The end of the financial year (EOFY) is an infamously busy time, to put it mildly. By May, most accounts payable (AP) teams are already bracing themselves for the whirlwind of tax returns, bookkeeping and completing pay runs.
Guess who else knows it’s a busy time? Scammers. That’s why they deliberately target AP teams during EOFY.
Scammers are aware of this flurry of admin duties, and they capitalise on feelings of urgency and chaos to trick beleaguered staff into making the wrong payments or giving the wrong information to the wrong people. Plus, stressed staff are more likely to skip important controls or overlook the red flags that can identify a scam. In 2023 alone, unsuspecting victims have been duped by scams to the tune of AUD $2.74 billion, according to Scamwatch.
So, financial aficionados, it’s time to get ahead of the game. In this article, we’ll dissect common EOFY scams to help you keep your organisation safe.
Cyber-criminals are always on the search for new technologies and tactics for outwitting your employees. But many are happy to follow a playbook if it’s proven to be successful in the past, which is why there are a few tried-and-true scam techniques that have been showing up during tax time over the last few years.
Here are some of the most common ones.
This type of social engineering scam involves an email or phone call in which scammers impersonate legitimate sources, like the Australian Taxation Office (ATO) or a financial institution, requesting personal or financial information. It’s important to remember that the ATO will never request sensitive information via email or phone, so be wary of any unsolicited requests. Explore other types of phishing attacks and real-world examples.
Similar to phishing scams, with tax refund scams, AP teams may come across a smishing scam orchestrated by cyber-criminals disguised as government agencies like the Australian National Audit Office or MyGov. Scammers may contact your AP team claiming to be from the ATO, supplying receipts for refunds. Make sure to always verify the authenticity of any refund claims with the ATO directly.
BEC scams involve cyber-criminals accessing a company’s email system and impersonating staff, such as the CEO or CFO, to request fraudulent financial transactions. Scammers are known to use effective psychological tricks to fulfil a BEC attack. For example, scammers will seek to deceive their victims into acting quickly, creating urgency. AP staff need training to help them identify which emails are legitimate and which are suspicious. Find out how to spot a BEC attack.
Fraudulent invoices, also known as false billing scams, may be sent to businesses in an attempt to deceive staff into paying for goods or services they never received. In case your vendor’s email has been compromised, make sure to verify the request through a strong call-back procedure.
To protect yourself and your suppliers against these EOFY scams, it’s important to stay vigilant and adopt measures that minimise your risk. This includes basic security hygiene, such as multi-factor authentication and choosing strong passwords.
However, this isn’t just the jurisdiction of security or IT teams – after all, no matter how strong your cybersecurity might be, your financial controls will be the last line of defence if one of your suppliers suffers a security breach. Fortunately, there are a variety of ways that finance leaders can shore up their defences ahead of the financial year-end.
Scammers are keen to exploit this reporting period by targeting individuals and businesses rushing to meet their tax obligations and close off time-sensitive tasks. But some common red flags can alert you to these scams – even during busy, hectic phases.
Let’s take a closer look at some of the most common red flags and how to prevent scams.
Ever received a surprising request or message that’s out-of-step with normal processes? One that wasn’t preceded by, say, an in-person conversation with an executive explaining the situation? DANGER ZONE. These messages might turn out to be legitimate, but they should be presumed malicious until proven otherwise.
That’s because an unsolicited email or phone call is one of the most common signs of a tax scam. In the example below, we see a scammer attempting a CEO scam through a phishing email.
The email above looks legitimate, and the use of a senior executive’s name adds a dash of authority. The cyber-criminals are hoping the recipient will action the request quickly, without verifying the request.
It’s best practice to confirm the company email address, along with verifying the recipient through a call-back. If you suspect that you’ve received a suspicious email, then report the scam to the Australian Cyber Security Centre (ACSC) or Scamwatch. It’s best practice to never click on any suspicious email link or attachment.
Another warning sign is an offer that seems too good to be true. Scammers may offer to help you claim a large tax deduction, offer a refund that is much larger than expected or promise to reduce your tax bill to an unrealistic amount. These offers may be presented in a way that seems official, but they are usually fraudulent.
The screenshot above is another example of a MyGov scam attempt, urging the recipient to click on the malicious link highlighted above. These malicious links try to achieve two outcomes. One is to have malware downloaded on your device undetected, compromising your security settings. The second is asking the user to enter their login details to reveal personal details such as their full name, bank account details, CVV number, address or phone number.
If you receive an email, phone call or offer that seems suspicious during the EOFY period, be sure to investigate further before providing any personal information or funds. Check the sender or caller’s credentials, look for spelling errors or unusual language, and verify the offer with the ATO or the appropriate stakeholder before taking any further action.
Whether it’s a typo, a wonky email address or supplier details that don’t look quite right, little flaws can indicate a big risk. You should always double-check senders’ email addresses (scammers are hoping you won’t notice that your CEO is messaging you from “totallylegitaddress183839@hotmail.com” instead of their usual email) – but, since email inboxes can be hacked and addresses can be spoofed, remember that a legitimate-looking email address isn’t sufficient proof of authenticity.
Scammers aren’t famous for their elegant, error-free prose, so keep an eye out for grammatical mistakes or turns of phrase that don’t sound natural. However, remember that generative AI tools like ChatGPT are helping even the laziest of fraudsters churn out legitimate-sounding text. Again, this is just one red flag to watch – flawless writing in an email or SMS won’t guarantee its legitimacy.
This one is tough because EOFY tasks really do tend to be time-sensitive. Because of scammers looking to capitalise on this reality, receiving urgent requests should be a reason to slow down, not to rush through usual control processes.
Fraudsters are getting better at imitating the polite language of most corporate environments, but sometimes threatening language still shows up in EOFY scams. Colleagues are more likely to ask things like “What’s a realistic timeframe for this?” or “Do you think finishing this by Friday COB is feasible?” Your mileage may vary, but be on high alert if a message threatens severe consequences for not actioning a request right away.
As that time of year approaches, one of the most effective ways to protect your organisation is fostering a strong security culture. This includes raising awareness about EOFY-specific risks, identifying EOFY scams and educating employees on how to differentiate between genuine and suspicious messages. Ideally, training is interactive and doesn’t just happen once a year – training modules need to happen routinely to reinforce messages and update staff on new scam tactics.
The State of the Phish report highlights that 45% of Australian organisations offer in-person training, the highest percentage among surveyed countries in the Asia-Pacific region. To maintain strong security amid evolving cyber-crime tactics, CFOs should look to continuously update and improve security training.
Further, CFOs play a crucial role in creating an environment of openness and transparency regarding potential data breaches. By encouraging staff to report any potential risks, organisations can cultivate a culture that motivates employees to be more proactive in identifying and reporting suspicious emails. Staff should never feel shy to raise their hand and ask if a message is legitimate, or to promptly inform someone if they think they’ve clicked on something dodgy.
Learn more in our comprehensive guide on defending against EOFY scams.
While generative AI has proven beneficial across several business applications, especially in industries like healthcare and manufacturing, cybercriminals are also harnessing powerful AI tools that can aid in their malicious activities.
The increasing usage of generative AI models like ChatGPT presents new risks that financial professionals should be aware of.
One major threat is the use of large language models (LLMs) and AI-generated content to refine social engineering tactics like business email compromise (BEC) attacks and phishing campaigns. LLMs can help attackers craft more natural-sounding and grammatically correct messages, overcoming red flags like spelling errors that might raise suspicion. AI writing assistants can also help cybercriminals overcome language barriers, enabling attacks in markets they previously struggled to penetrate.
Additionally, AI models trained on stolen personal data can analyse large datasets to identify vulnerabilities and high-value targets. Some advanced attacks even leverage multi-persona impersonation, with AI facilitating believable back-and-forth conversations to build trust before delivering malicious payloads.
Synthetic media allows users to artificially generate audio, video and even faces. Deepfake audio has already been used in high-profile “CEO fraud” cases to impersonate executives and deceive employees into transferring funds.
As this technology becomes more accessible, scammers may attempt to impersonate known business contacts using synthetic versions of their voices and faces during video calls. This could diminish trust across organisations and supply chains.
Security experts caution that the full extent of generative AI’s potential risks is still unknown. These powerful models can exhibit surprising behaviours and learn unanticipated capabilities, making it difficult to predict how they may be weaponized by threat actors in the future.
In light of these emerging AI-enabled threats, finance teams must adopt rigorous verification protocols, increase security awareness training, and stay vigilant against evolving social engineering tactics.
On average, a cyberattack occurs every 10 minutes in Australia with small to medium enterprises (SMEs), education, healthcare and government the most …
Crowdstrike outage aftermath: Government warnings, scam attempts, and essential steps to safeguard your business from cybercriminals.
See how a Rite Aid data breach compromised 2.2M customers’ data through an elaborate impersonation attack. Learn about the risks and preventive measures.
End-to-end B2B payment protection software to mitigate the risk of payment error, fraud and cyber-crime.
