The Australian Federal Police said Operation Dolos has helped recover or block A$465 million in business email compromise losses, as a new ClickFit campaign urges finance teams to verify every changed bank detail.
How payment redirection works
Business email compromise begins when criminals access a supplier or executive inbox, monitor threads for weeks, then insert fake invoices with altered BSB and account numbers. Victims often discover the fraud only when the legitimate vendor chases payment.
The National Anti-Scam Centre’s latest targeting scams report attributed A$166.8 million in reported losses to payment redirection last year, making it the second-costliest category after investment fraud.
ClickFit steps for payroll and AP teams
The Joint Policing Cybercrime Coordination Centre’s ClickFit material tells staff to stop before acting on urgent payment requests, check account numbers against prior invoices, protect against look-alike domains, verify by phone using known contacts, and report anomalies to ReportCyber.
ANZ’s business banking unit echoed the message in October, noting AI-generated voice clones now accompany fake emails to simulate CFO approval calls.
Why weekends matter
Investigators said fraudsters often strike on Friday afternoons or before public holidays, hoping approvals will be rushed. Altered inbox rules can hide legitimate supplier replies while the criminal acknowledges receipt from a typosquatted domain.
Property settlements and construction progress payments remain high-value targets because single transfers can exceed seven figures.
Technical controls that help
Multi-factor authentication on cloud mail, DMARC enforcement and outbound payment dual-authorisation for new payees reduce—but do not eliminate—risk. ASD’s Cyber Security Action Month theme “Take a second” aligns with mandating callback verification for any change to remittance details.
Insurers are tightening cyber policies to require documented verification steps before claims pay.
What to do if money moves
Contact your bank’s fraud desk immediately; recovery odds drop sharply after 24 hours. Report to ReportCyber and Scamwatch so JPC3 can share indicators with other firms facing the same criminal cluster.
Operation Dolos will not end business email crime, but the half-billion-dollar prevention tally shows coordinated industry reporting works when paired with mundane habits—reading an account number out loud on a trusted phone line before clicking pay.
Sector-specific playbooks
Law firms and conveyancers issued fresh checklists for trust-account transfers after several high-profile matters in Melbourne and Brisbane. Real-estate institutes now mandate verbal confirmation of settlement accounts even when emails appear to come from known partners.
Local councils are not immune: a regional shire reported a near-miss when a supplier email requested changed banking details for a road-resurfacing invoice. Staff caught the domain mismatch because the ClickFit poster sat above the photocopier.
October awareness calendar
Cyber Security Action Month gives IT vendors a hook to run phishing simulations. JPC3 wants those exercises to include fake supplier threads, not just generic password resets, because that is where the money leaves the building.
Bank liability and recovery
When fraudulent transfers clear, banks and customers dispute who bears loss under the ePayments Code. Recent AFCA decisions have split blame when businesses skipped callback steps highlighted in ClickFit materials.
ASIC’s ongoing consultation on scam liability may reference Operation Dolos statistics when finalising guidance for company directors on cyber due diligence.