Cyber Risks for Tradies: Invoice Scams & Hacked Emails

When we think about security for a trades business, we often think about physical assets. Locking the toolboxes on the back of the ute, securing the site at knock-off and tracking your machinery.

For many years that was enough, but times have changed in a big way.

One of the biggest threats to your business now isn’t someone cutting the padlock on your trailer, it’s a hacker getting into your email account and diverting your money into a different bank account.

You don’t need to be a massive corporation to be a target. If you use a smartphone, send digital invoices, run Xero or manage payroll online, you are at risk.

Hackers aren’t just targeting the big corporates. they want a quick five or ten grand, and small to medium sized trades businesses are an easy mark.

The Threats Tradies Actually Face

The Australian Cyber Security Centre (ACSC) received over 84,700 cybercrime reports in FY2024-25, with small business losses averaging $56,600 per incident (up 14% year on year) according to the latest Cyber.gov.au Threat Report.

For tradies, the risk breaks down into three main categories:

• Invoice Fraud: A scammer intercepts your email, swaps your BSB on an invoice, and your client pays them instead of you. This is the single most common cyber claim type in Australia, making up 31% of all claims per 2026 data.
• Ransomware: Malware locks your files, drawings, quotes, and job records. Ransom demands averaged $269,000 per incident in 2025.
• Accounting platform compromise: Someone gets into your Xero or MYOB and redirects payments or steals client data. Typical claims regularly hit $45,000+.

The Invoice Hijack

This completely bypasses standard security systems because it relies on human error rather than system glitches.

Here is exactly how it plays out:

1. The Invoice: You finish a job, send an invoice for $15,000, and email the PDF to the builder or homeowner.
2. The Interception: A scammer who hacked your email password weeks ago has been watching your inbox. The moment you send the invoice, they intercept it.
3. The Swap: They swap out your real BSB and account number for their own and forward the modified PDF to your client.
4. The Payment: The client receives the email from your exact email address and makes payment, assuming that nothing is wrong.
5. The Pain: Two weeks later you call the client chasing payment. They send you the receipt, and you realize the money has been paid into an account that isn’t yours.

This is an absolute nightmare scenario. The client paid the invoice they received, but you never got the cash. Getting those funds back from the bank is incredibly difficult once cleared, and it puts a massive strain on your cash flow and client relationships.

Locking Your Digital Toolbox

You wouldn’t leave your keys in the ignition of your ute while you walk into Bunnings. Leaving your business software unprotected is the exact same thing.

You can stop many of these attacks by implementing three straightforward habits:

• Turn on Two-Factor Authentication (2FA): Treat this as the padlock for your digital tools. Every major app, such Gmail, Xero, ServiceM8 etc. allows you to turn on 2FA. When you log in from a new device, it sends a code to your phone to prove it’s you. Sure it can by annoying, but it’s great protection.
• The verbal confirmation rule: If a supplier emails you claiming they’ve changed their bank details, or the details have changed on their latest invoice, do not transfer the money. Pick up the phone, dial their known number (not the number on the suspect email), and confirm it verbally with someone you know.
• Watch the text links: Scam texts pretending to be from Linkt about an unpaid toll, or Australia Post claiming a parcel can’t be delivered, are everywhere. Clicking these on your work phone can install malicious software that logs your keystrokes and steals banking passwords. If it looks weird, delete it immediately.

How the policy responds

A cyber policy doesn’t stop the scams, but it can deal with the financial consequences.

There are various cyber insurance policies available to tradies in Australia, and like any form of insurance, each has their own quirks when it comes to the coverage.

The following is a generalisation of what may occur after a claim, but keep in mind that each policy may respond slightly differently depending on the quality of the coverage.

Incident Response (The 24/7 Hotline)

This is the most immediately useful part. Many policies give you access to a panel of specialists around the clock. Within hours of calling, you have an IT forensic technician identifying and containing the breach, a lawyer advising on your obligations, and a PR consultant if clients need to be notified.

IT Forensics and System Restoration

The insurer pays forensic investigators to find the breach, remove malware, and restore your data. To put this in perspective, a business that refused to pay a ransom faced $80,000 in system restoration alone, plus $350,000 in business interruption. A $430,000 total bill. Without insurance, that would put most trades businesses into bankruptcy.

Business Interruption

If you can’t operate because your systems are down – meaning you can’t invoice, access job files, or run scheduling software – the policy pays lost income and extra costs during the recovery period. It typically covers 2–4 weeks of downtime, which is a realistic recovery window for an SME hit by ransomware.

Ransomware / Cyber Extortion

If criminals demand a ransom to unlock your files or threaten to publish stolen data, the policy can cover the ransom payment (where legally permitted), negotiation costs, and extortion management consultants.

Note: Since May 2025, businesses with a turnover above $3M must report ransomware payments to the ASD within 72 hours via ReportCyber. Many tradies will fall below this, but it’s worth knowing as you grow.

Notification Costs and Privacy Obligations

Under the Notifiable Data Breaches scheme, if you hold customer data (addresses, payment details, or email addresses) and it’s compromised, you may have a legal obligation to notify the OAIC and affected individuals. The policy covers legal advice, the cost of sending notifications, credit monitoring for affected customers, and regulatory response costs or fines where legally insurable.

Invoice Fraud / Social Engineering

This is the tradie-specific clause to scrutinise carefully. Many policies cover invoice fraud, but it is typically sub-limited. A $1,000,000 policy might only have $50,000 available for social engineering losses. If invoice fraud is your biggest exposure, you need to ensure your policy has a suitably large limit and check whether the policy requires a call-back verification procedure as a claims condition.

Third-Party Liability

If a client or supplier suffers a loss because your systems were the entry point, for example if a subcontractor’s details were stolen from your compromised system, the policy covers legal defence and damages claims against you.

Please note that the above items are examples of what a cyber liability policy may cover. Each policy is unique and you should speak with your broker about your own specific needs and exactly what your policy covers.

More Information

Protecting your business online doesn’t mean you need an IT degree. It just means treating your digital assets with the same respect you treat your physical tools.

For more information about cyber insurance designed for trades businesses, speak with your Trade Risk broker or call our team on 1800 808 800.