Everyone seems to be bombarded with fake invoice emails from Telstra, Optus, AGL, Xero and the list goes on. Some of the invoices look legitimate however all it takes is one false click and suddenly you have inadvertently loaded some malware on your computer.

Malware once installed can be extremely sophisticated and dangerous. Here are a couple of real cases that we have seen with our clients.

Case 1 – Hackers intercepted a bank transfer for $4,500 to a supplier via ANZ despite them using two-factor authentication. The supplier’s bank account details were changed to the attacker’s account, all the while mimicking what the user would expect to see from a typical banking transaction. The payer had no idea their account data had been changed and unknowingly sent money to the attacker’s account even after entering their second authentication password. Luckily the amount transferred was recovered.

Case 2 – Hackers intercepted a legitimate invoice and monthly statement sent via email to a customer. They then proceeded to correspond with the customer from a similar but fake email address asking for the payment of $35,000 to be redirected to a new bank account in Hong Kong. They amended the original invoice and statement details and even copied the original email signature. While the first request had already been paid to the correct account, the hackers then sent an updated statement requesting payment of the remaining $160,000. Luckily the customer finally realised there was an issue and contacted our client.

It pays to be extremely careful! The most important thing is to check the email address that the invoice is coming from. If the AGL invoice comes from john.doe@jhfs.yahoo.com then there is a fair chance it isn’t real. If there is an online link, hover your mouse over the link first before clicking on it. Your email software should then show the full link address so that you can ensure it is the legitimate website you are being redirected to.

If in doubt, don’t click it…just delete it!

Here are some simple – but important – security measures you can take to keep yourself and your business safe online.

  • Backup, backup, backup – keep an off-line backup of all computers on your network on an external hard drive or Network-attached Storage (NAS) device.
  • Keep your computer’s operating system software up to date with security patches and upgrades – it’s one of the easiest and effective things you can do to protect yourself.
  • Make sure you use and update your anti-malware (anti-virus, anti-spyware) software as soon as possible after you get notified that a new version is available
  • Use strong, unique passwords for each website or application so one compromised login doesn’t become many
  • Never share your passwords
  • Use two-factor authentication (2FA, MFA, 2SA) whenever available for an extra layer of security
  • Check with your supplier via the phone if you receive a request to transfer money or change bank account details.
  • Conduct banking transactions through safe browsers (often provided by anti-virus software providers), use a firewall and utilise a temporary VPN network to encrypt your internet traffic.
  • Educate and ensure your staff are also aware of the risks and procedures required to ensure they don’t compromise your network and business reputation.