What payment redirection is
Payment redirection is when a criminal gets a business to pay money into the wrong bank account. The usual trick is a message that looks like it comes from a supplier, a boss or a colleague and says: "our bank details have changed". The money leaves your account and lands in the criminal's account. The usual name for the wider problem is business email compromise, or BEC.
There are two common ways in. In the first, the criminal breaks into a real email account, such as a supplier's, and edits real invoices. The customer thinks they are paying the supplier, but the bank details are the criminal's. In the second, the criminal makes a fake address that looks almost the same as a real one. In both cases the first sign of trouble is often a real supplier asking why they have not been paid.
Remember
Facts and sources for this part
- Business email compromise (BEC) is a scam where criminals use email to trick an organisation into sending money, sharing sensitive information or handing over goods. [KS9]
- In invoice fraud, criminals get into a supplier's email, change the bank details on real invoices and send them on. The customer thinks they are paying the supplier, but the money goes to the criminals' account. [KS9]
- Scammers hack supplier email accounts and collect customer lists, bank details and previous invoices to make their fake requests look real. [KS4]
- A payment redirection scam may not be noticed until the real supplier complains that they were never paid. [KS4]
Why it works so well
Criminals do homework. Spain's cybersecurity institute (INCIBE) reports that attackers often sit inside a mailbox for several weeks, learning how payments work, and then pick their moment: a big invoice is due, there is a new customer, or the manager is on holiday. They add pressure ("this is urgent", "keep this between us") so the person paying does not stop to ask anyone.
The Australian Cyber Security Centre points to the same things from the staff side: a sudden change of bank details, an urgent request, threats if payment is late, or an unusual request from someone senior. Notice that none of these needs clever technology. They work because people want to be helpful and fear letting the boss down. A calm, written process takes that pressure off the person at the keyboard.
Remember
Facts and sources for this part
- The Australian Cyber Security Centre lists these warning signs for staff: an unexpected change of bank details, an urgent payment request, threats if payment is not made, and an unusual request from someone in authority. [KS9]
- One common method is to pretend to be a senior person, such as a chief executive or chief financial officer, and have a false invoice raised. [KS9]
- INCIBE says attackers often sit inside the victim's mailbox for several weeks, learning how payments work before they act. [KS34]
- INCIBE says they pick the moment, for example when a large invoice is expected, there is a new customer, or the manager is on holiday. [KS34]
- INCIBE says the attacker usually writes that the matter is confidential, to stop the employee asking colleagues. [KS34]
- INCIBE says the attack plays on urgency, trust and fear of disobeying a superior, so the payer makes the transfer without checking. [KS34]
The numbers, with dates and sources
Australia: in 2025 people reported combined scam losses of $2.18 billion (Australian dollars), up 7.8% from 2024, according to the National Anti-Scam Centre. Payment redirection was the second-largest scam type by loss, at $166.8 million. The same report says false billing was the most reported scam type for businesses, and that small businesses reported more scams and higher losses than medium and large ones.
United States: the FBI's 2025 report ranks business email compromise second for reported losses, after investment fraud, at about US$3.05 billion. These are figures that people reported, not a count of every case. Scam types and countries are counted in different ways, so do not add or compare these numbers directly. Your course adds the figures and reporting bodies for your own country.
Remember
Facts and sources for this part
- In 2025 Australians reported combined scam losses of $2.18 billion, up 7.8% from 2024. [KS1]
- Payment redirection was the second-largest scam type by loss in Australia in 2025, at $166.8 million in combined reports. [KS1]
- Scamwatch's report says business reports of false billing generally relate to payment redirections, also called business email compromise, and that small businesses reported more scams and higher losses than medium and large ones. [KS1]
- The FBI's 2025 report ranks business email compromise as the second-largest source of reported losses in the United States, after investment fraud, at about US$3.05 billion. [KS16]
A real-style case: $17,000 after one email
Scamwatch describes a case, with the names removed, where an accounts clerk received an email late on a Friday that appeared to come from a regular overseas supplier. It said the supplier's bank details had changed. The clerk updated the details in the system and, a few days later, paid $17,000 to the new account. Two weeks later the goods had not arrived, and the real supplier said it had never asked for a change. The business estimated its total loss at over $30,000, once missed orders were counted.
Look at what went wrong: one email changed the bank details, nobody else saw the change, and nobody phoned the supplier. Each of those is a gap you can close. The next modules show how.
Remember
Facts and sources for this part
- Scamwatch's example of a false billing case: an accounts clerk changed a supplier's bank details after one email, paid $17,000 to the wrong account, and the business estimated its total loss at over $30,000. [KS6]
- A payment redirection scam may not be noticed until the real supplier complains that they were never paid. [KS4]
Scenario 1: an email
Elena works in accounts payable at Kestrel Timber Co (an invented business). At 4:40 pm on a Friday she gets an email from "accounts@harbourline-supplies.example" saying Harbourline Plumbing Supplies has changed banks and the $12,400 invoice due Monday must go to a new account. The signature and logo look right. The email ends: "Please confirm today so we avoid late fees."
Red flags: A change of bank details arrives by email only; Sent late on a Friday with a short deadline; The sender address is not the one used on past invoices (the domain differs by a few letters); The message threatens a late fee to create urgency.
What to do: Do not reply to the email and do not use any number in it. Phone Harbourline on the number already in your supplier file, ask for the person you normally deal with, and confirm the change out loud. Keep paying the old account until a second person has approved the new details in writing. Tell your manager and the IT team about the email, because it may mean the supplier's mailbox has been taken over.
Remember
- A change of bank details arrives by email only
- Sent late on a Friday with a short deadline
- The sender address is not the one used on past invoices (the domain differs by a few letters)
- The message threatens a late fee to create urgency
Facts and sources for this part
- Scammers hack supplier email accounts and collect customer lists, bank details and previous invoices to make their fake requests look real. [KS4]
- Fake sender addresses are often made by adding, removing or subtly changing characters in the real address, so the fake is hard to spot. [KS4]
- The Australian consumer regulator's advice is not to check a suspicious payment request by replying to the email, because you may be talking to the scammer or the email may be intercepted. [KS4]
- The same advice is to phone the supplier using contact details you already hold or found independently, never a number listed in the suspicious email. [KS4]
- The Australian Cyber Security Centre lists these warning signs for staff: an unexpected change of bank details, an urgent payment request, threats if payment is not made, and an unusual request from someone in authority. [KS9]
Scenario 2: an email
Marcus, a finance officer at Wattle and Finch Accounting (invented), gets an email that appears to come from the managing director, Dana. It says: "I'm boarding a flight. I need a confidential payment of $38,000 to a new supplier today. Don't discuss this with anyone, I'll explain later. Details attached." The display name is Dana's, but the address is a free webmail account.
Red flags: Urgent, secret and unusual, from a senior person; The sender cannot be reached to explain (boarding a flight); A new payee and a large amount with no purchase order; The address is a free webmail account, not the company domain.
What to do: Do not pay. Contact Dana through a channel you already trust, such as her saved mobile number or a message through the company's own chat, and ask whether she sent it. Follow the normal approval steps for a new payee: a second approver and a purchase order. Report the email to IT. A real executive will not mind a short check.
Remember
- Urgent, secret and unusual, from a senior person
- The sender cannot be reached to explain (boarding a flight)
- A new payee and a large amount with no purchase order
- The address is a free webmail account, not the company domain
Facts and sources for this part
- One common method is to pretend to be a senior person, such as a chief executive or chief financial officer, and have a false invoice raised. [KS9]
- The Australian Cyber Security Centre lists these warning signs for staff: an unexpected change of bank details, an urgent payment request, threats if payment is not made, and an unusual request from someone in authority. [KS9]
- INCIBE says the attacker usually writes that the matter is confidential, to stop the employee asking colleagues. [KS34]
- Staff should have a way to report threatening demands for immediate action, pressure for secrecy, and requests to get around the normal payment steps. [KS9]
- Its checklist also recommends a dual-control rule, where two people authorise transfers above a set amount. [KS34]
Scenario 3: a chat message
A new starter, Tom, gets a message on the company chat from "Dana (MD)": "Hi Tom, are you at your desk? I'm in meetings and need a favour. Can you buy five gift cards for a client and send me the codes? I'll reimburse you today." The profile photo is Dana's, but the chat account was created this morning.
Red flags: A senior person asks a new employee for a personal favour that involves paying; Gift cards and codes are a payment method that is hard to reverse; The account is brand new, even though the photo looks right.
What to do: Do not buy anything. Ask a colleague or your manager in person, or check with Dana by phone. Report the account to IT so it can be blocked. Tom did nothing wrong by asking: newcomers are targeted because they do not yet know who normally asks for what.
Remember
- A senior person asks a new employee for a personal favour that involves paying
- Gift cards and codes are a payment method that is hard to reverse
- The account is brand new, even though the photo looks right
Facts and sources for this part
- INCIBE lists gift-card purchases presented as urgent company payments as a common CEO-fraud variant. [KS34]
- INCIBE says the attacker usually writes that the matter is confidential, to stop the employee asking colleagues. [KS34]
- INCIBE says the attack plays on urgency, trust and fear of disobeying a superior, so the payer makes the transfer without checking. [KS34]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
At 4:40 pm on Friday you get an email from a regular supplier saying their bank account has changed and the invoice due Monday must go to the new one. What is the best first step?
Show the answer
Right answer: C, Phone the supplier on the number in your own file and confirm before changing anything. Replying to the email or calling a number in it may reach the scammer. Use contact details you already hold, as Scamwatch advises. [KS4]
Question 2 of 3
Where should the phone number you use to verify a bank-detail change come from?
Show the answer
Right answer: C, Contact details you already hold, or ones you find yourself from a trusted source. The scammer controls any number inside their message. Use the record you already trust. [KS4]
Question 3 of 3
In the National Anti-Scam Centre's 2025 report, where did payment redirection rank among Australian scam types by combined loss?
Show the answer
Right answer: A, Second, after investment scams. The report lists investment first ($837.7 million) and payment redirection second ($166.8 million). [KS1]