4 in 5 Aussie Small Businesses Exposed to Scams — The 30-Second Fix
New research from the Australian Banking Association has put a number on something most small business owners already feel in their gut: being online is now a risk as well as a necessity. The ABA’s report found that one in five Australian SMEs reported a cyber security incident in the past year, and a striking 82 per cent said they’d been exposed to a scam (reported by Cyber Daily). As ABA chief executive Simon Birmingham put it, “it takes just one convincing fake invoice on a busy afternoon to wipe out a business’s hard work.”
That line matches exactly what we see. Across our own client base on the Northern Beaches and out through Central West NSW — Orange, Bathurst and Dubbo — the scam that lands most often isn’t exotic malware. It’s a fake invoice with the bank details quietly changed, and it almost always arrives late in the week when someone is rushing to clear payments before the weekend. The criminals aren’t hacking your systems; they’re timing your calendar. That’s why the median business email compromise now costs an Australian SME tens of thousands of dollars a hit — the money leaves through a legitimate-looking payment, not a breach.
The ABA flags three that catch small businesses most: fake invoice scams (a real-looking bill from a “trusted supplier” with the account number swapped), remote access scams (someone impersonating tech support, your software vendor or your bank to talk you into handing over access), and business impersonation scams (criminals posing as your business to fleece your customers). The single most effective defence is almost embarrassingly low-tech: before you pay a new or changed account, make a 30-second phone call to the supplier on a number you already have — never the number on the invoice. Turn on your bank’s Confirmation of Payee checks, and make it normal for staff to sense-check a suspicious request with a colleague rather than quietly sorting it out alone. Research shows most people who get scammed never asked anyone first.
If you’d like those checks baked into how your team actually works — payment verification steps, staff who can spot a dodgy invoice, and layered protection on email and endpoints — that’s our bread and butter. Have a look at our cybersecurity services and team cyber safety training, or get in touch and we’ll help you make “stop, check, protect” the default.