The invoice that looks right. The supplier whose “bank details have changed”. The ATO email that arrived in BAS week. Forward it — from your phone or your inbox — and a plain-English verdict comes back before the money moves. Nothing to install, nothing to connect to your books.
False billing was the most reported scam type hitting Australian small businesses, and payment-redirection scams cost Australians $166.8 million in 2025 — up 9.3% in a year. Small and micro businesses carry most of the business losses. Sources: NASC, Targeting Scams 2025 · ASIC small business warning.
PAYMENT_REDIRECTIONSAAS_LOGIN_LURE — the message names Xero; the link goes somewhere else.BANK_CONTROL_COACHINGSECRECY_INSTRUCTIONThese are the real replies, word for word, from the same templates the service sends. Every verdict names the pattern it matched — the full methodology, including results against third-party scam catalogues, is published at how verdicts are made.
Forward an email and the original From address is extracted from the quoted text — Gmail, Outlook or Apple Mail — and checked for one-letter lookalikes, brand-new domains and blocklist hits. That extra “t” in a fake bank domain is exactly what this exists to catch.
“Our details have changed” beside new account numbers. Being told to raise your transfer limit or split a payment — instructions no legitimate payee ever needs, because they exist to walk you around your bank's controls.
A fake Xero, MYOB or myGovID sign-in steals the password, and the mailbox is where every payment-redirection scam begins. If a message names a platform and links anywhere else, that's a scam verdict.
A genuine settlement or first invoice can look identical to fraud — so the honest answer is “be careful”, with the one instruction that works either way: ring them on a number you found yourself, and read the account details back. That call is the control that saves the money.
Running something bigger — a franchise group, a practice with many staff, or an institution? The partners page is for you.