Scams Awareness Week 2026: A Guide for Australian SMEs

In Australia, Scams Awareness Week runs from 24 to 28 August 2026, and this year’s headline number is a strange one. Reported scams are falling. The money they lost isn’t. If you run a small business, manage HR, or sign off on payments, that gap is the thing to understand before it costs you.

Why Are Scam Losses Rising While Reports Are Falling?

Scam losses are rising because scammers are running fewer, more targeted attacks instead of mass, low-effort ones — so a smaller number of successful scams is doing more financial damage. According to National Anti-Scam Centre (Scamwatch) data, total scam reports fell from 211,609 in 2024 to 167,667 in 2025, a drop of 20.8%. On its own, that sounds like good news. It isn’t, not really. Total financial losses still climbed 3.4%, from $285.8 million to $295.4 million. And the average loss per report jumped 30.4%, from $1,350 to $1,762.

Read those three lines together and the pattern is obvious. Scammers are running fewer attempts and picking targets more carefully. Volume is out. Precision is in. For a small business, that means the scam that gets through is more likely to be the expensive one.

What Are the Top Scam Tactics Targeting Australian Businesses?

The three scam tactics causing the most damage to Australian businesses are business email compromise, false billing, and phishing. Online channels accounted for $130.4 million in losses in 2025, the largest single share.

Business email compromise and payment redirection. Someone impersonates a supplier, a customer, or your own Chief Financial Offier, then asks you to pay an invoice or change the bank details on file for an account they control. The better versions spoof a real supplier’s domain and slot themselves into an existing email thread, so the request to “update the bank details” looks exactly like routine admin. Goods ship. Invoices get paid. Nobody notices until the real supplier calls asking where their money is.

False billing. This was the single most reported scam type against Australian businesses in 2025. An invoice arrives for a domain renewal, a directory listing, or office supplies: something nobody remembers ordering, or something that was “free” and quietly became billable. In a business processing dozens of invoices a week, one fake bill barely registers. That’s the point.

Phishing. Still the most reported fraud category overall in 2025, with 65,361 reports, even after a 33% drop in volume. Fake emails and login pages copy banks, accounting software, the ATO, ASIC, Australia Post, and Microsoft. AI-written phishing emails are now good enough that “check for typos” stopped being useful advice a while ago.

Why Is HR Now a Frontline Target for Scammers?

HR and recruitment teams are now a frontline target because hiring involves exchanging sensitive data; scammers want identity documents and bank details under a fake candidate or recruiter identity. If you think fraud is a finance-team problem, the latest numbers say otherwise. Jobs and employment fraud grew faster than any other category: reports up 102.5%, losses up 81.5% to $24.9 million. Fake candidates, fake recruiters, and fake work-from-home offers are all chasing the same thing: identity documents, bank details, upfront “training fees,” or a foothold inside your systems.

The people getting hit are shifting too. Losses among 18- to 24-year-olds rose 87.4%. Male losses rose 15.9% even as reports fell, while female losses dropped 9.9%. Men accounted for $183.2 million in losses in 2025, against $111.5 million for women. Geography matters as well: Western Australia had the highest average loss per report at $2,750, and New South Wales had the highest total losses at $98 million. None of the old assumptions about who falls for scams hold up anymore.

What Grant Scams Should Australian SMEs Watch For?

Common grant scams include fake invoices for “grant processing fees,” phishing emails impersonating government departments, offers of guaranteed grant approval for an upfront payment, and requests to update banking details via a spoofed department domain. Grants sit inside this same threat pattern, and they deserve a call-out of their own because the stakes are different. A grant application usually means handing over financial statements, ABN details, and banking information — exactly the paperwork that makes an unsolicited email look legitimate, and a spoofed-domain request to update banking details for a “pending grant payment” follows the same playbook as the BEC attacks above, just with a government logo attached.

No legitimate department will ever guarantee funding for a fee, and none will pressure you into a secretive, same-day payment.

What Are the Warning Signs of a Business Scam?

The clearest warning signs of a business scam are urgency or secrecy, lookalike domains, and requests for passwords, MFA codes, or unusual payment methods. Train your team to stop and question anything that:

1. Creates urgency or secrecy — “pay today,” “don’t call to verify”
2. Comes from a domain that’s almost right, not exactly right
3. Asks for passwords, MFA codes, remote access, gift cards, or cryptocurrency
4. Requests a payment method nobody in your business normally uses

Any one of these is reason enough to pick up the phone and check, using a number you already have on file, not the one in the email.

Also read: How to Patent Your Invention in Australia: A Complete Guide for Innovators

How Can Small Businesses Protect Against Scams?

Small businesses can protect against scams with a few concrete controls, most of which cost nothing to put in place:

• Verify every new or changed bank account by phone, using a number already on record, never the one in the email
• Require two-person approval on high-value or unusual payments
• Turn on MFA, use unique passwords, keep software updated, and separate who approves payments from who requests them
• Keep supplier and payroll contact records current, and restrict who can access financial systems
• Train staff to report suspicious messages without clicking links or opening attachments
• Check any investment or grant-related licence independently on ASIC’s registers, never on the promoter’s word

What Should You Do If Your Business Has Been Scammed?

If your business has been scammed, contact your bank immediately, preserve all evidence, change compromised passwords, and report the incident to Scamwatch and ReportCyber. Speed matters more than anything else here. Ask your bank whether the payment can be stopped or recalled, and save the emails, headers, invoices, phone numbers, and payment details before anything gets deleted. Kill any active sessions tied to compromised accounts, then notify whoever was impersonated alongside Scamwatch and ReportCyber.

How Does Pattens Group Help You Avoid Grant Scams?

Pattens Group protects clients from grant scams by working only with verified, official funding programs and confirming every financial and application detail through channels we’ve already established, not contact details supplied in an unsolicited email. As an Australian government grant consultancy, we never promise a “guaranteed approval” or ask for an upfront fee for a promise. We handle the research, the strategic alignment, and the application writing itself, so your team isn’t the one deciding, at 4pm on a Friday, whether that email from “the department” is real.

If you’re weighing up a genuine government grant this Scams Awareness Week, talk to us before you talk to anyone who emailed you first.

Frequently Asked Questions