How a real email thread nearly cost a furniture firm A$118,000

The email looked like the rest of the thread because it was the rest of the thread. A family furniture business in Melbourne’s Bayside had been dealing with a supplier by email when scammers quietly intercepted the conversation, then sent a follow-up in the supplier’s name saying the bank account had changed and the payment was urgent. The staff member, whom Victoria Police call Kate, paid the A$118,000.

What saved the business was a sequence of ordinary caution and luck. After the transfer, Kate’s bank flagged it as possible fraud, she rang the supplier on a number she already had, and learned the emails were not theirs. Her own bank could not claw the payment back. It took Victoria Police, working with the Australian Federal Police’s cybercrime centre, to block the funds and return the money. That ending is the exception. Most of these frauds, known as business email compromise, end with the money gone.

The trick is spreading because it is cheap to run and increasingly hard to spot. Four in five small and medium businesses now report being exposed to a scam, on research released by the Australian Banking Association, and close to half of those scams involved AI. The technology writes grammatically perfect emails in seconds, mimics a familiar tone, and can clone a director’s voice well enough to leave a convincing phone message asking for a payment to go out today.

The losses are not small. The Australian Signals Directorate (ASD) recorded average business email compromise losses of A$55,000 per affected business in 2023-24, up from A$39,000 a year earlier, and almost A$84 million lost to the scam in total. The average self-reported cost of any cybercrime to a small business reached A$49,000. For a furniture shop or a cafe, a single successful transfer can be the difference between a good year and insolvency.

Almost every one of these frauds beats a process rather than a firewall, which is why the defence is also a process. The ASD, which issued dedicated small-business guidance on AI-enabled scams in January, keeps returning to one control above the rest: any change to a supplier’s bank details is verified by a phone call to a number you already hold, never a number or a link in the email that is requesting the change. Kate made that call, but only after the money had gone. Made first, it is the step that keeps A$118,000 from ever leaving the account.

The headlines will keep promising AI threats and AI defences, and the Melbourne case is a useful reminder that the fraud still turns on something very old, a payment made to the wrong account because someone trusted an email. The AI is new and getting better at the disguise, but the point of failure has not moved. Our expectation is that voice-cloned “director” requests become routine over the next year, and that the businesses which come through are the ones that made verifying bank details boring and automatic long before the call came. Kate’s bank caught it this time. The cheaper insurance is the phone call a business makes itself.