4 in 5 SMEs report being exposed to scams

Indeed, 62 per cent of businesses with zero to four staff and 84 per cent of businesses with five to 19 staff have an online presence, according to the Australian Bureau of Statistics (ABS), Pyxis polling, and ABA member banks.

ABA chief executive Simon Birmingham said this served as a timely reminder that SMEs are a major target for scammers. He warned businesses that scammers know business owners are busy managing competing priorities and will take advantage through impersonation scams and fake invoices to steal money.

“Small businesses are a prime target for scammers, with criminals actively looking to exploit vulnerabilities in everyday systems and processes,” Birmingham said.

“It takes just one convincing fake invoice on a busy afternoon to wipe out a business’s hard work, with smaller operators often hit the hardest.”

The ABA warned businesses to stay alert for three common types of scams, including:

• Fake invoice scams: It looks like a genuine invoice from a trusted supplier, but the bank account details are from a scammer
• Remote access scams: Scammers could impersonate tech support, software providers, or banks to trick owners into granting remote access to company computers, banking credentials, and sensitive business data.
• Business impersonation scams: Criminals impersonate a business, usually attempting to steal money from customers, which could cause enormous reputational harm and brand damage.

“A quick 30-second phone call on a trusted number to double-check account details can stop a scammer dead in their tracks and save you thousands,” Birmingham said.

He added that according to ABA research, 30 per cent of businesses said their bank flagged a suspicious transaction in the last year, while one in five said they are aware of their bank blocking a transaction.

“Banks are ramping up scam protections across the whole industry with major initiatives like Confirmation of Payee, to help ensure businesses aren’t tricked into paying a scammer,” Birmingham said.

“But your best line of defence will always be to Stop, Check and Protect.”

Don’t deal with scams in isolation

Research from CommBank’s Behavioural Science Centre of Excellence revealed that many Australians attempt to deal with scams independently rather than checking with someone they trust, like a colleague or a friend.

Nearly three in four employees (72 per cent) who were scammed said they did not discuss the situation with a colleague before realising it was a scam.

Moreover, 63 per cent of business owners said there are barriers to talking to customers or others about scams, including concerns around alarming customers and suppliers, limited time, and believing it is not their role.

CommBank executive general manager, fraud and scams, James Roberts, said scammers increasingly rely on people making decisions in isolation.

“One of the biggest myths about scams is that people fall victim because they don’t know enough,” Roberts said.

“What we’re seeing is something much more human – when something unexpected happens, many of us believe we can work it out ourselves. When you don’t pause to sense-check with someone you know and trust, you are more likely to overlook any signs, even if you have already spotted them. This is because scammers use tactics like urgency, pressure and familiarity to influence your decision making.”

Roberts urged employees to make it a habit to check with someone else, such as a colleague or a manager, just as they would check a payment amount before transferring money.

CommBank behavioural scientist Caitlin Court said near misses are one of the most underused sources of scam prevention.

“Every suspicious text you delete, fake invoice you question or phone call you hang up on is a learning opportunity. Sharing those experiences can help someone else recognise the same tactic so they can help protect themselves,” she said.

The ATO recently announced that it is currently supporting a small number of tax professionals who were targeted by cyber criminals, chiefly via malicious links in emails, attachments, and other communications.

This followed reporting by Accountants Daily that the Tax Office confirmed it became aware that malware installed via dodgy links from fraudulent actors had affected some practitioners.