Fake Invoice Scams in Australia How Bookkeepers Catch Registry Look-Alikes and Bank Detail Changes Before Payment

Last reviewed: October 2026

What are fake invoice and registry scams?

They are requests for payment that borrow the look of a bill you expect to get. Most fall into three groups. The first is the registry look-alike: an unsolicited notice about your business name, company annual review or domain name that resembles an official renewal. The second is impersonation: a message that pretends to be ASIC, the ATO, a bank or another body and links to a fake invoice or a fake website. The third is payment redirection: a real supplier's invoice, or a convincing copy, with the bank account changed to one the criminal controls.

They work for the same reason. Small businesses pay many small, routine bills, and nobody wants to be the person who let the business name lapse. Registry notices also use real details. ASIC notes that unsolicited correspondence may use publicly available information from ASIC business registers, so your business name, ABN and renewal month can all be correct on a notice that has nothing to do with ASIC.

How can I tell a real ASIC renewal from a look-alike notice?

Check the sender, the timing and the fee. ASIC's page on scams impersonating ASIC says ASIC always emails from an address ending in @asic.gov.au, that business name notifications come from [email protected], that renewal notices are sent by email only, and that they are issued 30 days before the renewal date. A paper letter about a business name renewal, or an email from any other domain, is not from ASIC.

ASIC's newsroom item on unsolicited business name renewal and company review notices lists what to watch for. Third-party correspondence may look like an invoice even though you are not required to pay it, may refer to a renewal that is not yet due, may use urgent language or short payment timeframes, sometimes with a "discount", and may quote a single fee that does not separate the provider's service fee from the ASIC fee.

Not every third-party notice is a scam. ASIC says some senders are registered agents that can lodge on your behalf and charge an extra fee on top of ASIC's fees. It also says these providers must not misrepresent themselves as ASIC, must be clear they are independent, must distinguish their fee from ASIC's fee, and must make clear their offer is not an invoice. You do not have to use them. You can renew directly with ASIC or through your existing registered agent. The practical rule for the books is simple: nobody in the business ordered the service, so nobody should pay it until someone has checked it.

For company annual reviews, ASIC sends the annual statement to one address only, in a set order of priority: the registered agent if there is one, then the online or officeholder portal account, then the nominated mailing address, then the registered office or correspondence address. If your accountant is the registered agent, the real statement goes to them, and a statement that lands on the owner's desk from someone else deserves a second look.

Are domain name renewal notices a scam?

A notice from a company you did not register your domain with is, at best, an offer to move your domain to them. auDA, which administers .au domain names, says on its guide to renewing a .au domain name that licences can be renewed up to 90 days before expiry and that your own .au domain name provider, the registrar or reseller, sends you a reminder as the licence period ends. There is also a 30-day grace period after expiry, but auDA warns that websites and email stop working during it.

So the check is: who did we register this domain with, and is this notice from them? Keep a one-line register of every domain the business owns, the provider and the expiry date. A real lapse is a genuine risk too: ASIC's guidance on protecting your business from scams points out that an expired domain may become available for anyone to buy, including scammers, and suggests setting calendar reminders to renew ahead of expiry.

How do fake bank detail changes on supplier invoices work?

A criminal gets into a supplier's mailbox, or registers a domain one letter off the supplier's, and sends an invoice or a "we have changed banks" email that looks routine. The next payment goes to the wrong account. This is business email compromise, and it is where the large losses sit. In the Annual Cyber Threat Report 2024-2025, ASD's Australian Cyber Security Centre lists business email compromise fraud resulting in financial loss as 15% of self-reported cybercrime from Australian businesses, behind email compromise with no financial loss at 19%. The same report puts the average self-reported cost of cybercrime per report for small business at $56,600, up 14%.

ASD's guidance to recover from business email compromise notes that cybercriminals often use a similar-looking email address or domain name, and that a compromised account should be followed by warning customers and suppliers about requests for payment and changes to bank details. That second point matters for bookkeepers. When a supplier is compromised, its customers are the ones who pay the criminal.

Banks now add one more check. The Australian Banking Association says Confirmation of Payee has been rolling out at participating banks since July 2025. It compares the account name you enter with the BSB and account number and returns a match, close match or no match. A no match on a supplier you have paid many times is a stop sign. A match is not proof the invoice is genuine; a criminal's account can carry a plausible name.

What are the red flags on a fake invoice?

The strongest red flag is an invoice nobody in the business can match to an order. The table below sets out the common types, the tell and the check.

Sources: ASIC, auDA, ASD's Australian Cyber Security Centre and the Australian Banking Association pages linked in this article, reviewed October 2026.

What checks should a bookkeeper run before paying an invoice?

Run the same short set of checks on every bill, and hold anything that fails. Bookkeepers and BAS agents see every invoice before it is paid, which makes the payment run the best place to stop a fake one. The seven checks below take minutes on a normal run.

1. Match it to an order or a known recurring bill. If nobody can say who ordered it, it does not get paid until someone can.
2. Check the supplier's ABN. ABN Lookup is free, needs no login, and shows whether an ABN is active or cancelled and its GST status. The ATO's tax invoice rules require the seller's identity and ABN, and for sales of $1,000 or more the buyer's identity or ABN as well.
3. Compare the bank details with the supplier record, not the invoice. The payment goes to the account in the supplier file. The invoice does not get to change it.
4. Verify every bank detail change by phone. Use a number already held for the supplier, record who confirmed it and when, and have a second person approve the change in the accounting software.
5. Check renewals on the official source. Business names and company reviews on ASIC's register or portal; domains with the provider you registered with.
6. Look at the sender's address character by character. A look-alike domain is often one swapped letter or a different ending.
7. Read the bank's Confirmation of Payee result. A no match or close match on a known supplier means stop and call.

Checks 1 to 3 belong inside the bill capture step, before anything is approved. Our guide to automating invoice and bill data entry covers where purchase order matching sits in that flow. Checks 4 and 7 belong to whoever releases the payment. The point of a fixed list is that it does not depend on someone feeling suspicious that day.

What should I do if we have already paid a fake invoice?

Call the bank first, the same day. ASIC's guide to what to do if your business has been scammed says to stop sending money, report it to your bank or financial institution and ask them to stop any transactions, report the scam to Scamwatch, report cybercrime to ReportCyber, and warn staff, clients and suppliers about requests to change bank details. It also says to tell the ATO if taxpayer information may have been stolen, and notes that IDCARE offers free help for sole traders and small businesses. ASIC warns about follow-up scams that promise to get your money back.

If the bank's response is not good enough, ASIC says a small business or sole trader can complain to the bank, then to the Australian Financial Complaints Authority. Looking ahead, ASIC says most obligations under the new Scams Prevention Framework, which applies to banks, telcos and digital platforms, start on 31 March 2027.

In the books, record what happened as a loss and keep the evidence: the fake invoice, the emails, the bank reference and the report numbers. Do not code it to the expense account the invoice claimed to be for, and do not claim a GST credit on it as if it were a genuine purchase. How the loss is treated for tax is a question for the business's registered tax or BAS agent.

Why are bookkeepers the best defence against invoice fraud?

Because the bookkeeper is the last person who sees the bill before the money leaves. The owner opens the mail in a rush, the staff member who received the email may not know what the business ordered, but the bookkeeper sees the supplier file, the order history and the bank details side by side. That makes fraud prevention part of the job, even when the engagement letter does not say so.

For practices, that suggests three standing rules for every client: a list of who can approve a new supplier, a written process for bank detail changes with a call-back step, and a domain and registry calendar so real renewals are expected and fake ones stand out. Our use cases for Australian bookkeepers show where repetitive checks like these fit into a practice's week.

What is Agentive's view on invoice scams and AI?

Agentive's view is that invoice fraud is a process failure before it is a technology problem, and that AI should make the checks harder to skip, not replace the person who approves the payment. The seven checks above are exactly the kind of detailed, repetitive work that gets dropped on a busy Friday. That makes them well suited to AI-assisted bookkeeping with a person reviewing the exceptions: matching the bill to an order, comparing the bank details with the supplier file, looking up the ABN, comparing a renewal notice with the registry date, and holding anything that fails with a short note on why.

What it should not do is approve a bank detail change or release a held payment on its own. Those stay with a person, which is the design we argue for in our post on review checkpoints for AI bookkeeping. There is a data question too. Running these checks means the AI reads supplier files and bank details, so where it runs matters. Agentive's AI Employee runs on a dedicated single-tenant server on AWS Sydney, with client data stored onshore and never used to train models; our article on AI security and data governance in Australia covers what to ask any provider. The Finance Skill page sets out the payables work it covers.

One pattern to watch: scams cluster around change. When the card surcharge rules changed on 1 October 2026, ASBFEO warned merchants about emails, texts and calls claiming to be from their merchant service provider, as we noted in our guide to the card surcharge ban. A new supplier, a new bank, a new system or a new financial year are the moments to tighten the checks, not relax them. The same goes for clients chasing slow payers: a request to "update" where a large customer should pay you is as risky as one from a supplier, which is why our collections playbook for large clients says to confirm bank details through a contact you already know.

The two-minute check that saves the payment run

Fake invoices succeed because they look like the bills a small business expects. The defence is to stop judging by appearance and check against the source: ASIC's register for business names and company reviews, your own domain provider for domains, ABN Lookup for suppliers, and a phone call on a known number for any bank detail change. Put those checks in the payment run, hold anything that fails, and make sure a person approves every change to where money goes.

General information for Australian businesses and bookkeepers, not legal, financial or tax advice. Figures and guidance are stated as at 16 October 2026 from the ASIC, auDA, ASD, Australian Banking Association, ABR and ATO pages linked above. Speak to your registered tax or BAS agent, your bank or a lawyer about your own situation.