Scams

There’s no business in falling for scams.

How to spot a business email compromise scam

Sometimes, it can be hard to tell the real thing from the imitation. While there are times when this is a good thing, like enjoying an awesome cover band or your mate’s bang-on Arnie impression (‘get to da choppa!’), it also can bring challenges.

Scammers are becoming increasingly sophisticated in trying to lure businesses via email into making payments.

Known as ‘Business Email Compromise (BEC)’, scammers impersonate legitimate businesses in emails designed to take money away.

It pays to know how to spot business email scams so you can stay one step ahead of the scammers.

How it works

• Scammers gain access to a business’s emails and may pose as a senior member or trusted employee of the business to cause you harm.
• Scammers may also create fake email addresses posing as a legitimate business.
• Scammers pretending to be the business will email clients, customers and others to ask for payment and/or confidential information.
• They’ll change banking details on legitimate invoices so payments are sent to scammer accounts instead of the actual business.

3 signs of a BEC scam

• You receive an email asking you to click on a link taking you to a webpage asking for your username, password, or personal information.  
• There’s an urgent request for action, and you’re asked to provide money or personal details quickly or risk account suspension.
• A business claims to have changed banks since your last payment, and asks you to use a different bank account and BSB this time.

Specific things you can do

If you have a business or work for one, here are things to help avoid BEC:

1. Be vigilant against phishing

Phishing is a scam type where fraudulent messages (including email) are sent from scammers pretending to be from large organisations you know or trust.

You can be on the front foot against phishing by:

• Checking message details such as the spelling of a sender’s domain name. Double-check by comparing it to previous correspondence.
• Using spam and message-scanning services offered by your email, SMS or social media providers to filter potentially harmful content.
• Exercising caution when opening messages or attachments, and clicking on links from unknown senders.
• Not providing personal information (such as passwords, usernames, and PINs) to unverified sources.
• Contacting the business on a trusted phone number, to verify the authenticity of the communication or any key changes relating to payments.

2. Multi-factor authentication

Using multi-factor authentication (MFA) is one of the most effective controls in safeguarding access to computers, systems and online accounts. While scammers may have stolen login info from you, if you have MFA set up, it makes it harder for them to gain full access.

Multi-factor authentication can involve a combination of:

• Something the user knows (a passphrase, PIN or answer to a secret question).
• Something the user physically possesses (such as a smartcard, physical token or security key).
• Something the user inherently possesses (such as a retina pattern or fingerprint).

3. Be proactive in protection

Protecting yourself from scams including BEC is an ongoing responsibility. Ensure your business has a clearly-defined and known process for verifying and validating payment requests and handling sensitive information.

HR, accounts and finance teams may be particularly targeted by BEC given their access to payments and information, so having clear guidance on how to act upon these warning signs can help protect your business:

• An urgent payment request or threats of serious consequences if payment isn’t made.
• An unexpected change in bank details.
• Unexpected payment requests from someone in a position of authority, particularly if payment requests are unusual from this person.

3 steps you can take to stay prepared for business email scams

More useful resources

• ING. For our latest security alerts and more ways ING can help to protect you and your money, visit ing.com.au/security
• Scamwatch. To report a scam and get up-to-date information on how to avoid the latest scams targeting Australians, visit scamwatch.gov.au
• IDCARE. For free advice on how to respond to data breaches, scams, identity theft and cyber security concerns, visit idcare.org