New Zealanders reported $23.8 million in losses to the National Cyber Security Centre (NCSC) in the year to June 2026, and scams and fraud were the most common type of incident. For a small business, many of these scams end the same way: with money paid into an account the scammer controls.

That only works if the payment goes through without a second look, and in the lead-up to Christmas and the summer break, second looks are in short supply.

Busy weeks are when scammers strike

Kerry was busy when an invoice arrived from the builder who’d done some repairs on his house, so he read it quickly and paid the $400. The builder’s email had been hacked, and a scammer had sent fake invoices with new account details to many of his clients. His story is one of many on Consumer Protection’s scam pages.

“Once scammers have your attention, and your trust, they can trick you into sending them money, or get into your accounts and do it themselves,” said Tom Roberts, Threat and Incident Response team lead at the National Cyber Security Centre.

Timing and a familiar name did most of the work in Kerry’s case. In a business, the payment requests you’re expecting pile up around GST due dates and at the end of the financial year. A fake one can slip through among dozens of genuine payments, but planning ahead for big payment weeks means less to rush before the deadline and fewer payments approved without a proper check.

Five scams costing businesses money

You might think your business is too small to interest a scammer, but more than half of small and medium businesses experienced a cyber threat or attack in the six months before the NCSC’s latest survey. These types of scam come up again and again.

Payment redirection and business email compromise

“In a business email compromise attack, scammers get into your supplier’s emails,” says James Eling, Managing Director of IT managed services business Extreme Networks. “They know what you’re buying and what you owe.”

In just three months, from July to September 2025, the losses reported to the NCSC more than doubled, driven by a few large business email compromise cases.

When a genuine invoice is due, scammers reply in the same thread with the same invoice and one change: the bank account. Because the email can come from your supplier’s real address, checking the sender won’t catch it. If an invoice comes with new bank details, don’t pay it until you’ve called the supplier on a number you already have, however reasonable the explanation for the change. Own Your Online has more ways to spot an invoice scam.

Fake invoices, listings and renewals

Some scams skip the hacking and simply send a bill. It might be for a business directory listing you never asked for, an award nomination with an entry fee, advertising that never ran, or a domain renewal from a company that isn’t your registrar. Others pose as law firms, claim someone wants to trade mark your business name and rush you into paying for an application, as IPONZ has warned.

These invoices rely on being paid on autopilot, so if you can’t match one to something you signed up for, hold it until you can.

Phishing and email account takeover

Phishing often starts with a convincing login page that hands a scammer your email password. From there they read your inbox, learn who you pay and when, and use your account to send fake invoices to your own customers.

The giveaway is a link that takes you to a sign-in page, even when it comes from someone you know. To steer clear of fraudulent pages, type the address in yourself or use a bookmark. If you search for the site instead, check the web address before you click, because scammers can pay for ads that sit above the real result and lead to fake copies of the site.

Government and bank impersonation

Around GST due dates, scammers pose as Inland Revenue, another government agency or your bank, often by phone and usually with a deadline attached: a debt to pay today, a registration about to lapse, an account about to be frozen.

Pressure plus a request to pay or log in through their link or number is the common pattern. Hang up and call back on a number you find yourself, from the agency’s website or a letter you’ve received before. Inland Revenue keeps a list of the latest scams showing what its impersonators are sending.

Fake customers and overpayments

A new customer places a large order, pays more than the invoice and asks you to send back the difference. The original payment is often made with a stolen card or account, so it’s later reversed, leaving you out of pocket for the refund you sent.

Sometimes no money arrives at all, and the scammer sends an email or screenshot that looks like it’s from their bank, claiming they’ve paid or overpaid.

Before you send a refund or release goods, check your own banking app to confirm the money has arrived and cleared. An email or screenshot isn’t proof of payment.

Spotting a fake is getting harder

Scam advice used to focus on the giveaways: clumsy spelling, a generic greeting, a message that didn’t sound like the sender. Generative AI has removed most of them. Scammers can now write fluent, natural English, copy the style of a supplier’s past emails and rework a message in seconds.

Voice is going the same way, and for a business, a cloned voice can be used to back up a request that arrived by email. “The owner” calls to confirm the new account details you’ve just been sent, or a supplier’s accounts manager rings to hurry a payment along.

“A phishing gang could automate the creation of an audio or video avatar by scraping content that’s already on the internet,” says James. “Setting your social media profiles to private makes it harder for them to get the source material.”

If a call from someone who’s meant to know you doesn’t feel right, James suggests asking a question only they could answer. “Something like, ‘When did we last place an order?’ That usually throws the AI model off.”

If you’re unsure about any request, hang up or close the email and call the person back yourself.

Checks that protect your payments

“The number one thing an SME owner can do before Christmas is put robust payment policies in place,” says James. “Teach your staff not to trust an invoice just because a supplier emailed it, and to watch for any urgent request for payment.”

These six rules apply whether a request arrives by email, text or phone.

Verify with a contact you already had
Call the supplier on the number in your records or on their official website, never the one in the email or invoice. Consumer Protection’s Stop. Check. Report. campaign has more on checking who you’re dealing with.
Treat changed bank details as unconfirmed
Don’t update a supplier’s details in your accounting software or banking until you’ve spoken to them. Once they’ve confirmed, consider waiting a day before making the first payment to the new account, which gives you time to catch anything that doesn’t add up.
Use two sets of eyes
Have a second person approve new payees and changed details. In a small team, that might be you and your bookkeeper.
Agree a call-back rule for urgent requests
Any urgent request to move money, including one that sounds like you or anyone else who approves payments, gets confirmed by calling back on a known number. Some businesses add a code word that only the team knows.
Lock down your email
Turn on multi-factor authentication for every account that handles invoices or payments. Our guide to simple cyber security tips covers passwords and multi-factor authentication.
Brief your team before your busiest weeks
Casuals and new starters are the least likely to know how your business pays suppliers, so take five minutes to walk them through these rules.

Download this checklist as a PDF to share with your team.

If you’ve been scammed, act fast

Phone your bank first, because the sooner a payment is reported, the easier it is to stop or recall.

  1. Call your bank’s fraud line and ask it to try to recall the payment.
  2. Stop any other payments to the same account, and check for other invoices from the same fake supplier.
  3. Secure your own email in case it was accessed too. Change the password, turn on multi-factor authentication and check for forwarding rules you didn’t set up.
  4. Let the real supplier know their name was used, so they can check whether their email has been hacked and warn their other customers.
  5. If it was your email that was hacked, contact your customers too, as scammers may have sent them fake invoices from your address. Ask them to call you before they make any payment.
  6. Report it to the National Cyber Security Centre and, if you’ve lost money, to Police through 105.
  7. Contact IDCARE for free support if personal or business identity details were exposed.

If a card was involved, freeze it straight away. Many banks let you do this in their app.