NAB customer Rebecca* thought she was days away from taking home her brand new $100,000 car.  Instead, she was in the process of handing her life savings over to a criminal.

Rebecca visited the NAB Kingaroy branch in South Queensland earlier this month, ready to transfer her savings to her local dealership for a new car.

When the customer handed over the invoice to Customer Adviser Sara Parfett, Sara asked her go-to question.

“The first thing I always ask is, ‘Have you double checked the details with the dealership?’,” Sara said.

“The customer responded that she hadn’t.”

Spotting invoice scam red flags 

The more Sara looked at the invoice, the more red flags she could see.

“When I was looking at the e-mail, I noticed that it didn’t look the same as what most of our dealership emails look like. It had a couple of different ads put on there, it didn’t reference the type of vehicle she was buying, it just referenced the six-figure price and bank account details,” Sara said.

“It didn’t add up. I knew I needed to get in contact with the dealership.”

After speaking to one of the employees at the dealership, Sara quickly realised Rebecca was about to be scammed.

“I spoke to the person she had been dealing with face to face. I ran him through the details on the invoice and he confirmed that they were not correct. He hadn’t even sent her an email that day.

“We both clued-on that this was a big issue.”

NAB Executive, Group Investigations Chris Sheehan said invoice scams, also known as payment redirection or business email compromise scams, were often incredibly subtle and sophisticated.

“They occur when criminals hack into a business’ email account and change the account details on legitimate invoices,” Mr Sheehan said.

“The criminals hope the recipient doesn’t notice the doctored account details and pays them, instead of the intended business.

“Real estate, legal and construction sectors are traditional targets, while Scamwatch has received recent reports from car dealerships, travel companies and their customers.”

The Australian Competition and Consumer Commission’s latest Targeting Scams Report indicated Australians lost $92 million to payment redirection scams in 2023, down significantly from the $225 million the year prior but still significant losses experienced by everyday Australians.

Double check the details 

Having joined NAB five months ago, Sara said the bank’s commitment to protecting customers, and training around how to spot scam red flags ensured she was alert to the dangers of suspicious activity.

“We are trained to double check the details because we know there are so many things that can go wrong between the emails,” Sara said.

“It might take a little bit longer, and we might need to ask some more questions, but we’re doing it to keep the customer safe.

“They’ve worked hard for their money, we don’t want to let it get into the hands of criminals.”

After preventing the payment, both Sara and the customer were relieved that her savings were safe.

“I explained to her that we caught the scam before it happened so her money was still secure and it’s not going anywhere,” Sara said.

“She was shocked that she actually had an email come through that was not real.”

Sara worked with the dealership to get the correct invoice details to ensure Rebecca was able to pay for and pick up her dream car.

In addition to a range of different measures NAB has introduced to help crack down on scammers, in 2025 banks will implement a new $100m confirmation of payee system as part of the industry’s ABA Scam Safe Accord. The system is designed to help customers detect payment redirection scams and  fake invoices by indicating whether the account name matches the known account number.

What NAB is doing to stop scammers 

NAB has a comprehensive bank-wide strategy in place to reduce the impact of scams and fraud, including:

• Stopping the use of links in unexpected text messages to customers.
• Introducing real time payment alerts to mobile and internet banking.
• Working with telcos to prevent spoofing and NAB impersonation scams.
• Placing blocks on some high-risk crypto currency platforms.

Top tips customers can take to protect themselves from invoice scams:

• Read more about how to spot invoice scams on NAB’s Security Hub.
• Protect your email account with Multi-Factor Authentication (MFA). This adds an extra authentication layer to your email account. Learn more about MFA.
• When you receive an email or an invoice, always double check with the business or person directly to confirm their account details before hitting send on a payment. Contact them through their official channels and not the number included in the email as this could be the scammer’s contact number. A quick phone call can save thousands.
• Learn how to identify phishing messages.
• Know your money is safe in your account. Once you move your money to another account, you lose control of it, and it can be very difficult for your bank to recover it for you. Never be pressured to move your money.
• If you think you’re a victim of a scam or fraudulent activity, contact your bank, and report it to Scamwatch.

*Customer’s name changed.