Protect your business from scams – expert tips and strategies

Scammers are getting smarter and more sophisticated in how they extract personal information or funds from businesses. Here are expert tips to help you stay ahead and protect your business from the threat of scams. This article is a partnership between the National Anti-Scam Centre’s ScamWatch and Australia Post’s Cyber Services.

The National Anti-Scam Centre’s latest Targeting Scams report (PDF 1.2MB) revealed that Australian businesses lost $19.9 million to scams in 2024 – and around 65% of that was from small businesses.

Scammers continue to routinely target businesses through fake emails, phone calls, text messages, social media advertisements, and screen pop-ups, causing significant and sometimes devastating impact.

What can businesses do to better protect themselves from scams? The National Anti-Scam Centre’s Scamwatch team shares their top tips and advice.

Be extra vigilant during certain times of the year that are favoured by scammers

Scammers are attuned to current events and the socio-economic climate, which means particular industries may be targeted at certain times of the year. For example, tax agents and accountants may find an increase in scam activity around tax time or the end of the financial year.

However, most scammers operate all year-round and are excellent at playing the long game. This means that businesses of all sizes need to watch out for the warning signs and take steps to protect themselves, their customers, and clients from this ongoing threat.

Understand how scammers operate

Scammers use social engineering and manipulative tactics to carry out their criminal pursuits.

They often create a sense of urgency, pressuring their victims to act quickly without pausing to consider and check that the communication is real.

They also find ways to turn our greatest attributes, like generosity, trust, and empathy, against us by coming up with fake stories, threats, and opportunities that are designed to make us act quickly and part with our information and money.

Stay updated on the most common business-related scams

1. False billing scams

In 2024, false billing scams were the most reported scam type by small businesses. They also resulted in the second-highest losses reported by businesses. These scams typically involve:

• Scammers impersonating businesses by using similar names, emails, domains, and logos and sending invoices that appear legitimate but divert funds to scammer accounts
• ‘Payment redirection scams’ where a business has its system compromised and the scammer sends emails directly to customers. In this scenario, the scammer will change the banking details within emails so that payments are sent to scammer accounts instead of to the business’ account.

Industries that typically send and receive large value payments are at greater risk of being targeted by these types of scams. These include real estate, legal and conveyancing, building and construction, and automotive.

2. Investment scams

In 2024, the highest losses reported by businesses were from investment scams, including crypto investment scams, imposter bond scams, and fake initial public offering.

Investment scams can be hard to spot but often involve the promise of making money with little or no risk. Scammers can make a fake offer sound too good to miss and may create a sense of urgency by saying that the offer is only available for a limited time.

Scammers can also impersonate legitimate investment and finance companies and come across as very knowledgeable and professional. They can even gain trust by posting fraudulent endorsements online from well-known and respected public figures.

3. Remote Access Scams

Remote Access Scams occur when businesses are contacted by scammers impersonating large telecommunications or IT companies – that businesses would commonly communicate with.

The scammer may say that the business has a technical problem, virus, or internet issue with a device that they can fix if they are granted remote access. Alternatively, the scammer may ask the business to download software which will also grant them remote access to the business’ device.

Remoting into a business’ device means that scammers can gain access to all accounts and systems on that device.

Practice the ‘Stop. Check. Protect’ method

Stop.

Pause before automatically paying an invoice, providing personal information of employees or customers or granting someone access to a business device.

Check.

Verify who you’re really communicating with whether it’s on the phone, email, text message or social media. To be sure, check:

• The sender’s name, email address, and domain
• The goods or services listed in an invoice were genuinely ordered
• The bank details on any invoice are correct. To do this, use details listed on official websites or secure apps. It’s important that businesses don’t use contact details in emails or invoices unless they have been independently verified
• The company or website is not named on the Moneysmart investor alert list

Protect.

Keep yourself, your clients and customers safe by:

• Getting independent legal or financial advice from a financial advisor registered with ASIC before committing to any investment opportunities
• Implementing strong cyber security controls in alignment to the advice from the Australian Cyber Security Centre’s website (Resource for Business and Government).
• Training employees to Stop. Check. Protect. before making any payments or giving out any information
• Encouraging your customers to use the AusPost app for secure tracking and delivery notifications
  

What to do if you’ve been scammed

• Contact your financial institution immediately
• Report the scam to Scamwatch to help warn others
• If systems have been compromised, report the incident to ReportCyber
• If your business has been impersonated or compromised, alert your customers and clients to prevent them from sending money to a scammer

For more information on how to protect your business from scammers, visit https://www.scamwatch.gov.au/research-and-resources/resources/dealing-with-business-impersonation-scam-resources