Business Email Scam Cost Australian Companies $227M Last Year: Here's How to Avoid Being Next
In 2024, Australian businesses lost a staggering $227 million to business email scams. According to the Australian Cyber Security Centre (ACSC), these scams—known as Business Email Compromise (BEC)—are among the most financially damaging cyber threats facing organisations today. With December marking the start of IT budget planning for 2026, now is the time to understand the risks and take action.
What Is a Business Email Scam?
A business email scam involves cybercriminals impersonating trusted contacts—such as executives, suppliers, or partners—to trick employees into transferring funds or revealing sensitive information. These scams often include:
Payment redirect scams: Fraudsters send fake invoices or change bank details to divert payments.
Email thread hijacking: Attackers insert themselves into ongoing email conversations.
Executive impersonation: Scammers pose as CEOs or CFOs requesting urgent payments.
These attacks are sophisticated, often bypassing spam filters and appearing legitimate to unsuspecting staff.
Why Australian Businesses Are Prime Targets
Australia’s small and medium-sized enterprises (SMEs) are particularly vulnerable. The ACSC reports that:
The average loss per BEC incident is $55,000.
Small businesses lost an average of $49,600, an 8% increase from the previous year.
Sectors most affected include real estate, legal, construction, and automotive.
The rise of AI-powered scams and deepfake impersonations has made these attacks even harder to detect.
Anatomy of a Scam: How It Happens
Here’s how a typical BEC scam unfolds:
Reconnaissance: Scammers research your business and suppliers.
Email spoofing or compromise: They mimic or hack a legitimate email account.
Urgent request: A fake invoice or payment request is sent.
Funds transferred: The victim unknowingly sends money to the scammer’s account.
Real-life examples:
A property settlement firm lost $800,000 after a scammer redirected payment details.
A car dealership was defrauded of $150,000 through a fake supplier invoice.
Warning Signs and Red Flags
Watch for these indicators:
Sudden changes in bank account details.
Requests for urgent or confidential payments.
Slight variations in email addresses (e.g., john@company.com vs. john@cornpany.com).
Emails that bypass normal approval workflows.
BEC Scam Prevention: What You Can Do
Protecting your business starts with awareness and action. Key steps include:
Enable multi-factor authentication (MFA) on all email accounts.
Train staff to recognise phishing and impersonation tactics.
Verify payment details through a second channel (e.g., phone call).
Follow the ASD Essential Eight cyber hygiene practices.
Tools and Solutions That Help
Learn to spot the signs: 7 Signs Your Business Email Has Been Compromised (And What to Do Next)
Prepare for recovery: Phishing Attack Recovery Guide for Adelaide Businesses
Protect your data: How Acronis Email Security Protects Adelaide Businesses from Phishing Attacks
If you use asp you will have access to Atera and Acronis, which includes integrating security tools that offer real-time alerts and automated responses.
Planning for 2026: Budgeting for Cybersecurity
Cybersecurity is no longer optional—it’s a business imperative. When planning your 2026 IT budget:
Allocate funds for email security, staff training, and incident response.
Compare the cost of prevention vs. the cost of recovery.
Include regular security audits and penetration testing.
Call to Action
Protect your business in 2026 — start with a free security audit. Don’t wait until it’s too late.
Call me today 08 8291 5000