The email to the treasurer that costs a club its season
Community clubs get targeted with exactly the same playbook as small businesses, and they are softer. Not because the people are less careful — because the structure has none of the friction a business has.
A club with a few hundred members can be holding real money: registration fees, grant funding, uniform orders, venue hire, canteen float, end-of-season presentation night. And it is run by volunteers at nine in the evening, with one bank login, no purchase orders, no finance team, and a committee that meets once a month.
The two that actually turn up
1. The president who needs it done quietly
Every element is chosen. Urgency, so there is no time to check. Unavailability, so a phone call is not an option. Secrecy with a plausible reason, so the one person who would notice is excluded. And a real event on the calendar, because the club's fixtures are usually published on its own website.
Often it comes from the president's real address. Volunteer office-holders commonly use personal email with a reused password and no two-factor authentication, which makes account takeover easy. When the mailbox is genuinely compromised there is nothing to spot.
2. The supplier whose account has changed
The other one is quieter and takes more. Your uniform supplier, ground maintenance contractor or trophy shop emails to say their bank details have changed — and the email sits in the real thread, quoting the real invoice.
This is payment redirection, the same fraud that cost Australians $166.8 million in 2025. The mechanics are identical for a club; only the amounts differ. We cover the full version in the email says your supplier's bank details have changed.
Handover is the vulnerable moment
Treasurers change every year or two. That is exactly when institutional memory is thinnest: the new one does not know which suppliers are normal, what the usual amounts look like, or that the club was targeted last season.
Scammers do not need to know your AGM date. They simply get lucky more often. A short written list of your regular payees and their verified account details is worth more than it sounds — it is the thing that makes a changed account visible to someone who has been in the role three weeks.
Money coming in is a target too
Committees brace for outgoing payments and rarely think about incoming ones. But a message from a grant body, association or council asking you to confirm the account that funds will be paid into is a well-used hook. The details you supply route the club's own grant to a criminal.
Same rule, both directions: ring the funding body on a number you found yourself before replying to anything about bank details.
Five controls, none of which cost anything
- Two people on every payment. No exceptions for urgency — urgency is the request that most needs a second person. Put it in the minutes so it survives the handover.
- Verify any new or changed account by voice, on a number the club already had. Read the BSB and account number back.
- Keep a payee list with verified details, and hand it over with the role.
- Turn on two-factor authentication for the email of anyone who can ask for money to move.
- Agree out loud that no committee member will ever ask for secrecy. Said once at a meeting, it turns a request that would have felt awkward to question into an obvious signal.
If money has already gone
- Ring the bank now and ask them to attempt a recall and contact the receiving bank. Speed matters far more than certainty.
- Report to ReportCyber at cyber.gov.au and Scamwatch at scamwatch.gov.au.
- Call IDCARE on 1800 595 160 — free, and used to helping organisations as well as individuals.
- Tell the committee the same day. If the club is incorporated, check your rules for any obligation to members or your state regulator.
- Tell the real supplier if their account was impersonated. Their mailbox may still be compromised.
And say it plainly to whoever was tricked: this happens to accountants and finance directors. It is not a comment on them, and a committee that treats it as one will simply hear about the next one later.
Common questions
Why would a scammer target a small community club?
Because the money is real and the controls usually are not. A club with a few hundred members can hold a substantial account for grants, registrations, uniforms and venue hire, while everything is run by volunteers in the evenings with no purchase orders, no finance team and a committee that meets once a month. Criminals are not choosing between a club and a corporation on prestige - they are choosing on how quickly a payment goes out unquestioned.
The email came from our president's real address. Doesn't that mean it's genuine?
No. Volunteer office-holders commonly use personal email accounts with reused passwords and no two-factor authentication, which makes account takeover straightforward. When the mailbox is genuinely compromised there is no misspelling to spot - the message comes from the real address in the real thread. The sender address is not evidence.
What is the single most effective control for a club?
Two people on every payment, with no exceptions for urgency. It costs nothing, needs no software, and works even when nobody recognises anything is wrong - which matters, because the messages that succeed are the ones nobody found suspicious. Write it into the committee minutes so it survives the next handover.
Our treasurer changes every year or two. Does that matter?
It is one of the main vulnerabilities. Handover is when institutional memory is thinnest: the new treasurer does not know which suppliers are normal, what the usual amounts look like, or that the club has been targeted before. Scammers do not need to know your handover date - they simply get lucky more often. A short written note of who your regular payees are, and their verified account details, is worth more than it sounds.
Should the committee use a shared email address?
A shared address for the role rather than the person makes handover cleaner, but it needs the same protection as anything else: a strong unique password and two-factor authentication turned on. A shared mailbox with a weak password is worse than a personal one, because more people can be impersonated from it.
A grant body emailed asking us to confirm bank details for a payment to us. Is that normal?
Treat it with the same suspicion as an outgoing payment. Incoming money is a well-used hook - the message asks you to confirm or update the account that funds will be paid into, and the details you supply go to a scammer's account instead. Ring the funding body on a number you found yourself before replying to anything about bank details, in either direction.
We already paid. What do we do first?
Ring the bank immediately and ask them to attempt a recall and contact the receiving bank - speed matters more than certainty. Then report to ReportCyber at cyber.gov.au and Scamwatch at scamwatch.gov.au, and call IDCARE on 1800 595 160. Tell the committee the same day. If the club is incorporated, check your rules for any reporting obligation to members or to your state regulator.
Will insurance or the bank cover a club's loss?
Do not assume either. Australia's Scams Prevention Framework began applying to banks from 1 July 2026 and opens a complaints path through AFCA from January 2027, but it does not guarantee reimbursement. Some association or management liability policies include social engineering or funds transfer fraud extensions, usually with sub-limits and conditions such as mandatory call-back verification - which will not pay out if the call was skipped. Read the conditions before you need them.
Give the whole committee a second opinion
Is it a scam? lets any committee member forward a worrying email, text or invoice and get a plain-English verdict back in seconds — no app, no training night, and no need to be the person who knows.
See how it works for groups