Guides & Blog · 2026-10-31 · eWEB TEC

Last reviewed: 31 Oct 2026

Fake Invoice Emails: How a Small Office Stops Them

A fake invoice email is usually business email compromise: a criminal poses as a supplier, customer or staff member so you pay them or change someone’s bank details. The Australian Signals Directorate (ASD) says small businesses are often targeted because payment approvals and account changes may rely on trust and email. One phone check, done every time, is the main defence.

ASD’s last annual report put the average self-reported cost per cybercrime report for a small business at $56,600 in 2024-25. That figure covers all cybercrime reports, not only invoice fraud.

Three ways the email reaches you

ASD describes these routes in its small business guidance and its account compromise page. The last column is why no single check covers all three.

The rule to set this week

ASD’s advice is to introduce policies that verify requests. Written down for a small office, that comes to four lines:

• Any request to change payment details, or to make a large transfer, goes through an approval step.
• Verify it by calling and speaking to the sender on a verified number, not a number from the email.
• Staff know how to verify account details and are expected to stop and think about unusual requests.
• Demands for immediate action, pressure for secrecy, or requests to skip your normal process get reported to a named person.

Spotting a look-alike address

Criminals register domains that look like a business you know. ASD lists these tricks. The examples below are ours, using a made-up supplier, acmeplumbing.com.au.

ASD also suggests considering registering domains similar to your own business name, so fewer of these are available to use against your customers.

Checking a Microsoft 365 mailbox

Microsoft’s guide lists these signs that a Microsoft 365 mailbox may be compromised:

• Inbox rules that forward email to unknown addresses, or move messages to Notes, Junk Email or RSS Subscriptions
• External forwarding that nobody remembers adding
• Missing or deleted email, or strange messages in Sent Items or Deleted Items
• Frequent password changes or unexplained lockouts
• The mailbox is blocked from sending email

If you see any of these, Microsoft’s order of work is:

1. Disable the account, or if you cannot, reset the password. Do not email the new password to the user.
2. Revoke active sign-in sessions.
3. Remove unfamiliar multi-factor authentication methods and devices.
4. Remove apps the user should not have consented to.
5. Remove admin roles the user should not have.
6. Remove forwarding and suspicious inbox rules, including hidden ones.

App passwords are not revoked by a password reset, so they need deleting and recreating as well.

Stopping fakes of your own address

If your business uses its own domain for email, ASD says email authentication can stop criminals sending fake email that appears to come from you. Ask whoever runs your email and DNS to add SPF, DKIM and DMARC. Fakes then normally go to the recipient’s spam folder or are not delivered.

If you have already paid

1. Contact your bank or financial institution immediately, on its official number.
2. Report it at cyber.gov.au/report or call 1300 CYBER1 (1300 292 371).
3. Check the mailbox as above. Assume anything sent from it during the period may be fake, and warn the customers and suppliers concerned.
4. If personal information was exposed, the breach clocks in our ransomware guide may apply. Tell your cyber insurer if you have one.

FAQ

Related service: Business IT support · Essential Eight basics · contact eWEB TEC.