Is this email a scam? A two-minute check for your business

A supplier invoice with new bank details. The boss asking for an urgent transfer. A “your account will be suspended” login link. These are the patterns criminals use against Australian small businesses every day, and they are usually easy to spot once you know what to look for. Answer the questions below about the email, invoice or message you received, and you’ll get a clear risk read-out and the right next steps.

Scamwarden: email/invoice scam check · Result generated

Your email stays private. This check never asks you to paste the email or any of its contents. You only answer questions about its patterns. Everything runs on your own device: nothing is typed in, stored, or sent anywhere.

JavaScript is off in your browser, so the interactive check can’t run. The rule of thumb still applies: never act on a payment or bank-detail change from an email alone: phone the requester on a number you already have, and report suspicious emails to your IT provider and to ReportCyber at cyber.gov.au.

Does the sender’s email address match who they claim to be?

Check the actual address, not just the display name: tap or hover on the sender’s name to expand it. Scammers register look-alike domains that differ by one letter, or use free webmail accounts.

Yes: it exactly matches the address they’ve always used It’s slightly different or a look-alike (an extra letter, a swapped character, .co instead of .com.au, a new domain) It’s a free webmail address (Gmail, Outlook, Yahoo…) claiming to be a business, a supplier, or my boss I can’t tell / I haven’t checked the real address yet

If you press Reply (don’t send anything), does the reply-to address differ from the sender?

A “From” address that looks right but a reply that would go somewhere else is a classic compromise sign.

No: replies go back to the same address Yes: the reply-to address is different from the visible sender I haven’t checked / can’t check right now

What is the email asking you to do? Tick everything that applies.

The request itself is the strongest signal. Bank-detail changes, urgent boss-to-staff payment requests and gift-card purchases are the signature moves of business email compromise.

Change the bank account or payment details for a supplier, employee or payroll Make an urgent payment or transfer, requested in the name of the boss, CEO or a senior person Buy gift cards, vouchers or cryptocurrency Click a link to log in, “verify”, or “reactivate” an account (Microsoft 365, Xero, MYOB, bank, ATO, myGov…) Open an attachment I wasn’t expecting Provide passwords, MFA codes, or personal / company details Pay an invoice None of the above

Is there pressure to act quickly?

Urgency is manufactured so you act before you check. Genuine suppliers and colleagues can wait for a phone call.

Yes: act now / today / “before your account is suspended” / “or the deal falls through” Some time pressure, but nothing extreme No particular urgency

Does it ask for secrecy, or discourage you from checking?

“Keep this between us”, “I’m in a meeting, don’t call”, “handle this quietly”: legitimate requests never need to dodge a phone call.

Yes: it asks me to keep it quiet, not tell anyone, or not to phone No

Were you expecting this email or invoice?

Yes: it’s part of normal, expected business Unexpected, but plausible (we do deal with this organisation) Completely out of the blue

If it’s an invoice, how does it compare with previous invoices from this supplier?

Fake and “duplicate” invoices copy a real supplier’s look but change the bank account. Always compare against the last invoice you actually paid.

It matches previous invoices (same bank details, expected amount) The bank / BSB / account details are different from previous invoices It looks like a duplicate, or the amount / details have changed unexpectedly Not applicable: it’s not an invoice

If there are links, does the real web address match the service it claims to be?

Hover over the link (or long-press on a phone) to preview the destination without opening it. The text of a link can say anything; the destination is what counts.

There are no links Yes: the destination matches the genuine site No: the destination is different, odd, or a look-alike of the real address I can’t check right now (e.g. on my phone)

Is the request in character for this sender?

A first-ever request of this kind, an odd tone, or unusual timing (late night, just before a long weekend) are all worth noticing.

Yes: it reads normally and is the kind of thing they’d ask The tone or wording feels slightly off It’s out of character, not something this person or business would normally ask of me

Generic greeting, or spelling and grammar mistakes?

A weak signal on its own (polished scams exist), but “Dear Customer” from your own supplier is worth a second look.

Yes: generic greeting and/or noticeable errors No: it’s addressed properly and reads cleanly

Your result

What to do next

Verify out-of-band; this is the one that matters. Never action a payment, a bank-detail change, or an unusual request based on the email alone. Phone the supplier or requester on a number you already have on file or from their official website, never a number or link taken from the email itself. No genuine supplier or manager will mind the call.
Don’t click login links. If an email says an account needs attention, go to the service directly (type the address you know or use your own bookmark) and check from there.
Check the real sender address, not just the display name: expand the “From” details and read the domain carefully, letter by letter.
Preserve the email. Don’t delete it, and don’t forward an edited copy: the original headers are the evidence your IT provider and investigators need.
Report it. Tell your IT provider or IT partner straight away, and report cybercrime and cyber incidents to the Australian Signals Directorate’s ReportCyber at cyber.gov.au. Scams can also be reported to Scamwatch at scamwatch.gov.au.
If money has already been sent or a password entered: contact your bank immediately to try to stop or recall the transfer, change the password (and any account that shares it), make sure multi-factor authentication is on, and tell your IT provider. Speed makes a real difference.

Staff-awareness tip: the strongest defence is a simple workplace rule everyone knows: any change of bank details and any unusual payment request is always confirmed by phone on a known number before it’s actioned, no matter how senior the requester appears or how urgent it sounds.

This read-out flags signs based on common business-scam patterns described by the Australian Cyber Security Centre (cyber.gov.au) and Scamwatch (scamwatch.gov.au). It is guidance, not proof either way; when in doubt, verify by phone before acting.

Official help and reporting

These are the official Australian services. They are free and they are the ones to trust:

ReportCyber (cyber.gov.au), the Australian Signals Directorate's channel for reporting cybercrime against a business.
Scamwatch: report a scam, the National Anti-Scam Centre's reporting form, run by the ACCC.
IDCARE, Australia's free national identity and cyber support service.
ASD Essential Eight, the baseline controls the Australian Signals Directorate recommends for businesses.
OAIC: notifiable data breaches, the privacy regulator on what a business must do after a breach.

Make your business a harder target

A two-minute check helps with one email. Alien IT, the IT company that builds and supports Scamwarden in-kind, sets up the email security, staff awareness and payment safeguards that stop the next hundred.

Checking a personal text or email instead? Use the personal message check. Want to see the patterns first? Phishing email examples, decoded.

Is this email a scam? A two-minute check for your business

Please answer the highlighted questions

Your result

What to do next

Official help and reporting