A Queensland Council Lost $1.9M to an AI Payment Scam

Over the 2024 Christmas break, scammers talked staff at Queensland’s Noosa Council into redirecting a supplier payment in a sophisticated AI payment scam — and walked off with $2.3 million in ratepayer funds. The council clawed back about $400,000, leaving a $1.9 million hole.

What actually happened

According to the Australian Computer Society’s Information Age, the criminals used “sophisticated social engineering AI techniques” to impersonate a genuine supplier and convince staff to change its bank details. The matter now sits with the AFP’s Joint Policing Cybercrime Coordination Centre. Police told the council these attacks are on the rise, and warned every organisation to verify contact details before making sensitive changes.

Why this matters between Brisbane and the Sunshine Coast

If you’re waiting for a firewall alert to warn you, you’ll miss this entirely. AI voice cloning now needs only a few seconds of audio — a webinar clip, a voicemail greeting — to fake a director or supplier on a call. We see the same play across our South East Queensland clients: an email about “updated bank details,” then a follow-up call that sounds exactly like the person you expect. If a council with audit-office processes can lose $1.9M, a 20-person Brisbane firm without those checks is squarely in range.

What to do about it

• Never change a supplier’s or employee’s bank details off the back of an email or a call — verify by ringing a number you already hold on file, not one from the message.
• Require two people to sign off any payment big enough to hurt.
• Tell your team a cloned voice is now part of the con. “I heard them say it” no longer means it’s real.

How All IT Services can help

None of this needs a big security budget. We help South East Queensland businesses tighten their payment-change processes and run short, realistic cyber safety training so staff spot the play before money moves. Not sure your current process would have stopped Noosa’s scammers? Get in touch — we’ll pressure-test it with you.

Written by Michael Sacco, Head of Service Delivery, All IT Services. All IT is a managed IT provider supporting businesses across financial services, hospitality and not-for-profit sectors, with teams serving Sydney, the Central West, Melbourne and Brisbane.