Business Email Compromise in WA: What Actually Helps

Business email compromise is not a clever malware story. It is usually a normal-looking email that changes where money goes. That is why it lands so hard on small businesses: it attacks trust, not only technology.

For Australian businesses in FY2024-25, ASD reported business email compromise fraud with financial loss as one of the top three self-reported cybercrime threats for business, behind email compromise with no financial loss [1]. The same business fact sheet put the average self-reported cost per cybercrime report at $56,600 for small business and $97,200 for medium business [2]. Those numbers are not WA-specific, but they are the best national public baseline.

Do not overclaim the rate

The legacy notes behind this article contained a useful correction: we should not turn global survey figures into a fake local prevalence rate. There is no clean public statistic that says exactly what percentage of WA SMEs suffer successful BEC each year. ReportCyber and Scamwatch data show the shape and cost; they do not give a neat denominator for every attempted or successful attack.

The attacks we see most

• §Supplier invoice redirection: a real invoice arrives with altered payee details.
• §Executive impersonation: a senior person appears to request an urgent payment, gift card, or payroll change.
• §Mailbox compromise: a real account is used to continue an existing conversation and change the destination of money.
• §Business impersonation: a scammer copies a business name, logo, ABN, or domain lookalike to make the request feel routine.

Scamwatch describes the core move plainly: the scammer pretends to be a business or person you know and asks you to pay money to an account they control [3]. That is the centre of the problem. Everything else is decoration.

Training helps when it changes the workflow

Phishing training can help, but only when it is tied to the way money and access actually move through the organisation. Annual videos and shame-based click tests are weak medicine. Practice, fast reporting, and written payment rules are stronger.

1. 01Write down a bank-detail change rule: no change is accepted until it is confirmed on a known phone number.
2. 02Separate request and approval for payments above a threshold that would hurt the business.
3. 03Turn on MFA for email, accounting, banking, and domain registrar accounts.
4. 04Use a password manager so shared admin accounts are not passed around by email.
5. 05Give staff one obvious way to report suspicious messages and thank them when they use it.

“BEC prevention is mostly a business process problem with a security costume on.”

A WA-sized first step

For a Fremantle cafe, construction firm, clinic, studio, or community organisation, the first useful step is not a new platform. It is a twenty-minute payment drill: pick one recent invoice, trace who could change its bank details, and decide how the team would verify the next change.

After that, add simple tooling: MFA, a password manager, mail reporting, and a small phishing simulation programme that uses realistic but kind scenarios. The point is not to catch people out. The point is to make the pause normal before money moves.