Australian businesses lost $227 million to payment redirection scams in 2021, a 77 per cent increase compared to 2020, the ACCC’s latest Targeting Scams report reveals.

The report compiles data from Scamwatch, ReportCyber, major banks and money remitters, and other government agencies. It shows that payment redirection scams, also known as business email compromise, were the most financially damaging scams for Australian businesses in 2021.

In a payment redirection scam, scammers impersonate a business or its employees via email and request an upcoming payment be redirected to a fraudulent account.

“Scamwatch data shows that small and micro businesses lost the most money to scams last year,” ACCC Deputy Chair Mick Keogh said.

“The most common contact method scammers used against businesses was email, which is not surprising given the prevalence of payment redirection scams.”

“We would like to see overseas initiatives such as confirmation of payee implemented in Australia, where banks automatically check to see if account name and account numbers match. We believe it may reduce the losses to scams that we are seeing,” Mr Keogh said.

Based on Scamwatch data alone, false billing scams, which include payment redirection scams, had the highest losses with $6.7 million.

Businesses that are the victims of a cybercrime, such as payment redirection scams or ransomware, should report the incident to ReportCyber as soon as possible. ReportCyber is run by the Australian Cyber Security Centre and passes reports to law enforcement agencies for assessment and intelligence purposes.

Reports to Scamwatch also show Australian farm businesses lost over $1.5 million last year to scammers who targeted the agricultural sector. The most common scam targeting farmers involved the sale of tractors and other farm machinery, with losses of $1.4 million in 2021.

“Scammers targeted farmers looking online for a good deal on tractors and farm machinery by setting up fake websites and advertising on legitimate platforms,” Mr Keogh said.

“It is so important for businesses to be alert to scams, and to do some extra checks so you can be confident you know who you’re dealing with.”

The Scamwatch website provides a range of resources to help businesses avoid scams. Businesses that have been scammed should contact their bank as soon as possible.

The ACCC encourages businesses to make a report on the Scamwatch website. They can also follow @scamwatch_gov on Twitter and subscribe to Scamwatch radar alerts for more information about current and emerging scams.

The Small Business Information Network also provides details about new or updated resources, enforcement action, changes to Australia’s competition and consumer laws, events, surveys and scams relevant to the small business sector.

Top 5 scams by losses as reported by businesses in 2021 (Scamwatch data only)

Top 5 scams by losses as reported by businesses in 2021 (Scamwatch data only)
Scam type Reported losses Median loss
False billing $6.7m $4,200
Investment $5.1m $39,273
Classified scams $0.6m $2,250
Online shopping scams $0.3m $916
Identity theft $0.2m $1,531

Breakdown of 2021 scam reports and losses by business size (Scamwatch data only)

Breakdown of 2021 scam reports and losses by business size (Scamwatch data only)
Business size Number of reports Reported losses Median loss
Micro (0-4 staff) 1,093 $3.5m $1,550
Small (5-19 staff) 890 $3.5m $3,812
Medium (20-199 staff) 551 $4.2m $2,772
Large (over 200 staff) 319 $421,000 $1,601
Size of business not provided 771 $1.7m $2,398


The ACCC-run Scamwatch aims to raise awareness about how to recognise, avoid and report scams. It also shares intelligence and works with government, law enforcement and the private sector to disrupt and prevent scams.

Reference to combined reports or losses include data from Scamwatch, ReportCyber, other government agencies, and banks and financial institutions. Adjustments were made to avoid counting reports or losses multiple times.

The report otherwise uses Scamwatch data, which is based on phone and web reports made to Scamwatch between 1 January and 31 December 2021.