Christmas Invoice Fraud: A Call-Back Checklist for Accounts Teams

Reported payment redirection losses in Australia reached $166.8 million in 2025, more than the year before, and the end-of-year invoice rush gives scammers cover. This guide explains how the scam works and gives your accounts team a call-back procedure, a payment-approval checklist and the steps to take if money has already gone.

Why is December a risky month for accounts teams?

Invoice volume goes up, people take leave, approvers are harder to reach and everyone wants to clear the payables before the break. That mix of urgency, unfamiliar faces covering desks and pressure to "just get it paid" is what a payment redirection scam needs.

The numbers back up the worry. The National Anti-Scam Centre’s Targeting Scams report for 2025, published on 30 March 2026, puts payment redirection losses (combined from reports to Scamwatch, ReportCyber, IDCARE, the Australian Financial Crimes Exchange and ASIC) at $166.8 million, up from $152.6 million in 2024 (about 9%). Payment redirection was the second-largest scam category by loss in 2025, behind investment scams. These are reported losses only, so the real figure is higher.

None of this needs a sophisticated attacker. It needs one email that arrives at the right moment and one person who acts on it without checking.

How does a payment redirection scam work?

ASD’s Australian Cyber Security Centre (ACSC) describes the common pattern as invoice fraud: criminals get into a supplier’s email account, find genuine invoices, change the contact and bank details, and send them to the supplier’s customers from the real account. The customer pays, thinking they’re paying the supplier.

There are three common variations.

1. The supplier’s real mailbox is compromised. The email comes from the genuine address, in the existing thread, often with the correct invoice number and amount. Nothing about the email itself looks wrong. This is the hardest version to catch by eye, and the reason a call-back rule matters more than training people to "spot the fake".

2. A lookalike domain. The scammer registers a domain that differs by one character (supp1ier.com.au instead of supplier.com.au), a swapped TLD (.com instead of .com.au) or an extra word (supplier-accounts.com.au). ACSC’s warning signs include "an email address that doesn’t look quite right, such as the domain name not exactly matching the supplier’s company name".

3. Someone inside your business is impersonated. A message that appears to come from the owner or finance manager asks for an urgent payment, or an "employee" asks payroll to update their bank account. The money goes to the scammer either way.

Typical triggers to watch for, all drawn from ACSC’s list:

• an unexpected change of bank details
• an urgent payment request, or threats of consequences if payment isn’t made
• an unusual payment request from someone in authority
• a sender address that doesn’t quite match

A common example: a regular supplier emails in early December to say they’ve "moved banks for the new financial setup" and attaches an updated invoice on their letterhead. The thread is genuine, the amount is right and the supplier’s signature block is intact. The only change is the BSB and account number.

The call-back procedure (print this)

This is the core control. Print it, stick it next to whoever processes payments, and make it a rule, not a suggestion.

Bank-detail change: call-back procedure

1. Stop. Do not update the supplier record or pay anything yet, even if the request looks routine.
2. Find a number you already hold. Use the phone number in your supplier file, a previous contract, or the supplier’s official website. Never use a number, link or contact name from the email, invoice or attachment that asked for the change.
3. Call and ask an open question. "Can you confirm the BSB and account number we should be paying?" Let them read the details to you. Don’t read your new details to them and ask "Is that right?"
4. Speak to someone you can identify. Ideally the person you normally deal with. If you can’t reach anyone, the change waits.
5. Record the check. Note the date, time, number called, the person you spoke to and what they confirmed. Keep it with the supplier record.
6. Have a second person approve the change. The person who verified the call should not be the only person who updates the bank details.
7. Tell the supplier if the request was fake. Their mailbox may be compromised, and other customers may be receiving the same email.
8. Report it internally. Forward the suspicious email (as an attachment) to whoever manages your IT or security, and don’t delete the original until they say so.

Two details make this work in practice.

First, the number must come from somewhere the scammer couldn’t have touched. If the supplier’s mailbox is compromised, the scammer controls everything in that email thread, including the phone number in the signature. Scamwatch’s advice is the same: call the business using contact details you’ve found independently to check the payment details are correct.

Second, text messages and replies to the same email are not verification. Scamwatch notes that if you reply to ask about the new payment details, the scammer will respond "explaining" the change.

Payment-approval checklist

The call-back stops the most common version. These checks cover the rest. Use them for every payment run, and especially in the last weeks before the break.

Before the payment run

• Every bank-detail change since the last run has a recorded call-back (who, when, which number).
• New suppliers were verified before their first payment, using details from an independent source (their website, an ABN lookup for the business name, a signed contract).
• No payment is going to a new account for the first time without a second approver.
• Any "urgent" or "before Christmas" payment that skipped the normal process has been flagged and checked.

Approval

• Payments are approved by someone other than the person who entered them.
• Payments over a threshold you set (in writing) need two approvers.
• An approval request that arrives by email from a senior person and asks you to skip the process is treated as a red flag, and confirmed by phone or in person.

In your banking platform

• Dual authorisation is switched on for new payees and payments over your threshold, if your bank offers it.
• Payee names are checked against the account details where your bank provides a name-check or confirmation-of-payee feature.
• Banking logins use multi-factor authentication and aren’t shared.

Staff and cover

• Whoever is covering accounts over the holidays has read this checklist and knows who to call.
• Staff know they won’t be in trouble for delaying a payment to check it.

Process like this is what ACSC recommends: "a clear and consistent business process for workers to verify and validate requests for payment and sensitive information", with a way to report pressure to skip it.

What do you do if the money has already gone?

Speed matters most in the first hours, because banks can sometimes stop or recall funds that haven’t been moved on. Recovery isn’t guaranteed, so don’t wait to be sure before you act.

1. Call your bank immediately. Use the number on the back of your card or on the bank’s official website. Tell them it’s a scam payment and ask them to stop or recall the transaction and contact the receiving bank. Scamwatch’s first step is to contact your bank and ask them to stop any transactions.
2. Report it as a cybercrime through ASD’s reporting page at cyber.gov.au/submit-a-report. Record what happened, when, how you think it happened and what you’ve done since. Keep the report reference number (it starts with CIRS-), because your bank and insurer may ask for it.
3. Contact IDCARE on 1800 595 160 or through idcare.org. IDCARE is Australia and New Zealand’s national identity and cyber support service and can help you make a plan, for free, to limit the damage.
4. Tell the supplier, using the number you already hold. If their mailbox is compromised, they need to know, and so do their other customers.
5. Preserve evidence. Keep the original emails (don’t just forward and delete), the invoice, bank records and your call notes.
6. Check your own mailbox. If the fake request came from inside your business or was in a thread you started, your own account may be compromised. Our guide to what to do when business email is hacked covers the first hour step by step.
7. Tell your insurer if you hold cyber or crime cover, and check the policy for notification deadlines.
8. Watch for follow-up scams. Scamwatch warns that people who have lost money are often targeted again, especially by someone offering to recover it.

If you’re unhappy with how your bank handled it, you can complain to the Australian Financial Complaints Authority (AFCA). If personal information was exposed, you may also have obligations under the Notifiable Data Breaches scheme. This is general information, not legal advice; our Notifiable Data Breaches scheme guide explains the assessment.

How do you brief staff before the holiday rush?

You don’t need a full training program to make a difference this month. A 15-minute briefing with the people who touch payments, and anyone covering for them, does most of the work. Cover four points.

1. The rule. "We never change bank details without a call-back to a number we already hold. No exceptions, including for the boss." Hand out the printed procedure.

2. What it looks like. Walk through the three variations above. Stress that a compromised supplier mailbox produces a perfect-looking email in a real thread, so "it looked genuine" isn’t a reason to skip the check.

3. Permission to slow down. Say out loud that delaying a payment to verify it is the right call, even if a supplier or a manager is annoyed. Scammers rely on urgency, and staff need to know the business will back them.

4. Who to tell. Give one name and number for "I think something’s wrong", including for the days between Christmas and New Year.

Then do three practical things:

• Send a short note to your regular suppliers saying you verify all bank-detail changes by phone. It sets expectations and tells them to call you if they get an odd request "from" you.
• Check that your own domain is protected against spoofing with SPF, DKIM and DMARC, so scammers can’t easily send email that appears to come from your exact address. Our step-by-step guide for Microsoft 365 covers it.
• Make sure every mailbox, especially finance and management, uses multi-factor authentication. ACSC lists it as a key action against business email compromise.

If you’d like staff to practise spotting these emails before a real one lands, our security awareness training includes realistic phishing simulations built around scenarios like this one.

Key takeaways

• Payment redirection losses reported in Australia rose to $166.8 million in 2025, and December’s invoice rush gives scammers cover.
• A compromised supplier mailbox produces an email that looks completely genuine, so rely on process, not spotting.
• Verify every bank-detail change by calling a number you already hold, ask an open question, record the check and get a second approval.
• If money has gone, call your bank first, then report it at cyber.gov.au, contact IDCARE and the supplier, and keep all the evidence.
• Brief payment staff before the break and tell them, in writing, that slowing a payment down to check it is always acceptable.

Sources

• National Anti-Scam Centre, Targeting scams report (2025 data, published 30 March 2026): combined losses and top five scams by loss, infographic text version
• ASD’s ACSC, Protecting against business email compromise: invoice fraud pattern, warning signs, verification process, recovery steps
• ASD’s ACSC, Recover from business email compromise (published 8 September 2026): reporting, CIRS reference number, notifying contacts
• ASD’s ACSC, Submit a Report
• Scamwatch, Scam alert: Fake business invoice scams (4 April 2024): how the scam works, independent call-back
• Scamwatch, What to do if you’ve been scammed: contact your bank, IDCARE, AFCA, follow-up scams
• IDCARE, idcare.org