Criminals are in your inbox – and your business could be next!

Posted on 20/08/2025

Criminals aren’t just breaking in through windows anymore – they’re slipping through inboxes more than ever and South Australian businesses are left footing the bill.

As business email compromise and invoice fraud continue to be among the most damaging cybercrimes in Australia, a new awareness campaign launched today by Crime Stoppers South Australia in partnership with cybersecurity firm OpSys is urging business owners across the state to take simple steps to protect themselves before it’s too late.

The campaign comes as cyber scams targeting businesses reach alarming new heights, with the Australian Cyber Security Centre revealing business email compromise cost Australian businesses more than $224 million in 2023 alone – and that figure is likely to be significantly underreported. These crimes are now so common that many are slipping under the radar, disguised as routine communication between employers, employees and suppliers.

What makes these scams so dangerous is their sophistication and subtlety. Criminals are no longer relying on poorly worded emails or obvious red flags. Instead, they’re carefully crafting messages that mimic real people within an organisation – whether it’s a business owner requesting a supplier payment, a payroll change sent from a staff member’s email address or an invoice that looks just like the real thing but with one small, costly change.

Crime Stoppers SA CEO, Nigel Smart, said the growing trend is alarming, particularly because many small and medium businesses don’t realise they’ve been targeted until the money is gone.

“Cybercriminals are smart, organised and increasingly difficult to detect. They’re infiltrating email systems, studying how businesses operate and then striking with scams that are incredibly convincing. By the time someone realises something’s wrong, the damage is done,” he said.

“Whether you’re a small family business, a tradie on the road or a professional service in the city, if you receive invoices or make payments – you’re a target. That’s why we’ve joined forces with OpSys to roll out a campaign that delivers practical advice, real scam examples and the tools businesses need to reduce their risk.”

The campaign includes downloadable checklists, a cyber safety toolkit and staff training tips that are specifically tailored for businesses without the benefit of in-house IT teams. It also features stories from South Australian businesses who have been scammed – like the regional operator who unknowingly paid $34,000 to a fake account after a legitimate invoice was intercepted and altered or the local payroll officer who updated a staff member’s bank details at the request of what turned out to be a fake email.

According to OpSys Managing Director, Matt Fabri, these examples are just the tip of the iceberg.

“We’re regularly seeing cases where cybercriminals spend weeks, even months, monitoring email communications to learn how people write, who they deal with and what normal looks like. Then they insert themselves at just the right moment with a convincing message that causes a costly mistake,” he said.

“These aren’t random spam emails. These are calculated attacks and they’re hitting businesses of all sizes in every corner of the state. Most victims are shocked by how legitimate everything looked.”

Mr Fabri said that while many business owners assume cybercrime is too technical or expensive to prevent, there are simple things every organisation can do – like training staff to verify email requests, enabling multi-factor authentication on accounts and picking up the phone to confirm any unexpected changes to payment details.

“Cyber safety isn’t just an IT issue anymore – it’s a business survival issue. Our goal is to give business owners clear, actionable steps they can take without needing a tech background,” he said.

The campaign, which will be rolled out across regional and metropolitan South Australia, encourages businesses to report any suspicious online activity to Crime Stoppers – either by calling 1800 333 000 or submitting a report online at www.crimestopperssa.com.au  Reporting can be done anonymously and helps disrupt scam networks that often target multiple businesses at once.

Mr Smart said businesses who speak up could be preventing the next victim from falling into the same trap.

“We know that many people feel embarrassed about being scammed, but these criminals are professionals – they trick even the most experienced operators. Reporting what you’ve seen could protect another business and help authorities map how these scams are spreading,” he said.

Cybercrime is not just a digital inconvenience. It’s a growing threat to South Australia’s economy, jobs and local business confidence. With scammers becoming bolder and more sophisticated, this campaign arrives at a critical time to help businesses take back control, protect their finances and keep the cybercriminals out of their inboxes – and their bank accounts.

Check our our campaign page and download free resources here.

---

---

YOU MAY ALSO LIKE TO READ