What happened
A Melbourne furniture business transferred $118,000 to scammers who hijacked an active supplier email thread. The fraud ran from 7 to 25 September, after legitimate correspondence from 25 August to 5 September.
This was not a cold phishing email. Scammers inserted themselves into an existing conversation about an outdoor furniture shipment, claimed the supplier's bank details had changed, and created urgency around payment.
The business contacted its bank after suspicion, confirmed fraud with the supplier directly, and escalated to Victoria Police. The Cybercrime Squad and AFP's Joint Policing Cybercrime Co-ordination Centre blocked the funds and returned them. Worth noting: successful recovery after a BEC transfer is not guaranteed.
Why sales teams should care
This is business email compromise (BEC), not conventional phishing. The scammers had access to real correspondence, timing, and context. If your team handles supplier payments, channel partner agreements, or customer invoicing, you are exposed.
Victoria Police have logged 107 reports of this tactic since July. It is operating nationally.
What to lock down
Verify bank account changes independently. Call the supplier using a known number, not one in the email. If someone says their banking details changed mid-deal, that is the fraud signal.
Require dual approval for large transfers. One person should not be able to move six figures based on an email, even from a known contact.
Treat urgency as suspicious. Scammers add time pressure to bypass verification. If a familiar email thread suddenly gets urgent about payment, stop and verify.
Preserve evidence if hit. Contact your bank immediately, report to ReportCyber and police, and save all email headers and transaction records. Speed matters for fund recovery.
The broader picture
BEC works because it exploits trust in existing business relationships. Your team likely has dozens of email threads running with suppliers, partners, and customers. That is dozens of potential entry points.
Scamwatch recommends immediate bank contact, incident reporting, and evidence preservation. The recovery in this case demonstrates the value of rapid escalation, but most victims do not get their money back.
If your finance and sales operations do not have protocols for verifying payment instructions, this is the reminder to build them.