

The FBI warns that criminals generate video for real-time video chats with people claiming to be company executives, law enforcement or other authority figures, and use AI audio of a person to try to get into that person's bank accounts. FinCEN says criminals have used generative AI to pretend to be an executive or trusted employee and tell victims to transfer large sums.

Voice clones and deepfakes: Three cases from the sources

INCIBE describes a Spanish company where staff heard a voice exactly like the CEO's, joined a call in which he said an audit was imminent and a machine had to be bought, and paid straight after the call. Days later they learned it was not him. In another INCIBE case, a fake CEO messaged an employee on the company's Teams chat asking for an urgent EUR 150,000 purchase and emailed a document with forged signatures.

A third INCIBE case shows the defence working: a woman heard her husband's voice asking her to send a message to a number, called his usual number instead, and he confirmed he had not called. Notice what the people who were fooled had in common: a request outside the normal process, urgency, and no callback.

Voice clones and deepfakes: Do not rely on spotting the fake

The FBI lists signs in fake images and video, such as odd hands, irregular faces, wrong shadows, lag in the voice and unnatural movement, and says to listen to tone and word choice. It also says AI-generated content has advanced to the point that it is often difficult to identify and that voice clones can sound nearly identical. Europol adds that strengthening the approval process is currently seen as better than relying only on deepfake detection tools.

Europol's examples of stronger checks include approving with audio and video rather than audio alone, demanding a live video connection, and asking the person to perform random, complicated acts live on camera. Our advice: for money and passwords, the best check is not "does it sound right?" but "have I confirmed it through a channel the criminal does not control?".

Voice clones and deepfakes: Calm habits that work

The FTC's advice is not to trust the voice: call the person back on a number you know is theirs and verify the story. The FBI suggests an agreed secret word or phrase. INCIBE advises confirming identity through another known channel and, after its voice-clone case, authorising payments by email or in person, not by phone. Peru's data protection authority advises using the privacy options on social platforms and not posting videos, audio or personal information publicly.

None of this needs fear. It needs a habit: when a voice or video asks for money or access, pause, hang up and confirm.

Synthetic identities: What a synthetic identity is

The US Treasury's financial crimes unit (FinCEN) defines a synthetic identity as a combination of real and fake personal information used to build a person or business that can pass identity checks. It reports that criminals have combined AI-generated images with stolen or entirely fake personal data to create such identities. Europol warns that criminals can also abuse biometric data, using photos gathered online and deepfake technology to impersonate people.

FinCEN reports that accounts opened with suspected AI-made identities were used to receive and launder the proceeds of other frauds. That is why customer checks matter to everyone, not just compliance teams: the fake customer may be the end of a chain that began with a scam on someone else.

Synthetic identities: Fake documents can be made in minutes

Scamwatch says professional-looking certificates, licences and official documents can be created in minutes, and gives examples: fake regulatory papers for investment scams, and fake passports and work permits for romance scams. The FBI says criminals use generative AI to produce fake identification documents, such as licences and law enforcement, government or banking credentials, and AI-generated images for believable profile photos. FinCEN reports that criminals have used generative AI to create false documents, photos and videos to get around customer identification and verification.

A smooth, clean-looking document is therefore no longer a sign of a genuine one. Checks work best when they compare a document with other things the customer says and with independent records.

Synthetic identities: What customer checks can catch

FinCEN says institutions often found fake identity documents by re-reviewing account-opening documents, and that reverse image searches can show an identity photo matches a gallery of AI-generated faces. Indicators that deserve a closer look include inconsistencies between several identity documents or between a document and the rest of the customer's profile, and a customer who cannot satisfactorily prove their identity or source of income.

Further signs include a newly opened account with rapid transactions, many similar accounts acting in a coordinated pattern, and money withdrawn straight after deposit in ways that are hard to reverse. FinCEN stresses that no single red flag proves wrongdoing, so each case is judged on the surrounding facts. A flag means "look harder and escalate through your normal process", not "accuse".

Synthetic identities: Live checks and their limits

Live verification, where a customer is asked to confirm identity by audio or video, can help. FinCEN cautions that criminals may use tools that generate synthetic audio and video, so inconsistencies may be the only clue, and that some systems flag third-party webcam plugins which can show previously generated video instead of a live feed. Europol notes that a higher-quality synthetic image makes a forged document more likely to pass a visual check, and that the strength of an identification process depends on the whole process, not only the visual step.

Our advice: do not rely on one check. Combine document review, independent records, a live step and ongoing monitoring, and write down who decides what when the checks disagree.

Synthetic identities: Protect your own documents

Staff and customers can also be victims. Peru's data protection authority advises not letting anyone photograph your identity document, not sharing photos of it on social media or messaging, and using watermarks or crossed-out areas on any copy you must send. INCIBE advises not sharing personal documents before validating why they are requested and who is asking. In an INCIBE case, an employee shared a photo of their identity card as part of a fake executive's payment request.

Verification habits: Call back on a number you already hold

This is the habit that appears most often in the sources behind this course, in one form or another. Scamwatch: phone the supplier using contact details you already have, never a number in the email, and call a friend or family member back on their real number. The FBI: independently find a phone number for the person and call to verify. The US Federal Trade Commission: contact the organisation using a phone number, website or email address you know is real, not the contact details in the unexpected message.

Why it works: the scammer controls the message, including any phone number in it. They do not control the number already in your files, your phone's saved contacts or the number printed on a bank card. If a "new number" or "new bank account" arrives, the check is to go back to the old, trusted record.

Verification habits: A second channel and a code word

If someone you know contacts you from a new platform or number, the FBI says to verify the new contact through a platform you had already confirmed or another trusted source. INCIBE tells companies to confirm an urgent payment request through a different channel, such as a call or an internal message, and to confirm the identity of contacts by direct phone or in person, especially for sensitive operations.

The FBI also suggests a secret word or phrase agreed with family members to verify identity. Our advice: teams that handle payments can agree something similar, for example a phrase for phone approvals that is never written in email or chat and is changed now and then. A code word is a backup, not a replacement for the callback.

Verification habits: Two-person approval

Scamwatch suggests considering a multi-person approval process for payments above a set dollar amount. INCIBE recommends a dual-control rule in which two people authorise transfers above an amount, and payment procedures that need at least two people or two different channels, such as email and phone. After a voice-clone case, INCIBE recommended that payments be authorised by email or in person, never by phone alone.

Our advice: make the second person truly independent. They should check the details against your own records, not against the message that asked for the payment, and they should be free to say no to a senior person. If the person asking is the second approver, you do not have two people.

Verification habits: Slowing down urgency

Almost every scam in this course adds a clock. The US Federal Trade Commission says scammers want you to act before you have time to think and may tell you not to hang up so you cannot check their story. It adds: do not believe anyone who says you have to quickly move your money to protect it. INCIBE says the attack plays on urgency, trust and fear of disobeying a superior. The Australian Cyber Security Centre's advice is short: if something feels urgent or unusual, stop and verify it.

Our advice: treat urgency itself as a red flag. A simple rule is "urgent plus money or codes equals a second check". Give staff written permission to pause any such request, and to say "I will call you back", without needing to explain why.

Verification habits: Make it safe to report

The UK National Cyber Security Centre says that staff who fear for their jobs will not report mistakes, and that a positive culture turns staff into an early warning system. Our advice: thank people who report a suspicious message, including people who clicked. The faster a team hears about a bad link or a bad payment, the more can be stopped.

Where do you report, and what do you do first?

A scam can also be money laundering. If you suspect on reasonable grounds that a customer or their agent is not who they claim to be, or that a transaction may be relevant to crime, follow your program’s escalation steps at once. The AML/CTF compliance officer makes sure the report reaches AUSTRAC through AUSTRAC Online.

AUSTRAC says a report is due within 24 hours if the suspicion relates to terrorism financing, and within 3 business days for other suspicions. Do not tell the customer that you have reported or may report: that is tipping off.