Business Email Compromise: The $98M Threat to Australian SMBs in 2026

Business Email Compromise (BEC) is not a new threat. But in 2026, it's the single most expensive cybercrime targeting Australian businesses.​‌‌​​​‌​‍​‌‌‌​‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌​​‌‍​‌‌​‌‌‌​‍​‌‌​​‌​‌‍​‌‌‌​​‌‌‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​‌‌​​‌​‌‍​‌‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌​‌​​‌‍​‌‌​‌‌​​‍​​‌​‌‌​‌‍​‌‌​​​‌‌‍​‌‌​‌‌‌‌‍​‌‌​‌‌​‌‍​‌‌‌​​​​‍​‌‌‌​​‌​‍​‌‌​‌‌‌‌‍​‌‌​‌‌​‌‍​‌‌​‌​​‌‍​‌‌‌​​‌‌‍​‌‌​​‌​‌‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​‌​‌‍​‌‌‌​​‌‌‍​‌‌‌​‌​​‍​‌‌‌​​‌​‍​‌‌​​​​‌‍​‌‌​‌‌​​‍​‌‌​‌​​‌‍​‌‌​​​​‌‍​‌‌​‌‌‌​‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌​‌‍​‌‌​​​‌​‍​​‌​‌‌​‌‍​​‌‌​​‌​‍​​‌‌​​​​‍​​‌‌​​‌​‍​​‌‌​‌‌​

The ACCC's Targeting Scams report documented $98 million in verified BEC losses in 2025. The real figure is likely 3-5x higher. Most SMBs don't report it. Some don't even know it happened until the money's been gone for weeks.

How BEC Actually Works

BEC is not hacking in the Hollywood sense. There's no hooded figure typing furiously. It's social engineering at scale, and it works because it exploits trust.​‌‌​​​‌​‍​‌‌‌​‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌​​‌‍​‌‌​‌‌‌​‍​‌‌​​‌​‌‍​‌‌‌​​‌‌‍​‌‌‌​​‌‌‍​​‌​‌‌​‌‍​‌‌​​‌​‌‍​‌‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌​‌​​‌‍​‌‌​‌‌​​‍​​‌​‌‌​‌‍​‌‌​​​‌‌‍​‌‌​‌‌‌‌‍​‌‌​‌‌​‌‍​‌‌‌​​​​‍​‌‌‌​​‌​‍​‌‌​‌‌‌‌‍​‌‌​‌‌​‌‍​‌‌​‌​​‌‍​‌‌‌​​‌‌‍​‌‌​​‌​‌‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​‌​‌‍​‌‌‌​​‌‌‍​‌‌‌​‌​​‍​‌‌‌​​‌​‍​‌‌​​​​‌‍​‌‌​‌‌​​‍​‌‌​‌​​‌‍​‌‌​​​​‌‍​‌‌​‌‌‌​‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​‌‌​‌‍​‌‌​​​‌​‍​​‌​‌‌​‌‍​​‌‌​​‌​‍​​‌‌​​​​‍​​‌‌​​‌​‍​​‌‌​‌‌​

The Attack Chain

  1. Reconnaissance: Attacker researches your business on LinkedIn, your website, and ASIC. They learn who your suppliers are, who handles payments, and what's normal for your organisation.

  2. Email Compromise or Spoof: The attacker either:

    • Compromises a real vendor's email account (via credential stuffing or phishing)
    • Spoofs the domain with a lookalike (e.g., @c0mpany.com vs @company.com)
    • Registers a domain that's visually identical

  3. The Ask: A fake invoice arrives. Bank details have "changed." The amount is plausible. The tone is urgent but professional. It looks exactly like every other invoice your accounts team processes.

  4. The Payment: Your team pays. The money lands in the attacker's account.

  5. The Disappearance: Within 24 hours, funds are distributed through money mule networks. Often overseas. Gone.

The Numbers

Metric Value
Average BEC loss per Australian SMB $35,000
Average time to detect 30 days
Recovery rate of funds Less than 10%
Percentage involving vendor impersonation 77%
Percentage involving CEO/executive impersonation 23%

Sources: ACCC Targeting Scams Report 2025, Australian Cyber Security Centre, FBI IC3

Red Flags Your Team Should Watch For

Train every person who handles payments to recognise these signals:

  • Invoice bank details changed without a prior phone call or in-person verification
  • Urgent payment requests with threats of service cutoff or legal action
  • Slight changes to email addresses (e.g., @c0mpany.com, @companvy.com, extra characters)
  • Payment requests from new contacts at existing vendors
  • Requests to change established payment schedules without clear justification
  • Emails sent at unusual hours (2am on a Sunday)
  • Grammar that's "almost right" but slightly off for that sen der

The Defence Playbook for SMBs

1. Verify Bank Detail Changes via Phone

This single control stops 90% of BEC attacks. When bank details change on an invoice, call the vendor using a number from your records (not from the email). Confirm the change.

2. Implement Dual-Authorisation for Payments

Any payment over $5,000 requires two people to approve. This creates a human checkpoint that catches anomalies.

3. Deploy DMARC, SPF, and DKIM

These email authentication protocols make it significantly harder for attackers to spoof your domain. They also protect your business from being used as a vector against your customers.

  • SPF: Specifies which mail servers can send email from your domain
  • DKIM: Adds a digital signature to emails
  • DMARC: Tells receiving servers what to do if SPF or DKIM fails

4. Train Accounts Staff Quarterly

BEC tactics evolve. Your training should too. Use real examples. Run simulations. Make it relevant to the tools and vendors your team actually uses.

5. Implement Payment Delays for New Payees

A 24-hour delay on first-time payments to new bank accounts costs nothing and catches most BEC attempts.

What to Do If You're Hit

  1. Contact your bank immediately (within 24 hours, recovery is sometimes possible)
  2. Report to ReportCyber (Australian Cyber Security Centre)
  3. Report to Scamwatch (ACCC)
  4. Contact your cyber insurance provider
  5. Forensically preserve the phishing email (don't delete it)
  6. Change credentials for any compromised email accounts
  7. Notify affected vendors so they can warn other customers

Bottom Line

BEC doesn't require sophisticated technology to execute. It requires trust. And trust is what makes it so effective.

The defence is simple, cheap, and effective: verify changes via phone, dual-authorise payments, and train your team to be suspicious.

$98 million in losses last year. Don't be part of the next report.

Need help securing your business against BEC and other email threats? Get in touch.

TL;DR

  • Bad hackers are using AI (artificial intelligence) to trick businesses and steal information
  • AI helps hackers write perfect emails, create fake identities, and break into computers faster
  • But we can fight back with better passwords, special keys, and smart computer programs that watch for trouble
  • lilMONSTER helps protect businesses from these AI-powered bad guys

What Is AI, and Why Are Hackers Using It?

Think of AI like a robot brain that's really good at reading, writing, and solving problems. It's like having a super-smart assistant that can help you with homework instantly.

But just like how a magnifying glass can start a fire or help you read small print, AI can be used for good things or bad things. Hackers have figured out they can use AI robot brains to do their work faster and better.

Microsoft (the company that makes Windows) just released a report showing that hackers are using AI at every step of their attacks [1]. It's like giving burglars power tools instead of making them use old-fashioned lockpicks.

How Bad Guys Use AI (Explained Simply)

Step 1: Spying on Their Targets

Imagine you wanted to trick someone. First, you'd need to learn about them, right? Hackers used to have to do all this research by hand, which took a long time.

Now they use AI to:

  • Read hundreds of job postings to find companies hiring people
  • Look at websites to learn who works where
  • Find email addresses and figure out how the company writes them

It's like having a robot assistant who can read everything on the internet in seconds and tell you exactly who to target.

Step 2: Making Fake Emails That Look Real

You know how some scam emails have bad spelling or weird grammar? That's because many hackers don't speak English very well.

AI fixes this problem:

  • Writes perfect English with no mistakes
  • Sounds friendly and professional—not like a robot
  • Personalizes every email so it looks like it's just for you
  • Changes the tone to match how your company normally talks

It's like a shapeshifter that can sound like anyone it wants.

Step 3: Building Fake Identities

Some hackers pretend to be real workers to get jobs at companies. They send in fake resumes, do interviews, and get hired—then steal information from inside!

AI helps them:

  • Create fake names that sound real for any country
  • Write perfect resumes with all the right skills
  • Generate fake work history that looks convincing
  • Answer interview questions naturally

It's like having a Hollywood special effects team that can make anyone look like a perfect employee.

Step 4: Breaking Into Computers

Hackers use AI to:

  • Write computer code that breaks into systems
  • Fix mistakes when their code doesn't work
  • Test different ways to break in until something works
  • Move between languages so their attacks work everywhere

Think of it like a master key that can learn to open any lock by trying thousands of combinations instantly.

Step 5: Stealing and Selling Information

Once hackers break in, AI helps them:

  • Read through stolen files super fast to find valuable stuff
  • Summarize long documents so they know what's worth selling
  • Translate everything into different languages to sell to more bad guys
  • Write scary messages to demand money from companies

It's like having a super-fast librarian who can read every book in the library in one minute and tell you which ones are worth stealing.

Related: AI Subscription Hacking: How a $20 Tool Just Breached 10 Government Agencies

A Real Example: The Fake Worker Scheme

Microsoft found a group of hackers from North Korea who used AI to pretend to be IT workers [1]. Here's how they did it:

The Setup:

  1. AI generates a fake name like "Sarah Kim"
  2. AI creates a fake resume showing she's a great programmer
  3. AI writes a perfect cover letter for a job application
  4. AI helps "Sarah" answer technical interview questions

The Attack:

  1. Sarah gets hired as a remote worker (she works from home)
  2. She has access to the company's computer systems
  3. Instead of doing her job, she steals information
  4. AI helps her find valuable files and download them

The Problem: The company didn't know they hired a fake worker until it was too late. She had legitimate access—she wasn't hacking from the outside. She was already trusted on the inside.

Why This Is Scary (But We Can Handle It)

The Bad News

More Bad Guys Can Hack Now: Before, you had to be really smart with computers to be a hacker. Now, with AI helping, almost anyone can launch sophisticated attacks. It's like giving everyone a master key instead of just expert locksmiths.

Attacks Happen Faster: What used to take hackers hours or days now takes minutes. Faster attacks mean less time for the good guys to catch them [2].

Perfect Disguises: AI can write emails that sound exactly like your boss, your coworkers, or even your company's CEO. It's much harder to spot the fakes.

The Good News

AI Helps the Good Guys Too: Microsoft and other security companies use AI to catch hackers. It's like having robot guards that never sleep and can spot trouble instantly [1].

We Know What's Coming: Now that we understand how hackers use AI, we can build better defenses. It's like knowing the enemy's playbook before the game starts.

Smart Security Works: Even with AI helping them, hackers still have to get past your defenses. Good security stops them, AI or not.

How to Protect Your Business (Explained for Grownups)

Here's what your parents or business owners should do to stay safe:

1. Use Special Keys Instead of Just Passwords

Passwords alone aren't enough anymore. Businesses should use security keys—little physical devices that plug into computers (like a USB drive). You can't trick a physical key with AI emails.

Think of it like this: A password is like a secret word anyone can say if they overhear it. A security key is like a real key—you have to physically have it to open the door.

2. Watch for Weird Behavior

Smart computer programs can learn how each person normally uses their account. If something looks weird—like logging in from two different countries in one hour—the computer automatically blocks it.

Think of it like this: If your friend suddenly starts speaking a different language and wearing different clothes, you'd know something's wrong, right? Computer programs notice weird stuff too.

3. Check If Remote Workers Are Real

For businesses that hire people to work from home:

  • Do video interviews where they have to solve problems live
  • Call their old schools and jobs to make sure they're real
  • Check their work carefully for the first few months
  • Don't give them access to everything at once

Think of it like this: When you meet someone new online, you don't trust them with all your secrets right away. You get to know them first. Businesses should do the same thing.

4. Be Careful with AI Tools

If your business uses AI helper tools:

  • Don't type secret information into them
  • Only use AI apps that your business has approved
  • Tell the IT person if AI asks you to do something weird

Think of it like this: You wouldn't tell a stranger your family's secrets. Don't tell stranger AI programs your business secrets either.

What You Can Do (For Kids and Teens)

Even if you're not running a business, you can help keep things safe:

Be an AI Detective

If you get an email or message that seems weird:

  • Check who sent it—even if it says it's from someone you know
  • Look for things that don't make sense—like your principal asking you to buy gift cards
  • Never share passwords with anyone, even if the message looks real
  • Tell a grownup immediately if something seems off

Protect Your Accounts

  • Use strong passwords—long phrases are better than short ones
  • Turn on two-factor authentication (that's when you need both a password AND a code from your phone)
  • Don't click on weird links even if they promise free stuff
  • Remember: AI can make fake messages that look super real

Help Your Family

If your parents have a business:

  • Remind them about security updates
  • Tell them about scams you learn about at school
  • Ask if they use security keys instead of just passwords
  • Share what you learn about staying safe online

The Big Lesson: We Can Fight Back

Yes, hackers are using AI to be smarter and faster. But that doesn't mean they win.

Think about it like sports:

  • When one team gets better equipment, the other team upgrades too
  • When runners get faster shoes, the coaches design smarter training
  • When cars get faster engines, safety features get better too

Security is the same way. AI helps hackers, but it also helps the people protecting businesses. The good guys have AI too—and there are a lot more good guys than bad guys.

Microsoft. Google. Amazon. Thousands of security companies. Millions of smart people. All working to stop the bad guys.

And businesses like yours can work with companies like lilMONSTER to get protected. You don't have to figure this out alone.

FAQ

Not yet. Right now, hackers still tell the AI what to do. It's like a really smart assistant—it can do the work fast, but the human is still the boss. Someday AI might be able to hack by itself, but that's why we're building defenses now.

Because AI does lots of good things too! It helps doctors diagnose diseases, helps students learn, helps businesses run better, and helps catch bad guys. We wouldn't ban cars because bank robbers use them to drive away—we make security better instead.

Honestly? You probably can't. That's why we don't rely on spotting fake emails anymore. Instead, we use security keys (physical devices) so it doesn't matter if the email is fake—without the physical key, hackers can't get in.

If you have computers, internet, or valuable information, yes—but you're also in danger from regular hackers too. AI just makes existing dangers slightly worse. The good news is that good security stops both regular and AI-powered hackers.

Tell them to:

  1. Use security keys instead of just passwords
  2. Install programs that watch for weird behavior on accounts
  3. Be extra careful when hiring people they've never met in person
  4. Work with a security company like lilMONSTER who understands AI threats

References

[1] Microsoft Threat Intelligence, "AI as tradecraft: How threat actors operationalize AI," Microsoft Security Blog, March 6, 2026. [Online]. Available: https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/

[2] IBM X-Force, "2026 Threat Intelligence Index," IBM, 2026. [Online]. Available: https://www.ibm.com/reports/threat-intelligence-index-2026

[3] National Cybersecurity Alliance, "AI and Cybersecurity: What Families Need to Know," NCSA, 2025. [Online]. Available: https://staysafeonline.org/ai-families

[4] Cyber Safe Kids, "Understanding AI Safety," CSK, 2025. [Online]. Available: https://www.cybersafekids.com/ai-safety

[5] Common Sense Media, "AI Explained for Kids," CSM, 2025. [Online]. Available: https://www.commonsensemedia.org/ai-for-kids

[6] Google, "Be Internet Awesome: AI Safety," Google, 2025. [Online]. Available: https://beinternetawesome.withgoogle.com/en_us/ai-safety

[7] Stop.Think.Connect, "AI Security Tips," DHS, 2025. [Online]. Available: https://www.stopthinkconnect.org/ai

[8] FBI Safe Online Surfing, "Technology Safety," FBI, 2025. [Online]. Available: https://www.fbi.gov/sos/technology

AI is changing how hackers work, but lilMONSTER is changing how businesses protect themselves. Work with us to build defenses that stop both regular and AI-powered attackers. Talk to us about protecting your business

Ready to strengthen your security?

Talk to lilMONSTER. We assess your risks, build the tools, and stay with you after the engagement ends. No clipboard-and-leave consulting.

Get a Free Consultation