ANZ urged Australian businesses to treat payment redirection and business email compromise as top-tier risks this month, warning that criminals are using generative tools to mimic supplier letterheads, executive voices and remittance details. The bank’s October alert coincides with Cyber Security Action Month and with Australian Signals Directorate data showing more than 84,700 cybercrime reports nationally in the 2024–25 financial year.
Industry groups are sharing template callback scripts with members so accounts payable teams do not rely on memory during busy weeks. The Australian Cyber Security Centre’s reporting portal remains the reference point for national statistics, while banks operate 24-hour fraud desks that can only recover funds when alerted quickly.
Business email compromise remained among the most reported categories affecting organisations of all sizes. Scammers compromise or spoof email accounts, insert fraudulent bank details into legitimate invoices, and pressure accounts teams to pay before a deadline. AI-assisted deepfake audio has appeared in overseas cases; locally, banks report more polished written phishing that bypasses crude spelling filters.
October playbook for finance teams
ANZ general manager specialist sales Cosi De Angelis said impersonation of banks and trusted suppliers remains common, with urgency as the social-engineering hook. The bank reported that customer scam losses fell 24 percent between October 2025 and June 2026 while it prevented or recovered more than $100 million in fraudulent transfers—evidence that controls can work when paired with staff training.
The ASD’s annual threat report highlighted identity fraud and ransomware alongside BEC. For manufacturers already squeezed by higher freight levies and interest rates, a six-figure erroneous transfer can be existential. Yet many SMEs still lack dual-authorisation rules on new payees.
Regulator impersonation persists
Separately, ASIC continues to warn that scammers impersonate its staff and Moneysmart websites to harvest passwords. While today’s focus is invoice fraud, the same criminal groups rotate between fake regulators and fake suppliers depending on which lure converts.
Practical steps include callback verification, multi-factor authentication on email, and marking external emails with banners. ReportCyber remains the central reporting portal; banks can only freeze funds quickly when customers report suspicious transfers within hours, not days.
October’s awareness campaign is not abstract for finance teams processing end-of-quarter payables. With AI lowering the cost of credible forgery, the margin for skipping a two-minute verification call has vanished. Treat every changed BSB as a stop sign, not a speed bump.