Four in five small businesses had a scam attempt last year. Three checks that make you harder to impersonate.

What the numbers actually say

Scams Awareness Week 2026 ran from 24 to 28 August, led by the ACCC's National Anti-Scam Centre. This year's theme was "No one's just a number", and the campaign's three words are worth keeping: Stop. Check. Protect.

On the Monday of that week, the Australian Banking Association published research it commissioned: four in five small and medium businesses say they were exposed to an attempted scam in the past year. The same research found 30% said their bank had flagged a suspicious transaction in the previous year, and one in five were aware of their bank blocking one.

Now the part most coverage skips, because it complicates the story. In the National Anti-Scam Centre's Targeting scams report for 2025, small businesses lodged 2,228 reports to Scamwatch. Of those, 287 involved financial loss, totalling $9.5 million — 27.9% lower than 2024. Reported losses went down.

The report itself tells you not to read that as good news, and the reasoning is sound: "The reduction in reports does not necessarily mean a reduction in harm." Businesses have many places to report — their bank, police, ReportCyber, IDCARE — so Scamwatch sees a slice, not the whole. Treat these as the floor, not the total.

The scam that specifically targets businesses

Here's the finding that matters most, and it points straight at email. In the same report, false billing was the scam type small businesses reported most — both with and without a financial loss. The National Anti-Scam Centre explains what sits behind that label:

In plain English, a payment redirection scam works like this. A criminal gets sight of an email conversation about an unpaid invoice — sometimes by breaking into a mailbox, more often just by guessing who your suppliers are. They send a message that appears to come from that supplier, saying the bank details have changed. The invoice is real. The relationship is real. The amount is right. Only the account number is wrong.

Small businesses reported $2.0 million lost to false billing in 2025. Across the whole country and all victim types, payment redirection cost Australians $166.8 million in 2025 — the second-largest category by loss after investment scams. It is not an exotic threat. It is the ordinary one.

The ABA's chief executive, Simon Birmingham, put the practical version of it well: "It takes just one convincing fake invoice on a busy afternoon to wipe out a business's hard work."

Which is exactly why "be more careful" is a weak defence on its own. Nobody is careful at 4:40pm on a Friday. The checks below don't depend on you being careful.

Check one: can anyone send email that looks like it came from your domain?

What it is. Three settings live in your domain's DNS records — the internet's address book for your business name. They exist to prove an email genuinely came from you:

• SPF (Sender Policy Framework) — a public list of which mail servers are allowed to send email using your domain name.
• DKIM (DomainKeys Identified Mail) — a cryptographic signature added to your outgoing mail, so a receiving server can verify it wasn't altered or forged.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) — the instruction that tells other mail servers what to do with a message that fails those checks: ignore the failure, send it to junk, or reject it outright.

Why it matters to your business. Without them, someone can send an invoice from accounts@yourbusiness.com.au to your own customer, and that customer's mail server has no reliable way to tell it isn't you. The damage lands on your reputation and your customer's bank balance, and you may not find out for weeks. This is the single most direct way your domain — not your website — gets used against the people who trust you.

There is a subtlety worth knowing, because it catches businesses that think they're covered. DMARC has three enforcement levels, and only two of them do anything. A policy of p=none monitors and reports but instructs no one to block anything; p=quarantine sends failures to junk; p=reject refuses them. Plenty of small businesses have DMARC set to none, were told they "have DMARC", and are no better protected than a business with nothing at all. Separately, if a domain publishes two SPF or DMARC records instead of one, receiving servers may disregard the policy entirely — a misconfiguration that looks like protection from the outside and provides none.

How to fix it. This is a job for whoever manages your domain or IT — your web developer, your IT provider, or your email host's support team. Ask them, in these words: "Do we have SPF, DKIM and DMARC configured, is DMARC set to quarantine or reject rather than none, and are there any duplicate records?" Moving from none to enforcement should be done in stages so your legitimate mail doesn't start bouncing — a competent provider will know to monitor the DMARC reports first. It's typically an afternoon of work, not a project.

Check two: is there a domain out there that looks like yours?

What it is. A look-alike domain is a web address a person reads as yours at a glance — a hyphen added, .com instead of .com.au, rn in place of m, a plural where you use a singular. Criminals register them to send mail that survives a quick look, because the sending address genuinely passes authentication — it's just authenticated as their domain, not yours.

Why it matters. Email authentication protects your exact domain. It does nothing about a neighbouring one. This is the gap that catches people who have done check one properly.

How to check it. Search your business name on a domain registrar's search page and look at the close variants — the ones already registered by someone else are the ones to note. Then search your business name in a search engine along with the word "scam" or "review", which is the same advice the National Anti-Scam Centre gives consumers, and is worth doing about yourself. While you're in your registrar account, confirm two free settings are switched on: a registrar transfer lock, which stops your domain being moved away if your account credentials leak, and DNSSEC, which cryptographically signs your DNS answers so they can't be quietly forged.

If you find a genuine look-alike being used to impersonate you, report it to Scamwatch and to the registrar hosting it. Whether to pursue it further is a trade mark question worth putting to a professional rather than deciding alone.

Check three: can a customer easily verify it's really you?

What it is. The whole "Check" step of Stop. Check. Protect. depends on the real business being easy to find. The ABA's advice for anyone facing a changed-bank-details request is specific:

Why it matters. That advice only works if your customer can find your real number without going through the suspicious email. If your website has no visible phone number, no business address, no ABN and a contact form as the only route in, you have made verification harder than the scam. A customer who can't check quickly will often just pay.

How to fix it. Put a phone number and a business address on your website where they can be seen without scrolling to the bottom of a contact page — and publish your ABN so anyone can confirm you're a registered business through the free ABN Lookup service. If you ever do change your own bank details, tell customers by a second channel — a phone call, or a note on an invoice you've already established — and say plainly in your emails that you will never notify a change of account details by email alone. That one sentence in your invoice template does real work.

The control that beats all three

Everything above raises the cost of impersonating you. None of it removes the need for one internal rule, which is the only thing that reliably stops a payment redirection:

Any request to change bank account details gets verified by phone, on a number you already had, before anyone pays. Not the number in the email. Not a reply to the email. A number from your own records, or from the supplier's website that you navigated to yourself.

Write it down, tell whoever pays your bills, and make it a rule that nobody is embarrassed to follow — including when the request appears to come from you. The businesses that lose money to this are rarely careless. They're usually busy, and the rule is what covers for busy.

What a scan can and can't see

Being precise about the boundary, because this is a topic where it would be easy to imply more than we do.

What AegorIQ checks, on every tier including the free Scorecard: whether you have an SPF record, whether your mail is DKIM signed, whether you have a DMARC record and what enforcement level it is actually set to — not just whether one exists — and whether you have duplicate SPF or DMARC records, the misconfiguration that silently voids the policy. We also check your registrar transfer lock and DNSSEC, and whether your ABN, business address and contact details are visible on your site. That covers most of checks one and three above.

What we don't check. We do not search for look-alike domains registered by other people — that's check two, and it stays a manual job you do at a registrar. We can't see inside your mailbox, so we can't tell you whether an account has been compromised. We don't monitor your outgoing invoices. And we don't scan anything without your permission, or email you out of the blue to say we found a problem — which is itself worth knowing, because that approach is a scam pattern in this industry. The full itemised list of what we do and don't check is published here.

If you'd rather not run anything at all, the useful version of this guide is three sentences: get DMARC set to quarantine or reject, put a real phone number on your website, and never change a bank account on the strength of an email. That's most of the benefit, and it costs nothing.