AI Invoice Scams Cost Australian Businesses $167m in 2025

Australian businesses lost $166.8 million to payment redirection scams in 2025 — the fraud where a criminal impersonates a supplier, or your own director, and quietly reroutes a legitimate payment into their account. That's up 9.3 per cent on the year before. And AI is the reason it keeps working: the fake invoice now reads perfectly, and the 'urgent' call confirming a new bank account can be a cloned copy of a voice you know.

The National Anti-Scam Centre's Targeting Scams report for 2025, published by the ACCC on 30 March 2026, put total reported scam losses at $2.18 billion. Payment redirection — the category that lands squarely on businesses — accounted for $166.8 million of that, second only to investment scams. ACCC Deputy Chair Catriona Lowe named the driver directly: scam activity is growing more sophisticated 'through Artificial Intelligence and the industrialisation of criminal syndicates'.

The mechanics are old; the polish is new. A payment redirection scam intercepts or imitates a real business email thread — a supplier's invoice, a request to 'update our account details' — and swaps the account number. What used to give it away, the broken English and the odd formatting, is gone. Generative AI writes fluent, on-brand messages in seconds. The newer escalation is audio: attackers need only a few seconds of a recording to clone a voice, so the follow-up phone call can sound exactly like the person it claims to be.

Want to know what this means for your business? We'll map it in one call.

This is a cash problem before it is an IT problem. A trades business paying a $40,000 supplier invoice, or an accounting firm moving client funds, is one swapped account number away from a loss no one notices until the real supplier chases payment weeks later. By then the money has cleared, and in most cases it is unrecoverable. Business email compromise — intercepting or fabricating invoices to redirect payments — is already the most common cyber attack causing a financial loss for Australian businesses, at 15 per cent of reported incidents, per the ASD's Annual Cyber Threat Report. We've written before about how SMEs adopted AI faster than they secured it; payment redirection is where that gap turns expensive.

The uncomfortable part is that the controls most owners reach for don't catch this one. Antivirus doesn't stop it. A spam filter doesn't, because the email is often genuine — a real supplier account that's been compromised, or a lookalike domain a busy eye won't clock. Multi-factor authentication protects your logins, not your accounts-payable process. The attack targets a decision, not a device: someone approving a bank-detail change under time pressure. If you're not sure where a decision like that sits in your own business, a short call will map it.

The defence costs nothing. Never change a supplier's or an employee's bank details on the strength of an email or a phone call alone. Verify every change by calling the person back on a number you already had — not the one in the message. Put a second pair of eyes on any payment over a threshold you set. And treat urgency as a warning, not a reason to hurry: 'pay this today or we lose the discount' is the scammer's oldest lever, now delivered in a familiar voice.

The ASD's free small-business guidance at cyber.gov.au and the ACCC's Scamwatch both spell out the same callback rule. It works because it breaks the one thing AI can't fake for the criminal: a channel they don't control. This is the mirror image of the caution we urged before you hand an AI agent access to your business data — same principle, applied to the humans and machines asking you to move money.

Key takeaways

Common questions

Related notes

Not sure where a fake invoice could slip through your business?

A short call maps where money leaves your business and where a verification step belongs. Book a call to talk it through.