ANZ is warning that criminals are using AI to write highly convincing fake invoice and payment-redirection emails, often claiming a supplier's bank details have changed. The real harm happens when a payment is sent to the new account — not when the email is opened. Always verify a bank detail change by phone before paying.
How does the fake invoice scam work?
The scam usually starts with an email that looks like it's from a supplier, a trades business, a body corporate, or another organisation you already deal with. It might be a normal-looking invoice, or a message saying "our bank details have changed — please use this new account for your next payment." Because the email can look like a genuine, ongoing conversation, it's easy to miss that anything is wrong.
If you receive an email asking you to change a payment, send money to a new account, or provide sensitive banking details, treat it as suspicious until you've verified it independently — not by replying to the email or calling a number it provides.
Why has AI made this scam harder to spot?
AI tools let scammers write messages in fluent, natural English, copy a real company's tone and letterhead, and personalise details so the message feels specific to you rather than a mass-sent scam. Some of these scams also involve identity fraud — criminals using stolen identity details to open bank accounts that are then used to receive and quickly move the stolen money, making it harder to trace or recover.
The real damage happens not when someone opens an email, but when a payment is actually sent to the new account based on the fake instructions. For a family, this might mean a payment meant for a trusted tradesperson or care provider ending up in a scammer's account instead.
Where does Scam SafeGuard fit in?
This kind of scam usually arrives and plays out inside an email, with the real damage done when a payment is sent rather than when a link is clicked. The most important step is always a phone call to a number you already have on file, before you pay — made independently of anything in the email itself.
Red flags to watch for
- An email saying payment or bank account details have changed, especially if it asks you to update details you already have on file.
- Pressure to act quickly, or language suggesting something urgent or time-sensitive.
- A request for passwords, PINs, or one-time codes — a real bank or business will never ask for these over email. A request to change payment or banking details is also worth treating as suspicious, but verify it independently rather than assuming it can't be genuine.
- An invoice or payment request that's slightly different from what you normally expect, even if the rest of the email looks professional and familiar.
- Contact details in the email (a phone number or reply address) that you haven't used with this organisation before.
What to do
- Don't use the phone number or email address in the message to "confirm" anything — look up the organisation's official number or website independently and call them directly.
- If it claims to be your bank, remember that banks never ask for passwords, PINs, or one-time passcodes by phone or email. Hang up or stop replying if you're asked for these.
- If a payment has already been made to a changed account, contact your bank immediately — the sooner a fraudulent transfer is reported, the better the chance of recovering it.
- Report the scam to Scamwatch (scamwatch.gov.au) so the National Anti-Scam Centre can track and act on the pattern.
Frequently asked
How does the fake invoice scam work?
An email arrives that looks like it's from a supplier, a trades business, a body corporate, or another organisation you already deal with — sometimes a normal-looking invoice, sometimes a message saying bank details have changed. AI tools now let scammers write these in fluent, natural English and copy a real company's tone, making them harder to tell apart from a genuine, ongoing conversation.
What's the biggest red flag in a fake invoice scam?
An email saying payment or bank account details have changed, especially if it asks you to update details you already have on file, combined with pressure to act quickly. A real bank or business will never ask for passwords, PINs, or one-time codes over email.
What should I do if I receive a suspicious invoice or payment request?
Don't use the phone number or email address in the message to "confirm" anything. Look up the organisation's official number or website independently and call them directly before paying. If a payment has already been sent to a changed account, contact your bank immediately and report it to Scamwatch.
Sourced from ANZ (major bank scam-alert page / media release): alert, published 6 October 2026.
Worried about a fake invoice or payment-redirection email reaching your business or family?
Don't use the contact details in the message itself. Verify independently through your own accounts or the organisation's official number or website, or report it to Scamwatch.
Before you start: Scam SafeGuard uses Google's Web Risk service, which works to provide the most accurate and up-to-date information about unsafe web resources. However, Google cannot guarantee that its information is comprehensive and error-free: some risky sites may not be identified, and some safe sites may be identified in error.
Before you paste: we check any links in your message, and we look at the wording too, to help spot common scam patterns. Please don't include passwords, bank details, or other personal information — we don't need them to check your message.
A quick, one-off check.
We watch for fake versions of the Australian brands scammers copy — Linkt, AusPost, myGov — so we can flag a lookalike even before it's reported anywhere else.
Uses Google Web Risk threat data. We are not affiliated with, or endorsed by, Google.
Built for Australia today. Not local to you yet? Tell us where you'd like us next →
← See all scam alerts