$2.03 billion lost to payment fraud. Every year.
The latest Australian payment fraud data, sourced from official reports and industry research. Here's what your business is up against.
Combined Australian losses in 2024
Source: NASC Targeting Scams Report, 2024
Up 66% from the previous year
Source: NASC Targeting Scams Report, 2024
Banks reimburse just 2-5% of losses
Source: ASIC Report 761, 2023
Here's what the data says
Business Email Compromise (BEC)
BEC is the #1 cyber threat targeting Australian businesses. Scammers compromise or impersonate email accounts to redirect payments to fraudulent bank accounts.
Total BEC losses in FY2023-24
ASD Annual Cyber Threat Report
Average loss per BEC incident
ASD Annual Cyber Threat Report, FY2023-24
Increase in BEC losses for large businesses
ASD Annual Cyber Threat Report, FY2024-25
BEC reports with financial loss in FY2023-24
ASD Annual Cyber Threat Report
The cost of cybercrime by business size
The average cost of cybercrime is rising across every business size. No one is too small to be a target.
ASD Annual Cyber Threat Report, FY2024-25
ASD Annual Cyber Threat Report, FY2024-25
ASD Annual Cyber Threat Report, FY2024-25
Recovery is almost impossible
Once money leaves your account through a fraudulent payment, the chance of getting it back is almost zero. Prevention is the only reliable strategy.
of scam losses are borne by the victim
Banks do not reimburse the vast majority of fraud losses. The money is your problem.
Source: ASIC Report 761, 2023
of scam payments detected by banks
Banks catch roughly 1 in 8 scam payments. The other 7 go through.
Source: ASIC Report 761, 2023
of victims globally recover their money
Once a fraudulent payment clears, recovery rates are near zero worldwide.
Source: GASA / Feedzai Global State of Scams, 2024
of total losses reimbursed by banks
Individual Australian banks reimburse between 2% and 5% of scam losses.
Source: ASIC Report 761, 2023
AI is making payment fraud worse
Deepfakes and AI-generated emails are making fraud harder to detect. The old methods of "call them to check" won't work when the voice on the phone is fake too.
of Australian businesses received deepfake threats in the past 12 months
Mastercard, 2024
increase in global deepfake incidents year-on-year
Deepstrike, 2024
lost in a single deepfake attack (Arup, Hong Kong, 2024)
Multiple sources, Feb 2024
Most targeted industries
Some industries are hit harder than others, but no sector is immune. If your business processes payments, you're a target.
Construction
High-value subcontractor payments and frequent invoicing make construction a prime BEC target. The AFP issued a specific warning in 2024.
Professional Services
Trust-based supplier relationships and regular invoice cycles create opportunities for email impersonation and fake invoice scams.
Healthcare
102 data breaches in the second half of 2024 alone. Ransomware incidents doubled in FY2024-25. Compliance requirements add complexity.
Government
Public money, procurement rules, and large payment volumes make local and state government a high-value target for fraud.
Education
Universities process payments to thousands of suppliers. The University of Queensland found $3.5 million in duplicate payments.
Retail & Transport
High-volume payment processing across multiple suppliers, warehouses, and logistics partners creates attack surface.
Sources: ASD Annual Cyber Threat Report FY2024-25, AFP Media Release 2024, NASC Targeting Scams Report 2024
Related content
Payment Fraud Prevention Guide
Complete guide to preventing payment fraud for Australian businesses.
THREATPayment Redirection Fraud
The $152.6M threat: how redirection scams work and how to stop them.
THREATBusiness Email Compromise
$84M in Australian BEC losses. How email compromise enables fraud.
RESOURCESFraud Statistics 2025
Updated statistics and trends for 2025.
Prevention is the only strategy that works
Banks won't catch it. Recovery is near impossible. The only reliable protection is verifying every payment before money leaves your account. That's exactly what ezyshield does.