Operation Dolos: $465M Saved From BEC and What It Teaches

The short answer: Operation Dolos, the AFP’s business email compromise operation, has recovered or prevented $465 million in losses since January 2020, the AFP said on 1 October 2026. The five cases it described share one pattern: a payment went to an account that did not belong to the supplier. Checking account ownership before paying addresses that pattern directly.

Key takeaways

• The AFP did not split the $465 million between recovered and prevented funds.
• Payment redirection scams caused $166.8 million in reported losses last year, second only to investment scams.
• A call on a trusted number helps, but it cannot prove who owns a bank account.

On 1 October 2026, the Australian Federal Police announced that Operation Dolos has recovered or prevented $465 million in losses for Australians and Australian businesses targeted by business email compromise (BEC) since it began in January 2020. (AFP)

The release also noted that payment redirection scams caused $166.8 million in reported losses last year, according to the National Anti-Scam Centre. They are the second most costly scam type after investment scams.

The AFP did not split the $465 million between recovered and prevented. What the release does do is walk through five cases. Read together, they show where payments keep failing.

What pattern do the five AFP cases share?

• Northern Territory Government. Police allege a man registered a company with a name similar to a legitimate construction contractor, then used fraudulent emails and bank details to trick an agency into sending more than $3.58 million. The AFP investigation began after a bank reported the suspicious transaction. Most of the money was recovered, although police allege he accessed some of it first.
• Gold bullion. In May 2026, three people were charged over an alleged $600,000 BEC scam, with funds used to buy gold bullion. About $300,000 was recovered.
• A Tasmanian couple building a home. Scammers intercepted emails and sent an invoice with altered bank details that appeared to come from the builder. A $47,500 payment went to the scammers’ account. The bank’s query to the victim was also intercepted. A later invoice was flagged by the bank, which halted further payments. The release does not mention any recovery.
• A Victorian property deposit. A man received an email from someone posing as his conveyancer and transferred $45,000. He only learned it was a scam when he phoned his conveyancer.
• A gravestone. A false $2,300 invoice was inserted into an email chain with a monument company. The estate paid it because the email and invoice looked legitimate.

The amounts range from $2,300 to $3.58 million. The mechanism does not change. A message that looks right asks for a payment, or a change of bank details, and the payer trusts it.

What is the AFP asking businesses to do?

The AFP’s ClickFit campaign sets out six steps to take before making any payment: stop before you act, check payment details carefully, protect against impersonation, verify before making payment, be alert to urgency, and report immediately. The advice on verification is clear. Confirm changes using a trusted phone number or in person, not contact details from the email.

Detective Superintendent Marie Andersson said “every time someone stops to verify a payment request, it becomes increasingly harder for these criminals to succeed.”

Where does a phone call fall short?

Verification by phone on a trusted number is good advice, and it catches many attacks. The Tasmanian case shows why the channel matters. It also helps to be clear about what a call can and cannot do. The bank emailed the victim to ask whether the changed account details were correct, and the scammers intercepted that email, so the victim stayed unaware. A confirmation sent over the same channel the attacker controls proves nothing.

There is also a scale problem. A business making dozens of supplier payments a week cannot phone every supplier for every change, and it only works if someone makes the call every time. A call also confirms who you spoke to, not who owns the bank account.

That is why we treat the bank account as a separate check. Before money moves, verify that the business is real and registered, that the person asking is who they say they are, and that the BSB and account number belong to that business. See how to verify a supplier’s bank account for the steps, and our earlier post on the NT Government case.

Before your next payment run, try our free BEC email checker. It takes a few minutes and shows where your process is exposed.

Related reading: BEC Case Study: How a New BSB Cost an Agency $3.5M, Why Managers Miss BEC Scams: The Payment Approval Gap.

What should you do this week?

• Hold a verified bank account record for your top suppliers, sourced from somewhere other than an email.
• Re-verify any supplier whose bank details have changed recently.
• Make sure the person who accepts a bank detail change is not the person who approves the payment.
• If a payment has gone astray, contact your bank straight away through its official channels and report it to police through cyber.gov.au. Speed matters.

The $465 million figure shows what coordinated policing can achieve. The cases behind it show that the most reliable place to stop a redirected payment is before it is sent.

Frequently Asked Questions

What is Operation Dolos?

Operation Dolos is the AFP’s operation targeting business email compromise. Since January 2020 it has recovered or prevented $465 million in losses for Australians and Australian businesses.

How much do payment redirection scams cost Australians?

According to the National Anti-Scam Centre, payment redirection scams caused $166.8 million in reported losses last year, the second most costly scam type after investment scams.

Is calling the supplier enough to stop BEC?

A call on a trusted number catches many attacks, but it confirms the person, not the account. Checking that the BSB and account number belong to the supplier closes the remaining gap.