Why Payment Redirection Scams Are Surging And How To Stay Ahead Of Them

They’re quietly becoming one of the most damaging financial threats facing Australian organisations – payment redirection scams are growing in both frequency and sophistication.

The overall structure is simple: scammers masquerade as familiar vendors, asking for payments or changes to bank details. They might even build rapport with victims for months before, say, sending them a fraudulent invoice to pay.

Whatever the tactic, the final result can be losing thousands or millions of dollars to a scammer. And these scams are disturbingly common. In fact, this year, we’ve seen the largest volume of known fraud attempts on record since Eftsure’s founding in 2015.

In other words, strengthening your finance processes is more crucial than ever. Here’s why it’s a growing problem and what you can do about it.

Entrance Through Emails

For many businesses, the invoice process still revolves around email. It’s how invoices are sent, how bank detail updates are communicated and how many teams confirm what needs to be paid. Yet email has no built-in mechanism to confirm the identity of the sender and no way to verify that payment details haven’t been tampered with.

This means businesses have a major vulnerability. Fraudsters may not even need to breach any company’s systems – they sometimes only need to replicate a communication that looks and sounds familiar. Once trust is established, it’s easier to make requests like sending payment to a new bank account or processing an invoice outside of usual controls.

Fraud At Scale

In some cases, attackers will spend weeks monitoring inboxes, learning how a supplier communicates and timing their fraud to coincide with an actual invoice. In others, they’ll impersonate domains or internal staff to make a request look legitimate. We’ve even stopped fraud attempts in which a malicious actor infiltrates systems of both the target organisation and the vendor, orchestrating “conversations” between both parties as a way to give greater credibility to fraudulent invoices or requests.

In the past, it would’ve taken scammers significant time and effort to coordinate such highly targeted attacks. Now, scammers can quickly and cheaply research targets, refine messages, forge official-looking documents and analyse emails or stolen data in a matter of seconds.

This new speed and efficiency comes from rapidly accelerating artificial intelligence (Ai) capabilities, along with a growing pool of data fuelled by breaches like those at Medibank or Latitude. Data about scam targets has never been easier to find, whether it’s traded on the dark web or gleaned from publicly available information on social media or company websites.

Where Businesses Go Wrong

Across the payment environments, a consistent pattern emerges. Most vendors are onboarded once and rarely change their bank details. When those details do change mid-relationship, especially via email, that’s a big red flag. But, under pressure to meet payment deadlines or avoid disrupting vendor relationships, it’s a red flag that can go unnoticed.

Too often, the update is accepted at face value and the payment is made. The fraud is discovered days or weeks later, usually when the real supplier chases a missing invoice. By then, the funds may have been transferred into accounts far beyond Australia authorities’ jurisdiction. These aren’t failures of competence, they’re symptoms of workflows that rely too heavily on only one type of verification.

Controls Over Instinct

Stronger controls demand separation between roles and permissions so that no single person can release funds without multi-factor verification occurring first. Assume that internal systems can be breached, phone calls can be intercepted and that email, texts or video chats can be faked.

An important success factor is to use multiple levels of verification. For example, utilize 3rd party data sources for validating business identities and associated information such as internet domains, verify bank details, evaluate multiple fraud signals such as location, network and VPN usage, use manual call backs and so on. Fraudsters use varied and constantly evolving attack patterns, so organizations need to rely on a comprehensive approach using multiple verification techniques.

Arm employees with training and boilerplate scripts to push back whenever impersonated executives urge them to skip steps and process urgent payments. Look for technology solutions that automate or offload manual verification processes so that you’re building layers of security without hamstringing workflows.

New Scams Demand New Controls

With redirection scams and cyber threats growing in volume and sophistication, traditional approaches to fraud prevention aren’t enough. Every organisation needs systems and habits that assume communication channels can be compromised, that even the savviest employees can be deceived.

This requires incorporating technology that automates verification throughout vendor onboarding and management, all the way through to the point of payment – while arming employees with real-time information, backed by a larger variety of verification factors.

Ramesh Menon is Chief Product Officer at Eftsure.

Last Updated on July 12, 2025 by Ramesh Menon