TL;DR: In September 2026, NAB warned of fake audit emails that ask businesses for invoice details for a "credit review" or "internal audit", sometimes styled as a forwarded email from a NAB banker. In July 2026, Westpac warned that a business called "Westpac-Group Australia" has no link to Westpac. Both feed invoice and payment redirection fraud, which cost Australians $166.8 million in 2025. Verify any request by phone with a number you already have.
The fake audit email
From NAB’s alerts (September 2026):
- Emails ask businesses for invoice details as part of a "credit review" or "internal audit".
- Some pose as a forwarded message from a NAB banker.
- Don’t respond. Verify with your banker first.
Why invoices? Because with real invoices, a scammer learns who you pay, how much and when. Next comes a perfectly timed "our bank details have changed" email from your "supplier."
The look-alike company
Westpac (July 2026): "Westpac-Group Australia" is not affiliated with Westpac and isn’t authorised to use its name. Verify any payment requests independently.
A hyphen and the word "Group" are all it takes to look official. It’s the corporate version of a knock-off handbag.
The bigger picture
Payment redirection scams cost Australians $166.8 million in 2025, per National Anti-Scam Centre data cited by CommBank. Businesses are prime targets because they pay large invoices routinely.
Controls that work
- Never send invoices or customer lists in response to unexpected "audit" requests. Call your banker on a number you already have.
- Verify every bank detail change by phone, using a saved number, not one from the email.
- Use Confirmation of Payee: a "No match" on a supplier payment is a red flag (how it works).
- Two-person approval for new payees or changed details.
- Turn on MFA for all business email accounts. A hacked inbox is how most of this starts.
- Train staff to pause on urgency.
If you’ve paid a fake invoice
- Call your bank immediately to try a recall.
- Report to ReportCyber and Scamwatch.
- Check your email for forwarding rules you didn’t create.
Real Australian cases: Victoria’s $118K BEC recovery and Sydney’s $600K BEC case. A free exposure check shows if staff emails appear in breach data.
Frequently Asked Questions
Does NAB email businesses asking for invoices for an audit?
NAB warned in September 2026 that such "credit review" or "internal audit" emails are scams. Verify with your banker first.
Is Westpac-Group Australia part of Westpac?
No. Westpac says it is not affiliated or authorised to use its name.
How much do Australians lose to payment redirection scams?
$166.8 million in 2025, according to National Anti-Scam Centre data.
How do businesses prevent invoice fraud?
Verify bank detail changes by phone using saved numbers, use Confirmation of Payee, require two-person approval and turn on MFA.