Holiday scams: how to spot fake invoices and phishing emails.

The end of the year is busy for small businesses, and scammers know it. You're paying more invoices, ordering stock, chasing deliveries and closing the books. That's exactly when a fake invoice or a "your parcel is held" message is most likely to slip through.

Here's what to watch for, and a few simple habits that protect your business over the holidays.

The scams I see most

Fake or changed invoices

An email that looks like it's from a regular supplier says their bank details have changed. Or an invoice arrives that looks almost identical to the real one, with a different account number. Pay it, and the money is usually gone.

Parcel and delivery texts

"Your package couldn't be delivered. Update your details here." These links lead to fake pages that steal card details or logins.

Fake login pages

An email says your Microsoft 365, Google or bank account needs attention. The link goes to a page that looks real but captures your password.

Urgent requests from "the boss"

A staff member gets an email that looks like it's from the owner, asking them to quickly buy gift cards or make a payment. The urgency is the trick.

How to spot them

• Urgency. "Today", "immediately" or "your account will be closed" is a red flag.
• Changed details. Any request to change bank details should be treated as suspicious until proven otherwise.
• The real address. Look at the sender's actual email address, not just the name shown.
• The link. On a computer, hover over it before clicking. On a phone, press and hold to preview it.
• Something feels off. Odd wording, a strange greeting or an unexpected attachment.

Five habits that stop most of it

1. Call to confirm bank changes. Use the phone number you already have, never the one in the email.
2. Turn on multi-factor authentication for email, banking and accounting software.
3. Don't click delivery links. Go to the courier's app or website directly instead.
4. Agree a rule with staff: no urgent payments or gift card purchases without a phone call.
5. Keep devices updated before you close for the break.

If something goes wrong

Act fast. Call your bank straight away if money has been sent. Change any password you may have entered, and turn on multi-factor authentication if it wasn't already on. You can report scams to Scamwatch at scamwatch.gov.au and cyber incidents to the Australian Cyber Security Centre at cyber.gov.au.

If you'd like a quick check of your business's setup before the holidays, get in touch. Most fixes take an afternoon, not a project.