Wednesday 11 November 2026 • By Timothy, CPA — Managing Director, Professional Financelink (PFL)

Abstract illustration of a stopwatch beside a payment arrow that has been caught mid-flight by a net and is curving back towards its starting point

A Melbourne Small Business Paid a Scammer $118,000 and Got It Back. Before Christmas Orders Peak, Write Down Your First Hour.

Prevention controls matter, and we've covered them. This post is about the part most small businesses never plan: what happens in the hour after the money has already gone.

Last month, SmartCompany reported on a small family furniture business in Melbourne's Bayside area. In September, a staff member paid $118,000 for an outdoor furniture order. The email thread with the supplier was real. The last few emails in it weren't. Scammers had got into the conversation, posed as the supplier, said the bank details had changed and pushed for urgent payment.

The money went. Then it came back. The business's bank alerted her to possible fraud. She contacted the supplier directly and confirmed it was a scam. Victoria Police, working with the AFP's Joint Policing Cybercrime Coordination Centre, got the transaction blocked and the funds returned.

Plenty of businesses don't get that ending, and the public reports don't explain every reason this one did. But from what's been published, the difference wasn't a clever control before the payment. It was a bank that noticed, a quick call to the real supplier, and police who could act while the money was still within reach. Only the middle part is in your control, and that's worth planning for, especially now.

$118,000 Paid to scammers who had slipped into a genuine supplier email thread, and recovered after the bank and police moved quickly	107 Reports of this type of scam to the Victoria Police cybercrime squad since July, as reported in late October
150m+ Times Confirmation of Payee was used in its first year (Australian Banking Association)	Advisory The banks' own description of Confirmation of Payee: a checkpoint, not a hard block. The decision to pay is still yours

Why the next six weeks are the risky ones

For retailers, hospitality venues and most service businesses, November and December are when the biggest payments of the year go out. Stock for Christmas trading, deposits on January orders, a new supplier brought in because the usual one is short. At the same time, the people who normally approve payments start taking leave, and someone less familiar covers.

That combination is what this scam needs: a large payment that feels routine, a supplier you're already emailing, time pressure, and an approver who doesn't know the supplier well enough to think "that's odd". None of it requires a fake order. In the Bayside case the order and the supplier were real. What changed was the bank account.

Prevention, briefly

We went through the prevention side in August: your AP controls were designed to catch a bad invoice, not a convincing one. The short version is to verify any change of bank details by calling a number you already hold, not one in the email. Have a second person approve the change. Treat the first payment to a new account as a higher-risk payment.

One thing has improved since many small businesses last looked at this. Confirmation of Payee has been rolling out across Australian banks since July 2025. When you enter a BSB, account number and name for a new payee, the receiving bank checks the name against its records and returns a match, a close match or no match. The banks say over 100 institutions now offer it.

It helps, but it has limits, and it's important to know them:

It's advisory. You can still press pay after a "no match" warning. The banks describe it as a checkpoint, not a block.
A genuine supplier trading under a different name from the one on its account can return a close match or no match. If your team sees that often, they'll learn to click through, which is the habit a scammer relies on.
It checks Australian account payments only, not overseas transfers.
Check with your bank whether it runs on the way you actually pay suppliers. If you pay through an uploaded payment file, ask specifically how and when payee names are checked.

The practical rule for the season: a "no match" on a supplier payment means stop and ring the supplier. Never treat it as a typo to fix.

The first hour, on one page

The Bayside case is a reminder that money sent to a scammer isn't always gone. The window to stop it is short, and in most small businesses nobody has written down what to do. When it happens, the person who made the payment is usually panicking, the owner may be on a plane, and the bank's fraud number isn't in anyone's phone.

So write it down now, on one page, and pin it where the person who pays suppliers will see it:

Ring the bank's fraud line straight away. Not a branch, not an email. Save the number in two phones now. Have the payment details ready: date, amount, BSB and account paid. The AFP's business email compromise advice says the same: if money has been sent, contact your bank through its official channels.
Ring the real supplier on a number you already hold, to confirm the request was not theirs. They may also be compromised, and they need to know.
Report it to police and through ReportCyber at cyber.gov.au, as Victoria Police urged after the Bayside case. Record the reference number.
Keep the evidence. Don't delete the emails. Save them with full headers, and screenshot the payment confirmation.
Secure the mailbox. If your own email may have been accessed, change the password, check that multi-factor sign-in is on, and look for forwarding or filtering rules nobody set up. Attackers often add one so replies go to them.
Tell the people who need to know: the owner or director, your accountant, and your insurer if you hold cyber cover. Many cyber policies include notification requirements, so read yours before you need it.
Hold the next payment run until you're sure no other supplier records were changed.

Next to each step, write a name and a backup name for the Christmas period. That's the part that usually goes missing.

Where AI fits, and where it doesn't

AI tools can help with the boring, useful work around this. They can draft the one-page response card from your own list of contacts. They can compare the sender addresses on payment-related emails against your supplier list and flag near-misses, such as a supplier name with one letter changed. They can produce a weekly list of every supplier bank detail change, so a second person actually looks at it.

Be careful with the opposite idea. An AI email assistant that summarises a long thread will happily summarise a scammer's email as "supplier advises new bank details, payment urgent". If anything, it makes the request look more routine. The judgement that matters ("did this supplier really ask?") still needs a phone call to a number you trust.

A note on AI and your data: supplier bank details and payment records are exactly the kind of information you don't want leaving your control. If you use an AI tool on them, confirm whether the vendor retains your inputs or trains its models on them. The safest posture is a tool where data isn't retained for training.

This post is general commentary based on publicly available information and does not constitute legal or tax advice. Always seek independent professional advice before acting.

Twenty minutes this week

Before the big December payments go out, do three things. Save the bank's fraud number in two phones. Write the one-page first-hour card with names against each step. And tell whoever covers payments over the break that a bank detail change during the holidays waits until a known person has rung a known number. A supplier who is genuinely changing banks will almost always accept a short delay while you check. Pressure to skip the check is a warning sign in itself.

Who approves supplier payments while you're on leave?

PFL provides senior-level outsourced finance, management reporting, and AI automation for Australian NFP, NDIS, and SME organisations. A short review of your payment approvals, supplier change process and holiday cover is a sensible thing to do before the biggest payment month of the year.

Book your free health check →

Timothy, CPA is Managing Director of Professional Financelink (PFL), providing senior-level outsourced finance, management reporting, and AI automation for Australian NFP, NDIS, and SME organisations. 20+ years in finance leadership across NFP, NDIS and SME.

Sources

Tomorrow: AI saved your team time. It also handed them a checking job nobody wrote down.

Search This Blog

Finance Intelligence