A Northern Territory government agency has become the latest victim of a business email compromise (BEC) scam, allegedly transferring more than $3.5 million to a fraudulent bank account.
According to the Australian Federal Police, threat actors registered a business with a name closely resembling that of a legitimate government vendor and opened a bank account to receive the funds. A fraudulent corporate email was used to deceive the agency into sending $3,583,363 to the imposter account.
The scam was uncovered as part of an AFP investigation that led to the arrest of a 38-year-old man in Sydney. He was charged with dealing in the proceeds of crime and granted conditional bail. If convicted, he could face up to 12 years in prison.
How the scam unfolded
The AFP alleges that the perpetrator created a fake vendor identity, opened a lookalike bank account, and used a deceptive corporate email to trick the agency into making a payment. This method mirrors known BEC patterns, where threat actors impersonate vendors and manipulate finance teams using familiar communication channels.
Impact contained, but not without cost
Thanks to fast intervention by the receiving bank, $3,571,760 of the funds were recovered, reducing the net financial loss to under $12,000.
However, even a near-miss can have lasting effects. Incidents like this disrupt internal workflows, raise concerns about due diligence processes, and heighten scrutiny on finance operations.
Lessons for finance leaders
For finance and accounts payable teams, this incident underscores the importance of verifying vendor details and communication sources before releasing funds. Key controls include:
- confirming bank details through verified, external contact points
- requiring multi-person sign-off for changes to vendor payment info
- providing regular fraud awareness training for staff
- auditing vendor master data and approval workflows
Why Eftsure is a critical control
Eftsure helps finance teams stop payment redirection fraud by validating vendor banking details in real time before payments are made. Our platform continuously checks vendor data against an independently verified network, alerting teams to inconsistencies — even when emails and business names appear legitimate.
As part of a broader financial controls ecosystem, Eftsure adds an essential layer of protection that complements bank security features, internal governance, and regulatory reporting obligations.
Book a demo to see how Eftsure protects your payment workflow from vendor impersonation fraud.
