Payment redirection: the only major Australian scam category still growing
Australia's National Anti-Scam Centre reported combined losses of A$166.8 million to payment redirection scams in 2025, up 9.3% on 2024. Every other category in the country's top five fell or grew more slowly: investment losses dropped 11.4% and romance 10.8%, while remote access fell 34.1%. Payment redirection — the Australian name for business email compromise — was the outlier.
- Year
- 2025
- Where
- Australia
- Outcome
- Ongoing
- Reported loss
- $107.5 million
- Victims
- Not stated in the sources
- Schemes
- Business email compromise, Invoice and vendor fraud
- Last reviewed
- 2026-09-06
The facts, as recorded
- Combined 2025 losses to payment redirection: A$166.8 million, up 9.3% from A$152.6 million in 2024.
- The figure combines reports to Scamwatch, ReportCyber, the Australian Financial Crimes Exchange, ASIC and IDCARE, de-duplicated.
- ReportCyber accounted for A$114.7 million of it — the channel businesses use, rather than Scamwatch.
- Scamwatch alone recorded A$12.2 million, about 7% of the combined figure, which is why Scamwatch data alone understates this scheme badly.
- By contrast, investment scam losses fell 11.4% to A$837.7 million, romance fell 10.8% to A$139.9 million and remote access fell 34.1% to A$69.9 million.
- Australians made 481,523 reports across all five bodies in 2025, with combined losses over A$2.18 billion.
Why this case matters
Enforcement pressure, bank controls and public awareness campaigns have visibly moved several categories in Australia. Remote access losses fell by a third. Investment and romance both fell by about a tenth. Payment redirection went up.
That divergence is informative. The categories that fell are the ones aimed at individuals, where bank warnings, call blocking and awareness campaigns reach the target directly. Payment redirection is aimed at a person doing their job inside an organisation, where the intervention has to come from a process rather than a warning screen — and processes change more slowly than consumer awareness does.
Why the reporting channel matters here
Of the A$166.8 million, ReportCyber recorded A$114.7 million and Scamwatch just A$12.2 million. Scamwatch is where consumers report; ReportCyber is where businesses report a cybercrime.
The practical consequence is that anyone reading Scamwatch’s own figures for this category — around 7% of the true combined total — will badly underestimate it. It is a good illustration of why this site labels which reporting body a number came from, and why the National Anti-Scam Centre’s whole project is to stitch the five sources together.
What it tells you about the scheme
Business email compromise does not need a technical breakthrough to keep growing. It needs an organisation where a change of bank details can be actioned by one person on the strength of an email, and there are still a great many of those. The countermeasure is not better spam filtering; it is a rule that a change of payment details is confirmed by calling a number you already had.
Sources
- Targeting scams: report of the National Anti-Scam Centre on scams data and activity 2025. National Anti-Scam Centre (ACCC), Australia. Accessed 2026-09-06. Supports: All figures above, from Table 1 and Table 3 of the report published 30 March 2026.