Your business was scammed: will the bank pay it back, and what changes in 2027?

If your business has been scammed, call your bank on its official number right now and ask it to stop or recall the payment. Then report to ReportCyber, Scamwatch and IDCARE. A refund is never guaranteed and depends mostly on speed. The new Scams Prevention Framework strengthens protections, but only for scam conduct on or after 31 March 2027.

If you’re reading this with your stomach in your boots, start with the next section and come back to the rest later. If you’re here to plan ahead, the later sections explain what changes and how to keep the business running while a claim plays out.

What should I do in the first hour after a business scam?

Work through these in order. The first one is the only one that can move the money.

1. Call your bank. Use the number on the back of your card or on the bank’s official website, never one from the email, text or call that tripped you up. Say plainly: “I’ve been scammed, I need the payment stopped or recalled.” Ask for the fraud or scams team, and note the time and the name of the person you speak to.
2. Stop all contact and further payments. Don’t reply to the scammer, don’t “test” them, and don’t send a smaller amount to make it go away.
3. Report to ReportCyber. The ACSC’s report-and-recover pages explain how, and the report goes to the relevant police jurisdiction. You’ll want the reference number for your bank and insurer.
4. Report to Scamwatch. Include screenshots, the account details you paid, and any impersonation of your business. You can do it through Scamwatch.
5. Contact IDCARE. ASIC notes IDCARE is free for sole traders and small businesses and can help you build a recovery plan.
6. Lock down the accounts. Change passwords, switch on multi-factor authentication, check email forwarding rules and remove any app or user you don’t recognise. A hijacked inbox is how many payment-redirection scams start.
7. Tell the ATO if tax details walked out the door. If employee tax file numbers or banking details may have been taken, ASIC’s guidance says to let the ATO know.

Write down a timeline as you go: when the payment left, when you noticed, when you called. It makes every later conversation, with the bank, AFCA or a lender, quicker.

Will the bank actually pay my business back?

Honestly: sometimes the money comes back, often only part of it, and sometimes none.

What decides it today:

• How quickly you reported. Scammers move funds on fast. If the money is still sitting in the receiving account when your bank contacts the other bank, a recall has a real chance. A day later, much less.
• Whether you authorised the payment. If you or your team approved the transfer, even under false pretences, the bank usually isn’t obliged to refund it. If someone accessed your account without your authority, the position is different and stronger.
• What the banks did or didn’t do. If your bank missed an obvious red flag, or the receiving bank let a mule account operate, that’s the substance of a complaint.

Whatever happens, ask for the outcome in writing. If you’re not satisfied, ASIC’s guidance says to complain to the bank first, and then small businesses and sole traders can go to the Australian Financial Complaints Authority, which is a free service.

Don’t rely on the consumer assumptions you might have heard. A lot of public talk about “banks refunding scams” is about individuals. A business account, especially a company account paying a supplier, is judged more like a commercial customer who is expected to run its own controls.

What is the Scams Prevention Framework and what does it change for small businesses?

The Scams Prevention Framework (SPF) is a federal scheme that puts scam-prevention duties on designated industries. Banks, telcos and certain digital platforms are the first in line. The headline dates, based on public law-firm briefings of the Treasury material:

• The initial designation instrument was made in May 2026.
• Sector codes, the detailed rules for each industry, were drafted by Treasury and are proposed to apply from 31 March 2027 or later.
• Designated businesses will need to belong to AFCA so people can escalate scam complaints.
• AFCA ran a consultation on its proposed scam rules that closed on 28 September 2026, with final versions expected in early 2027.

For you, the practical points are these:

• Small businesses are in scope. An eligible small business can bring a scam complaint, with eligibility judged by your status when the conduct happened.
• It isn’t retrospective. The conduct must generally occur on or after 31 March 2027. A scam in October 2026 isn’t covered by the SPF pathway.
• Treasury’s reimbursement ideas are proposals. Draft codes and position papers have discussed how reimbursement could work, but until the final codes are made, nobody should plan their cash on a refund that doesn’t yet exist.

So for now, the safest planning assumption is simple: build controls as if the bank won’t refund you, and treat anything it does recover as a welcome surprise.

How do I stop it happening twice?

Most business scams are not clever hacking. They’re a believable request at a busy moment. Four habits close most of the gaps:

• Call back on a known number before changing any bank details. Use the supplier’s number from an old invoice or your own records, not the one in the email asking for the change.
• Two people for new payees. One person sets up a payee, another approves the payment. For a sole trader, the second set of eyes can be your bookkeeper.
• Lower the limits on online banking. Keep daily transfer limits close to what you really send, and lift them only when needed.
• Multi-factor authentication on email, banking and accounting software. Your email inbox is the master key to the rest.

For the lender-impersonation version, where the “loan” arrives with an upfront-fee request, our guide to spotting a fake online lender is worth a read, and so is how linking bank statements stays safe.

How do I cover the cash hole while the claim runs?

This is the part nobody puts in the scam fact sheets. A scam usually lands on top of a normal month: wages, a BAS instalment, rent, suppliers. Recovery, if it comes, can take weeks, and your bills won’t wait.

A worked example (illustrative only): a small trades business pays a $38k supplier invoice to new bank details after a convincing email. It spots the problem four days later. The bank’s recall recovers part of the money, the claim for the rest drags on, and the next payroll and a supplier run are due within ten days. The business is profitable, and it is simply short of cash for a month or two.

That’s a timing problem, and it’s the kind finance is built to handle:

• A short-term business loan can bridge a defined gap.
• A business line of credit gives you room to draw only what you need.
• A property-backed option may suit a bigger hole, if you have equity.

If that sounds like your position, you can check your options with a 60-second online enquiry while you handle the reports and the bank. It doesn’t need to wait for the claim to finish.

What will a lender think of a scam loss on my statements?

Lenders read bank statements, so the transaction will be visible. That’s fine. What a lender wants to see is the trading story around it:

• Steady income before and after the incident.
• A short written explanation, with the ReportCyber reference and your bank’s case number.
• The controls you’ve changed since, such as dual approval and call-backs.

An unexplained gap is more worrying than an explained one. Be upfront, and keep the explanation to a few sentences.

Ready to get the business back on its feet?

A scam is a rotten thing to happen to a hard-working business, and it says nothing about how well you run it. Once the reports are filed and the bank is on the case, the next question is how you keep paying people while the dust settles.

That’s where we can help. Our 60-second online enquiry won’t touch your credit file, so asking is risk-free. We don’t send your details to a pile of lenders, so your phone won’t light up with strangers. A real person reads your situation and calls you to talk it through. All we ask is that you fill the form in accurately, including the scam loss, so we can match you with the right option first time.

See if you qualify →