Business Email Compromise and Client Bank Details

Business email compromise redirects payments by making a criminal’s instructions look like a trusted email. Protect your practice and clients by calling an established number before changing bank details. If money has already moved, contact the paying bank immediately.

What Business Email Compromise is

Business email compromise (BEC) happens when a criminal takes over or imitates an email account to obtain money or change bank details. The recipient trusts the apparent sender and acts on instructions the real sender never authorised.

Your practice can meet three different forms. A criminal can take over your mailbox and send genuine-looking messages to clients. A lookalike domain can imitate your practice without anyone accessing your mailbox. A client’s or supplier’s compromised mailbox can send fraudulent instructions to your staff.

Phishing can steal the password that starts a mailbox takeover. BEC is the subsequent abuse of business trust, and an attack can also use impersonation without stealing a password. CEO fraud uses apparent authority to pressure staff into paying.

The ASD Cyber Threat Report 2024-25 records more than 84,700 cybercrime reports across all categories. BEC involving financial loss accounts for 15% of self-reported business cybercrime threats. The report also records a 138% increase in total reported BEC losses for large businesses. These figures describe reported crime, not the probability that your practice will suffer a loss.

How Fake Invoice Fraud Reaches a Practice and Its Clients

Fake invoice fraud changes the destination of a payment while preserving enough genuine information to make the request convincing. A mailbox takeover can unfold in this order.

1. The criminal gains access to a practice, client or supplier mailbox.
2. They read invoice threads and learn who expects a payment.
3. They send replacement bank details or an altered invoice within the conversation.
4. The payer transfers money to an account the criminal controls.

A familiar thread, correct invoice number or recognisable signature cannot establish who sent the new instructions. Scamwatch’s BEC guidance recommends checking payment changes by calling an independently sourced number.

These fictional examples show where your practice can interrupt the scam.

Request	What can go wrong	Check before acting
A client receives a replacement practice fee invoice	The amount and services are genuine, but the bank details are altered	The client calls your established office number before paying
A client emails a new refund account	Staff save the criminal’s account in your tax software and the refund goes there	Staff call the client on the number already on file and record confirmation
A supplier sends an invoice for work nobody ordered	Staff record and pay a false liability	Check the work against the order, then call the supplier independently
An email requests payment of a tax debt to a new account	The client pays a criminal who impersonates the practice or ATO	Obtain payment instructions through the client’s genuine ATO account or published ATO payment options

Clients must pay the Australian Taxation Office (ATO) through its published payment options. Treat an email announcing new ATO bank details as fraudulent. Open the ATO payment instructions independently and use the correct client payment reference.

Keep the original request and record the verification beside the invoice or bank-change task. Staff must be able to see that the check happened before payment or an account update.

Checks That Protect Client Refunds and Bank Details

Confirm every change to a client’s bank details by calling a number already on file. Never use a number supplied in the change email, its attachment or a reply from the same thread.

Before staff can apply that rule, your practice needs an established contact number and a named person authorised to give instructions. If the caller’s authority is unclear, stop the update and resolve it with the existing authorised contact.

1. Put the requested change on hold before editing any account details.
2. Call the client using the established contact record. Confirm that they requested the change and confirm the account name, BSB and account number.
3. Record the staff member, call date and time, number dialled, person reached and details confirmed. Keep bank details in the restricted client record.
4. Obtain the required approval under your practice’s payment procedure. Then update your tax software and the relevant ATO record.
5. Compare the saved account details with the confirmed instructions before lodging or releasing a payment.

If the client denies the request or cannot be reached, leave the existing details unchanged and escalate the suspicious email. A completed check means the saved details match the authorised client’s instructions and staff can retrieve the call record.

Collect bank details through a secure onboarding form instead of email. The new client form guide helps you collect the account details with the rest of the client’s information. Restrict staff access and treat every later change as a fresh high-risk instruction.

Refund Accounts and Professional Duties

ATO refund rules require an eligible account at an Australian financial institution. Account-holder rules allow the taxpayer, their registered agent and specified trustee or executor arrangements. An unrelated third-party account requires the Commissioner’s discretion, so a bank-change email cannot authorise that exception.

Where your practice receives refunds on trust, obtain the client’s authority for the arrangement and any fee deduction. Keep client money separate and account for what you receive and disburse. The TPB’s client-money guidance explains those responsibilities. Never redirect a refund to an account the client has not confirmed.

Section 30-10 of the Tax Agent Services Act requires honesty and integrity, lawful action in the client’s best interests and confidentiality. The TPB Code of Professional Conduct sets out these duties. Your call-back record helps demonstrate how staff protected the client’s instructions and money. Protecting mailbox access also limits disclosure of confidential client information.

Warning Signs Staff and Clients Can Spot

Changed payment instructions deserve an independent check even when the email has no obvious mistakes. Staff can look for these signs.

• Unexpected bank details or a replacement invoice with different payment instructions.
• Urgency, secrecy or pressure to bypass the usual approval.
• A domain with one changed character or a reply-to address different from the sender address.
• New payment instructions inserted into an old conversation.
• An invoice for services or goods that nobody ordered.

Mailbox warning signs include unfamiliar sign-ins, unexpected inbox rules and forwarding to outside addresses. Missing replies or messages moved into unusual folders can also warrant investigation. Ask your email administrator to investigate these signs before trusting the mailbox again.

If your practice adopts that policy, you can add this warning to invoices:

Our practice never changes its bank details by email. Before paying an invoice with different bank details, call our established office number.

A shorter email footer can say:

We never change bank details by email. Call our established office number to check any change request.

Apply the policy consistently and give clients the office number during onboarding. A warning printed on an altered invoice can itself be edited by the criminal.

Business Email Compromise Prevention for the Practice

Protect mailboxes and payment decisions together. Ask the email administrator to require multi-factor sign-in for staff and administrator accounts, using phishing-resistant methods where available.

Block automatic forwarding outside the practice unless a specific approved need exists. Set alerts for new inbox rules and review sign-ins regularly. Investigate unexpected locations, devices or access times instead of assuming a password reset ends the incident.

Configure the practice’s domain using the ASD guidance on email authentication.

• Sender Policy Framework (SPF) lists which servers can send email for your domain.
• DomainKeys Identified Mail (DKIM) adds a digital signature that receiving servers can check.
• Domain-based Message Authentication, Reporting and Conformance (DMARC) tells receiving servers how to handle messages that fail the domain checks and provides reports.

Have the administrator check every legitimate sender before tightening the DMARC policy. These measures reduce domain impersonation. They cannot stop a criminal sending from a genuinely compromised mailbox or registering a different lookalike domain. Monitor lookalike domains and investigate impersonation reports from clients.

Train staff with payment and bank-change examples, including an urgent request that appears to come from a principal. Nobody acts on a changed-bank email alone, regardless of the sender’s seniority. Use the wider practice cyber security checklist for other protections.

Where the paying bank provides Confirmation of Payee, investigate a name mismatch before continuing. A name match does not establish that the invoice or change request is genuine. The ACCC’s Targeting Scams Report 2025 describes the industry rollout, so keep the call-back rule in place.

If a Client or the Practice Has Been Caught

Call the paying bank immediately and ask its fraud team to stop or recall the transfer. Recovery depends on where the money has gone, so do not delay that call while completing an internal investigation.

1. Give the bank the transaction reference, amount, recipient details and payment time. Keep the bank’s case number.
2. Ask the email administrator to secure any compromised mailbox. Reset credentials, revoke active sessions and remove unauthorised rules or forwarding after preserving evidence.
3. Preserve the original emails with headers, attachments, sign-in records and payment evidence. Record who collected them and restrict access.
4. Report the fraud through ReportCyber and Scamwatch. Keep both report references.
5. If the scam impersonates the ATO or affects a client’s tax account, use the ATO scam reporting page and arrange urgent protection of the affected account.

ReportCyber has a police cybercrime reporting route. Follow police requests for evidence and contact local police directly where immediate assistance is needed. Reporting does not guarantee an investigation or repayment.

A compromised mailbox can also expose client information. Activate your data breach response plan to identify the information accessed and assess the risk of serious harm. Under the OAIC notification scheme, covered entities must notify eligible breaches. Tax File Number recipients can have obligations even where a small-business exemption otherwise applies.

Take reasonable steps to complete a suspected eligible-breach assessment within 30 days. If serious harm is likely and remedial action has not prevented that risk, arrange the required OAIC and affected-person notices promptly.

Contact affected clients through a channel you know is safe. State the confirmed facts, the payment or information at risk and the actions they must take. Explain which invoices or instructions they must disregard and give a safe contact route. Obtain legal and insurer advice before accepting liability, while continuing urgent protective action and required notices.

Before staff resume bank-detail changes, check that unauthorised access has ended and the call-back approval record is working. Assign an owner to each outstanding recovery action and follow up the bank and reporting references.