What should a small business do in the first hour after paying a fake invoice?
Quick answer
Call your bank straight away and ask it to stop the payment. Then write down what happened, report it, secure your email and warn your contacts. ASD says to contact your bank immediately if you have sent money to a scammer1. ASD cannot recover lost money, so speed and a clear record matter2.
On this page
What do you do in the first hour, step by step?
Do these in order. Work down the list and write the time beside each step.
- Straight away: stop paying and call your bank or credit union. Ask it to stop any transactions3. Use the phone number on the bank's own website, not a number from the scammer's email4. Do not send any more money while you are unsure3.
- Next: write down what happened while it is fresh. Note what happened, when, who contacted you, what you received or shared, the platform, and how you responded4.
- Then: report it. ASD's hotline is 1300 292 371 (1300 CYBER1), open 24 hours a day, 7 days a week. It can guide you through a police report made through ReportCyber2. If your business email may be compromised, report it to ASD and your financial institution immediately5.
- Keep the reference. Write down the Report Reference Number you are given. You may need it when dealing with banks, insurers or other organisations5.
- Secure your email. Change your password, sign out of all active devices, turn on multi-factor authentication and remove rules or settings you do not recognise5.
- Warn your customers, suppliers and colleagues. Tell them as soon as possible, so they can spot requests for payment and changes to bank details5.
- Before the hour is up: ask for support. IDCARE can help you make a plan, for free3.
If you have sent money to a scammer, contact your bank or credit union immediately: it may be able to stop a transaction4.
Want a first-hour log you can print and fill in?
Tick the sheet you want, type your business name, and print it or save it as a PDF. Fill in the time beside each step as you go.
First-hour log: step, time and who did it
Work down these steps in order and write the time beside each one: call your bank and ask it to stop any transactions3; write down what happened4; report to ASD and the police through ReportCyber2; note the Report Reference Number5; secure your email5; tell your customers, suppliers and colleagues5; ask IDCARE for support3.
| Step | Time started | Time done | Who did it | Notes or reference number |
|---|---|---|---|---|
A starting point for your own records. Adapt it to how your business works, and keep it with your other notes on the incident5.
Bank call notes
Call the number on your bank's website4 and ask it to stop any transactions3. Write down who you spoke to, what the bank agreed to do and any reference it gives you.
| Time of call | Number called | Person spoken to | What the bank agreed to do | Reference number |
|---|---|---|---|---|
A starting point for your own records. Adapt it to how your business works, and keep it with your other notes on the incident5.
Nothing is sent and nothing is stored: the name and month appear only on your screen and on your printout.
Who should you tell, and where does each report go?
You make each of these calls and reports yourself, by phone or online.
| Who | What you do | Source |
|---|---|---|
| Your bank or credit union | Phone it now and ask it to stop any transactions | 36 |
| ASD (cyber.gov.au) | Report the incident; call the hotline if you want help | 25 |
| Police | Report through ReportCyber, or online | 23 |
| Scamwatch | Report the scam once your details are secure, so others are warned | 36 |
| IDCARE | Ask for free help with a plan | 3 |
| Customers and suppliers | Tell them, and tell them to call their own bank if they lost money | 5 |
Can you get the money back?
Nobody can promise it. ASD says it cannot recover lost money2. Your bank may be able to close your account or stop a transaction, and that is why the first call matters4. Police may not respond to every report, but each report helps support investigations4.
Be careful of anyone who offers to get your money back. Scamwatch says never to accept such an offer and to work with your financial institution instead7. Scammers often come back for more, and 1 in 3 victims of a scam have been scammed more than once3.
What does a real case look like?
Scamwatch publishes a story based on real reports. An accounts manager got an email late on a Friday afternoon that seemed to come from a regular supplier. He changed the supplier's banking details and then made a scheduled payment of $17,0008.
The fake was found 2 weeks later, when the goods had not arrived and he phoned the supplier. The company estimated its loss at over $30,0008. When he did phone, it became clear the supplier had sent no request at all. A phone call before the change is the check covered in how to check a change to a supplier's bank details.
Do you have to tell anyone else?
Maybe. If personal information has been leaked, you may have legal obligations to report a data breach. If you are unsure, ASD says to seek legal advice5. This guide cannot tell you what applies to your business.
If you are unhappy with how your bank handled it, you can complain to the Australian Financial Complaints Authority3.
How do you stop it happening again?
Put the checks in writing so that anyone in the team can follow them. ASD says to set up a clear and consistent process to verify requests for payment1. Our call-back script and checklist is a start. The payment fraud kit turns it into editable documents, and the free AI-scam tools help with fake messages and voices.
Frequently asked questions
Who do I call first after paying a fake invoice?
Your bank or credit union. ASD says to contact it immediately if you have sent money to a scammer4. Ask it to stop any transactions3.
Can my bank reverse the payment?
It may be able to stop a transaction or close your account, but the sources do not promise a reversal4. Ask the bank what it can do.
Is ReportCyber the same as Scamwatch?
No. ReportCyber is the joint tool for reporting a cybercrime to the police2. Scamwatch uses your report to warn the community about new scams6. Many cases need both.
What if I am not sure it was a scam?
Stop sending money. Scamwatch says scammers keep asking for more until you stop3.
Should I pay a company that offers to recover my money?
No. Scamwatch says never to accept an offer from anyone who says they can get your money back7.
Sources
Each number in the text links to the document the fact comes from. We keep a dated copy of every source with its SHA-256 fingerprint, so we can show what it said on the day we checked it.
- Source 1: Protecting against business email compromise (guidance page on cyber.gov.au). Australian Signals Directorate (ASD), cyber.gov.au, checked 2 November 2026.
https://www.cyber.gov.au/publication/protecting-against-business-email-compromise - Source 2: Help during a cybercrime (cyber.gov.au). Australian Signals Directorate (ASD), cyber.gov.au, checked 2 November 2026.
https://www.cyber.gov.au/guidance/help-during-a-cybercrime - Source 3: What to do if you've been scammed (Scamwatch). Scamwatch, National Anti-Scam Centre (ACCC), checked 2 November 2026.
https://www.scamwatch.gov.au/stop-check-protect/what-to-do-if-youve-been-scammed - Source 4: Recover from scams (cyber.gov.au). Australian Signals Directorate (ASD), cyber.gov.au, checked 2 November 2026.
https://www.cyber.gov.au/guidance/recover-from-scams - Source 5: Recover from business email compromise (guidance page, published 8 Sep 2026). Australian Signals Directorate (ASD), cyber.gov.au, checked 2 November 2026.
https://www.cyber.gov.au/guidance/recover-from-business-email-compromise - Source 6: Report a scam (Scamwatch). Scamwatch, National Anti-Scam Centre (ACCC), checked 2 November 2026.
https://www.scamwatch.gov.au/report-a-scam - Source 7: Small business scams: Scams impacting small business (Scamwatch guidance PDF). Scamwatch, National Anti-Scam Centre (ACCC), checked 2 November 2026.
https://www.scamwatch.gov.au/system/files/small-business-scams-guidance_1.pdf - Source 8: False billing: John updated supplier details and it ended up costing thousands (Scamwatch scam story, based on real reports). Scamwatch, National Anti-Scam Centre (ACCC), checked 2 November 2026.
https://www.scamwatch.gov.au/stop-check-protect/real-life-stories/false-billing-john-updated-supplier-details-and-it-ended-up-costing-thousands
Aptia Skills is a private training company. It is not connected with any bank, police force, regulator, FINTRAC or government, and this guide is general information, not legal or financial advice.