An invoice arrived for something you never ordered
This is the most common scam aimed at Australian small businesses, and it is the one people are least prepared for — because it does not look like a scam. It looks like admin.
In the National Anti-Scam Centre's 2025 data, false billing was the most frequently reported scam type for small businesses, both with and without financial loss. ASIC has separately warned that false billing causes the highest losses of any scam type hitting small business, ahead of investment and remote access scams.
What arrives
Read it again. Every phrase is doing work. Renewal implies you already signed up. Existing listing implies a relationship. No action required if paying removes the reason to ask anyone. And nothing in it is quite a lie.
The usual costumes:
- Domain name renewal — quoting your real domain, from a registrar you have never used.
- Business directory or online listing — annual, plausible, entirely optional, occasionally imaginary.
- Business name or company renewal — a "fast-track" service at many times the real ASIC fee.
- SEO or advertising retainer — arriving already marked PAST DUE, referencing a month of work.
- Office supplies — toner is the classic, "as per your order", with a threat to place the account on hold.
The honest complication
Most warnings tell you these are all frauds. They are not, and pretending otherwise makes you worse at spotting the real ones.
It is also why our own checker answers these with be careful rather than scam. We will not call something fraud on evidence that only supports "you may not owe this" — and for a business, that turns out to be the more useful sentence anyway. You do not need to prove a crime to refuse an invoice.
The one question that stops nearly all of it
Not "does this look real?" — it does. The question is:
If nothing in your records ordered it — no purchase order, no email, no approval, nobody who remembers it — you are finished. You do not owe it, and you do not need to establish whether the sender is a criminal to decline.
Do you actually have to pay?
Generally, no. Under the Australian Consumer Law, a business that sends unsolicited goods or supplies unsolicited services cannot simply demand payment for them, and the ACCC publishes guidance on how unsolicited supply works. That is worth knowing before you pay something small "just to make it go away", which is how a lot of these get paid.
We are not lawyers and this is not legal advice — for anything substantial, or if you are being pursued, get advice on your own situation.
Five checks, in order
- Find the purchase order or approval. Match it against your own records first, not against the invoice.
- Name the person who ordered it. Ask internally before you ask the sender anything.
- Check the sender against your real suppliers. Look up the ABN at abr.business.gov.au. A different entity with a confusingly similar name is the entire trick.
- Go direct for anything official. Business name and company renewals through your own ASIC login. Domains through your actual registrar. Never a link in the invoice.
- Refuse once, in writing, and keep a copy. Don't negotiate, don't part-pay, don't ring the number printed on it.
The control worth building
One rule, and it costs nothing: no invoice gets paid without someone naming who ordered the thing.
It is unglamorous and it does more than any amount of scam awareness training, because it does not depend on anyone recognising anything. It works on the invoices nobody found suspicious — which, by definition, are the ones that get paid.
Common questions
Is an invoice for something we never ordered always a scam?
Not always, and this is the part most warnings get wrong. Some are outright fraud. Others come from real registered companies using a deliberately misleading process - a 'renewal notice' for a directory listing you never joined, worded to look like a bill you already owe. Both should be refused, but only one is a crime. The practical answer is the same either way: verify against your own records before anyone pays.
Do we have to pay for goods or services we never asked for?
Generally no. Under the Australian Consumer Law, a business that sends unsolicited goods or provides unsolicited services cannot demand payment for them, and there are rules about what happens next. The ACCC publishes guidance on unsolicited supply. If you are being pursued for an amount you never agreed to, that guidance is the place to start - and for anything substantial, get your own legal advice rather than relying on a blog.
Why do these invoices always say FINAL NOTICE or PAST DUE?
Because it works on the person opening the mail rather than the person who would know. Urgency plus a plausible amount plus an implied existing relationship is designed to get the invoice paid rather than checked. A genuine first bill from a genuine supplier does not usually arrive already overdue.
We got a renewal notice for our business name that wasn't from ASIC. Is that legitimate?
Treat it with suspicion. ASIC has repeatedly warned about invoices imitating official renewal notices, sometimes offering a 'fast-track' service at many times the real fee. Never renew a business name or company through a link in an email. Go to ASIC directly and use your own login.
What about domain name renewal invoices?
Same test. Check who your registrar actually is - it will be in your own records or your web developer's - and renew only through them. A renewal notice from a company you have never dealt with, quoting your real domain name, is a long-running variation of this scam. Your domain being real does not make the invoice real.
Why does your checker say 'be careful' instead of 'scam' for these?
Because that is the honest answer. Calling something fraud is a claim we can only make when the evidence supports it. An invoice for a directory listing you never ordered is often a real company using a misleading process - so the answer is that you may not owe this and should check before paying, not that a crime has occurred. We would rather be accurate than dramatic.
Who should check these invoices in a small business?
Whoever can match it against a purchase order or an approval - not whoever opens the post. The single most effective control is boring: no invoice gets paid without someone naming the person who ordered the thing. That one question stops nearly all of this.
We already paid one. Can we get the money back?
Sometimes, and it is worth trying quickly. Ring your bank and ask about a recall or a chargeback if it went by card. Report it to Scamwatch at scamwatch.gov.au. If it was a real company using misleading conduct rather than outright fraud, the ACCC is the relevant body, and you may have grounds to dispute the charge as a payment for something never ordered.
Not sure about an invoice?
Forward it — the email, or a photo of the paper one — and Is it a scam? answers in seconds, in plain English. You and up to three others, unlimited by email and WhatsApp, with a tax invoice for a deductible expense.
See the Business plan