Key takeaways
- Payment redirection scams trick a client or a business into paying money to a criminal’s bank account, usually by sending a convincing email with “updated” bank details.
- Builders are attractive targets because large progress payments and deposits move regularly between clients, builders and suppliers, often by email invoice.
- The attack often starts with a compromised email account, yours, a supplier’s or a client’s, or a lookalike domain that is one letter different.
- The single most effective control is verifying any change of bank details by phone, using a number you already have, never one in the email.
- Multi-factor authentication on email, clear written payment instructions in the contract, and staff who know the warning signs stop most attacks.
Imagine the call. Your client says they paid the frame stage claim three days ago, but it has not arrived. They show you the invoice. It has your logo, your ABN, your usual wording and the right amount. The only thing that is different is the bank account, and a short note in the email saying your bank details had changed. The money is gone.
Payment redirection scams, also called business email compromise or invoice fraud, are one of the most damaging cyber crimes facing Australian businesses, and the building industry is a favourite target. This guide explains how the scams work, why builders are attractive targets, and the simple controls that stop them.
Why builders are targets
Criminals go where the money moves, and in building the money moves in large amounts, often by email.
- Large, predictable payments. Deposits and progress claims are often tens of thousands of dollars, due at known stages.
- Invoices by email. Most claims and supplier invoices arrive as PDFs attached to an email, which is easy to imitate.
- Many parties. Clients, builders, subcontractors, suppliers, conveyancers and lenders all exchange payment information.
- Small businesses. Many building businesses have no IT department, shared passwords and limited security.
- Busy people. A supervisor or office manager paying twenty invoices on a Friday afternoon is exactly the person scammers hope to catch.
How the scam works
How a payment redirection scam usually unfolds
- 1AccessThe scammer gets into an email account by phishing or a leaked password, or registers a lookalike domain.
- 2WatchThey read emails quietly to learn who pays whom, when, and how invoices look.
- 3StrikeAt the right moment, they send a genuine-looking invoice or a note saying the bank details have changed.
- 4PressureThe message stresses urgency: pay today, or work stops, or a discount is lost.
- 5VanishThe money is moved on quickly. By the time the real payee asks, it is often gone.
The most dangerous version starts inside a real email account. A builder’s office email is compromised through a phishing link or a reused password. The criminal reads the inbox for weeks, learning who the clients are, when claims are due, and how invoices are worded. When a large claim is about to go out, they send the client the real invoice, altered with their own bank details, from the builder’s real email address. Nothing looks wrong, because it is coming from the right account.
Other versions use a lookalike domain, an email address one character different from yours or your supplier’s, or they compromise a supplier’s email and send the builder a fake “change of bank details” before a large supplier payment. The scam can hit you as the payee, as the payer, or both.
Who loses, and why it gets messy
When a client pays a fake account, a difficult question follows: who bears the loss? The client says they paid the invoice they were sent. The builder says they never received the money and the account was not theirs. Recovery from the criminal is rare once the money has moved. The answer can depend on the facts, the contract, and whose systems were compromised, and these disputes can end in legal proceedings that damage the relationship and the job.
Builders are also exposed as payers. Paying a supplier’s invoice to a fraudulent account does not usually discharge the debt to the real supplier, who still wants to be paid.
Never change bank details on the strength of an email. Not from a supplier, not from a subcontractor, not from someone claiming to be your accountant. Call the person on a number you already have, not one in the email, and confirm the change directly.
The warning signs
Red flags in an invoice or payment email
- A request to change bank details, especially close to a payment date.
- An email address that is slightly different from the usual one: a swapped letter, an extra word, a different domain ending.
- Unusual urgency or pressure to pay immediately.
- A reason why the usual account cannot be used, such as an “audit” or “bank problem”.
- A request to keep the change confidential or not to call.
- Small differences in the invoice layout, logo, ABN or phone number.
Controls that stop it
Controls that stop payment redirection
| Control | What it stops |
|---|---|
| Call-back verification of any bank detail change, on a known number | Almost all redirection attempts, whatever the email looks like |
| Multi-factor authentication on every email account | Most account takeovers from stolen passwords |
| Bank details stated in the signed contract, with a warning they will never change by email | Clients paying a fake account after a spoofed email |
| Two-person approval for new payees and large payments | A single staff member being tricked under pressure |
| Bank name-checking services where available | Payments to an account whose name does not match |
| Staff training on the warning signs | Clicks on phishing links and rushed payments |
Call-back verification
This is the control that stops almost every payment redirection attempt, however convincing the email. Any change to bank details, for any payee, is verified by phone using a number already on file, before any payment is made to the new account. Make it a written rule in the business, and apply it every time, including when the request comes from someone senior or familiar.
Protect your email
Turn on multi-factor authentication for every email account in the business. It is the single most effective protection against accounts being taken over with stolen passwords. Use strong, unique passwords, ideally with a password manager. Remove access for former staff promptly. If you use shared accounts such as “accounts@”, secure them just as carefully.
Tell your clients, in writing
Put your bank details in the signed contract, and state clearly that you will never change them by email. Repeat the warning on every invoice and progress claim: “We will never change our bank details by email. If you receive such a request, call us on the number in your contract before paying.” Many builders also call clients before large payments to confirm details verbally. Clients appreciate it, and it protects both parties.
Two sets of eyes
Require a second person to approve new payees and changes to bank details, and payments above a set amount. Scammers rely on pressure and urgency; a second approval breaks the pressure.
Use your bank’s tools
Australian banks have been introducing services that check whether the account name matches the account details before a payment is made, and many offer alerts and payment limits. Use them, and pay attention when a name check does not match.
Train your people
Anyone who handles payments or opens invoices should know the warning signs and the call-back rule. A short session once a year, and a reminder when a scam is in the news, goes a long way.
A worked example: the supplier who “changed banks”
A builder’s office manager receives an email from their regular timber supplier’s accounts contact. It says the supplier has moved to a new bank and asks for future payments to go to a new account. The email address looks right, the signature block is the usual one, and the tone is familiar. A large invoice for frames and trusses is due that week.
Under the business’s rule, the office manager does not update the bank details. Instead, they call the supplier’s accounts line using the number saved in the accounting software. The supplier has not changed banks. Their email account has been compromised, and the scammer has been sending the same message to several of the supplier’s customers.
The builder pays the real account, warns the supplier, and forwards the fake email to their IT support. The call took two minutes. Without it, the builder would have paid a five-figure invoice to a criminal and still owed the supplier.
A written payment policy for a small building business
A short written policy makes the controls stick, especially when staff change. It can be a single page:
- Bank details for new payees are only accepted on the supplier’s letterhead or through the accounting software’s verified process, and confirmed by phone on an independently sourced number.
- Any change to existing bank details is confirmed by phone on the number already on file, and approved by a second person, before any payment.
- Payments above a set amount require two approvals.
- Our own bank details are stated in every contract and never changed by email; every invoice says so.
- All email accounts use multi-factor authentication; shared passwords are not allowed.
- Anyone who suspects a scam reports it immediately, with no blame for raising a false alarm.
That last point matters. Staff who fear being blamed for delaying a payment are more likely to pay a fake invoice under pressure. Make it clear that checking is always the right call.
If it happens
- Call your bank immediately and ask them to try to stop or recall the payment. Speed matters.
- Ask the payer’s bank to contact the receiving bank too, if you were the intended recipient.
- Report it to the police through ReportCyber, the Australian Cyber Security Centre’s reporting service.
- Secure your email: change passwords, turn on multi-factor authentication, check for forwarding rules the criminal may have set up, and review who has access.
- Tell affected clients and suppliers so they can check other payments and watch for further fake emails.
- Consider your privacy obligations. If personal information was exposed, the Notifiable Data Breaches scheme may apply to your business.
- Talk to your insurer, particularly if you hold cyber insurance.
Cyber insurance
Cyber insurance can cover some of the costs of an incident, such as investigation, recovery and sometimes losses from social engineering fraud, depending on the policy. Policies vary widely, and many require specific controls, such as multi-factor authentication, to be in place. Read the policy carefully and make sure the controls it requires are actually in place.
Other scams builders see
- Fake supplier accounts ordering materials on credit in your business’s name.
- Phishing emails pretending to be from the ATO, your bank, or a government regulator.
- Fake tender invitations that lead to credential-stealing websites.
- Impersonation of your business to take deposits from clients for jobs you never quoted.
The same controls help with all of them: verify through a known channel, protect your accounts, and slow down when an email asks for money urgently.
The bottom line
Payment redirection scams succeed because they look exactly like normal business. The defence is equally simple: never change bank details on the strength of an email, verify every change by phone on a known number, protect your email with multi-factor authentication, and tell your clients in writing that your bank details will never change by email. Those four habits stop almost every attempt.
Questions builders ask
What is a payment redirection scam?
A scam in which a criminal tricks someone into paying money to the criminal’s bank account, usually by sending a convincing invoice or email with changed bank details.
How do I stop clients paying the wrong account?
Put your bank details in the signed contract, state on every invoice that you will never change them by email, and encourage clients to call you on a known number before large payments.
What should I do if a supplier emails new bank details?
Do not pay to the new account until you have called the supplier on a number you already have, not one in the email, and confirmed the change directly.
What do I do if money has been sent to a scammer?
Call your bank immediately to try to stop or recall the payment, report it through ReportCyber, secure your email accounts, and warn affected clients and suppliers.
Does multi-factor authentication help?
Yes. It is one of the most effective ways to stop email accounts being taken over with stolen passwords, which is how many redirection scams start.
Sources
- Business email compromise · Australian Signals Directorate’s Australian Cyber Security Centre
- ReportCyber · Australian Cyber Security Centre
- Notifiable Data Breaches scheme · Office of the Australian Information Commissioner
Published 16 August 2026. General information for builders, not legal, financial or engineering advice for a specific job. Check current requirements with the relevant regulator or standard before relying on them.
