Don't get scammed: a small business guide to fraud prevention
Small businesses are attractive targets for fraud because they often rely on trust and have one person handling all the money. Most losses come from a handful of predictable scams and gaps in controls, and most can be stopped with simple habits.
Scams from outside the business
Fake bank detail changes
The most costly scam we see. An email arrives that looks like it’s from a regular supplier, saying their bank details have changed. It might come from a hacked supplier account, so it can look completely genuine, sometimes in the middle of a real email thread. The next payment goes straight to the scammer.
Stop it: never change bank details from an email or a letter alone. Call the supplier on a number you already have (not one in the email) to confirm. Make this a rule for everyone who pays bills.
Fake invoices
Invoices for services you never ordered, such as directory listings, domain renewals, or “unpaid” bills from companies that sound familiar, sent in the hope someone pays without checking.
Stop it: only pay invoices that match a purchase order or a known supplier, and have someone check new suppliers before they’re set up.
Impersonation scams
Calls, texts or emails pretending to be the ATO, your bank, energy provider or even your own director asking for an urgent transfer. The ATO will never ask you to pay by gift card or cryptocurrency, or demand immediate payment under threat of arrest.
Stop it: hang up and call the organisation back on its official number. Treat any “urgent, keep this quiet” payment request from a director as suspicious until you’ve spoken to them.
Account takeovers
Scammers who get into your email, accounting software or banking can do almost anything.
Stop it: turn on multi-factor authentication for email, banking, Xero or MYOB and the ATO portals. Use a password manager and don’t share logins.
Fraud from inside the business
Most internal fraud is committed by trusted, long-serving staff, often because one person controls everything. Common examples:
- Ghost employees or inflated hours in payroll
- Personal purchases on business cards or accounts
- Fake suppliers set up and paid by an employee
- Skimming cash or manipulating refunds
- Stealing stock and covering it with adjustments
Controls that work
- Separate the duties. The person who sets up suppliers or employees shouldn’t be the one who approves payments, and neither should reconcile the bank account. In a small team, the owner can be the second set of eyes.
- Approve payments yourself, or require two people to authorise payments in internet banking.
- Review the bank reconciliation and payroll report every month. Look for names you don’t recognise and changes to bank details.
- Use software permissions. Xero and MYOB let you limit what each user can see and do.
- Reconcile stock regularly and investigate unexplained adjustments.
- Require receipts for every card transaction, attached in your accounting software.
- Take a look at the unusual: a staff member who never takes leave, or resists anyone else doing their job, is a classic warning sign.
If it happens
- Call your bank immediately to try to stop or recall the payment.
- Report it to ReportCyber (cyber.gov.au) and Scamwatch.
- Change passwords and secure your email and systems.
- Tell affected suppliers or customers.
- Talk to your accountant about the tax and insurance implications, and to a lawyer if staff are involved.
Get your controls checked
An independent review of how money moves through your business, who can approve what, and where the gaps are, is often far cheaper than one successful fraud. Our audit team can review your internal controls and recommend practical fixes [check: confirm you offer internal control reviews]. See audit services, and keep your books current with bookkeeping so problems show up quickly.