Business Email Compromise: Tracing Stolen Funds

Business Email Compromise Defined

Business email compromise exploits trust in an existing payment relationship by substituting the fraudster’s payment instructions. The email can come from a genuinely compromised mailbox or an address made to resemble a trusted contact. A familiar signature or an existing email chain can make the request appear ordinary.

The main variants change who is impersonated and which payment is diverted.

Variant	What the fraudster changes	What the business sees
Invoice redirection	A supplier’s payment details	A request to pay a real invoice into a replacement account
CEO fraud	The apparent authority for a payment	An executive’s urgent instruction to send money
Payroll diversion	An employee’s bank details	A request to send salary to a different account
Property settlement fraud	The destination for settlement funds	Bank details apparently supplied by a conveyancer, lawyer or other settlement participant

In a hypothetical example, a business owes a supplier $80,000. A fraudster enters the supplier’s email chain and sends replacement bank details shortly before payment. The business pays $80,000 to the substituted account, while the supplier remains unpaid. The real invoice and real debt give the false instructions their credibility.

An altered invoice can also be used without email compromise. The wider invoice fraud investigation addresses those schemes. BEC focuses on the email identity or access used to obtain the payment.

Business Email Compromise vs Phishing

Phishing tricks someone into disclosing credentials or opening malicious content. Business email compromise uses email access or impersonation to persuade someone to make a payment. A phishing message can therefore be the entry point for a later BEC attack.

For example, a fake mailbox sign-in page captures an employee’s password. The fraudster uses that access to read correspondence, identify an unpaid invoice and send substituted bank details from the genuine account. In an impersonation attack, the fraudster uses a lookalike address instead, without first entering that mailbox.

Keep both parts of the evidence. Original emails and account-access records explain how the instructions reached the payer. Bank records show what happened to the money. The Australian Signals Directorate’s BEC protection guidance explains the impersonation and payment-verification risks.

Tracing Stolen Funds in the First 48 Hours

Notify the paying bank immediately and request a recall before waiting for a complete investigation. The first 48 hours are an urgent response period, not a recovery deadline or a promise that funds remain available.

1. Call the paying bank’s fraud team using its official number. Give the amount, payment time, transaction reference and receiving BSB and account number.
2. Ask the bank to recall the payment and urgently notify the receiving bank. Record the case number, notification time and the bank’s response.
3. Report the incident through ReportCyber. Preserve the report reference alongside the bank case number.
4. Confirm the receiving bank through the payment record and bank response. Preserve the original instruction emails, attachments and payment approval records.

The Australian Cyber Security Centre’s BEC recovery guidance puts immediate bank contact and reporting first. A police report supports the investigation, while the bank recall addresses the payment itself.

The receiving account’s records show the incoming credit and subsequent debits. Trace each onward transfer by amount, time, destination details and reference. A first account can be a money mule account used to receive and move stolen funds.

In the hypothetical $80,000 payment, the first account transfers $50,000 to one account and $25,000 to another two hours later. Those debits create two further tracing leads. A statement balance of $5,000 does not establish that all $5,000 belongs to the victim if other funds are mixed into the account.

Lawyers obtain third-party bank records through the appropriate court process or other lawful authority. A victim’s own statement proves the outgoing payment, but it does not show the receiving account’s later movements. Preserve exact transaction times where available because a daily statement entry can conceal the order of transfers.

Once the records arrive, FinTrace saves hours of manual statement review by following transfers across the supplied accounts. Lawyers, investigators and forensic accountants receive a searchable Excel ledger and a readable findings report, with suspicious transactions clearly flagged. Every finding cites the source PDF filename and page, putting the supporting records directly at hand.

Recovery and Who Bears the Loss

Recovery and liability are separate: locating funds creates a recovery opportunity, while responsibility for the loss depends on the payment and applicable legal duties. Run the urgent tracing work alongside complaints and contract analysis.

Bank Complaints and Payment Authority

Start with a complaint to the bank identifying the payment, warning signs and response after notification. Eligible small businesses and sole traders can escalate an unresolved complaint to the Australian Financial Complaints Authority (AFCA). Eligibility and monetary limits apply. ASIC’s business scam guidance also confirms that eligible complaints can concern a receiving bank where the complainant is not its customer.

AFCA distinguishes a payment made by the customer from a transaction made without the customer’s authority. A payment induced by a fraudulent email can still be authorised for this purpose. That distinction affects which liability rules apply.

The ePayments Code covers consumer facilities and excludes facilities designed primarily for business use. A business account’s terms can adopt Code protections, so examine the actual contract. The Code’s mistaken internet payment procedure concerns entry or selection errors and expressly excludes transfers made because of a scam. Treating an authorised BEC payment as a typo can send the complaint down the wrong path.

Scams Prevention Framework

Part IVF of the Competition and Consumer Act 2010 establishes the Scams Prevention Framework. Its principles address governance and the prevention, detection, disruption, reporting and response to scams. Banking is a designated sector, and AFCA membership requirements have commenced for regulated providers.

Most substantive obligations have a later commencement under the official implementation timetable. ASIC identifies their scheduled commencement in 2027. The banking code remains part of that implementation process. Apply the provisions operating at the relevant time and within their consumer and service coverage. The Framework does not create automatic reimbursement for every BEC loss.

Claims Between the Payer and Supplier

A compromised supplier mailbox does not automatically transfer the loss to the supplier. Examine whether the fraudulent instruction was authorised, whether payment discharged the debt and whether a duty of care existed. A negligence claim also needs breach and a causal connection to the loss. Contractual notice clauses and indemnities can affect the result.

In Mobius Group Pty Ltd v Inoteq Pty Ltd [2024] WADC 114, the Western Australian District Court ordered the payer to pay the supplier’s outstanding balance. The supplier’s email account had been compromised, but the court found no relevant duty of care on the facts. That decision shows why mailbox compromise alone cannot settle liability.

Preserve the bank-detail change request, earlier verified details and any telephone confirmation. Payment approval records help show who acted on the instruction and which controls operated. These records matter both to the fraud investigation and any later dispute over the unpaid debt.

Holding Located Funds and Preventing a Repeat

Consider an urgent freezing order when located assets face a real risk of dissipation and the applicable court requirements are met. A bank recall and a court restraint perform different jobs. A freezing order preserves assets for enforcement, while the substantive claim determines entitlement to recovery. The Federal Court’s freezing orders practice note explains the protective purpose and urgent application process.

Use payment controls that address the point of substitution.

• Confirm changed bank details by calling a number already held in the supplier or client record. Record who confirmed them.
• Require independent approval of new payees and bank-detail changes before payment.
• Use an account-name check where the bank and payment channel provide it. Pause a mismatch and resolve it with the intended payee through a known contact.
• Preserve the verification and approval record with the payment, so the control can be demonstrated later.

Confirmation of Payee for businesses checks entered account details against the receiving bank’s records. Availability depends on the banking channel. ANZ documents it in its Internet Banking for Business guide. CommBank also documents its distinct NameCheck business service, which uses payment-pattern information. A name match helps verify the destination account, but independent confirmation still establishes that the real supplier requested the change.

Business Email Compromise Statistics in Australia

Business email compromise with financial loss accounted for 15% of business cybercrime reports in ASD’s Annual Cyber Threat Report 2024–25. The report also records a 138% increase in total BEC losses for large businesses compared with the previous reporting year.

For a separately identified loss total and report count, ASD’s 2023–24 report records almost $84 million in self-reported BEC losses. More than 1,400 reports involved financial loss, with an average loss above $55,000 per confirmed incident. These are Australian dollars. The figures describe reports received through ReportCyber, rather than every BEC attack in Australia.

For an individual matter, national loss figures do not reveal where the payment has gone. Preserve the payment reference, initiate the recall and obtain the records needed to follow each onward transfer.