Fake invoices: what an ABN check catches, and what it can't

What an ABN check catches

An ABN is 11 digits with a built-in check digit, so a number that has been made up or mistyped usually fails the checksum straight away. A number that passes can still be missing from the Australian Business Register, cancelled, or belong to a different business from the one named on the invoice.

ABN Lookup shows the entity name, any business names, whether the ABN is active and whether the entity is registered for GST, including the dates. If an invoice charges GST but the ABN wasn't registered for GST on the invoice date, or the name on the invoice doesn't match anything on the register, that is worth a question before you pay or claim a GST credit.

This is most useful for invoices from someone you haven't dealt with before, or bills for goods or services nobody remembers ordering, which Scamwatch lists as a warning sign of its own.

What an ABN check can't catch

The most common version of this scam, called payment redirection or business email compromise, uses a real supplier's details. Scamwatch describes it like this: the email comes from a business you've been dealing with, sometimes from its real address because its email has been hacked, sometimes from an address that is one letter different, and it can sit in the same email thread as genuine messages. The invoice looks right and carries the right ABN. Only the payment details are different.

Because the ABN is genuine, an ABN check passes. If you reply to the email to ask about the new account, Scamwatch and the ACCC both note the scammer will answer and explain the change.

The check that stops payment redirection

Scamwatch's advice is to stop and check any change to payee details, and to call the business on a phone number you found yourself, from its official website, app or your own records, not the number in the email or on the invoice.

Compare the BSB and account number against an earlier invoice or payment you know was genuine. Check the sender's email address letter by letter. Treat a new or changed account on a large or urgent payment as a reason to slow down, not speed up.

If you have already paid, Scamwatch says to contact your bank or card provider immediately and ask them to stop the transaction, change your passwords, and then report it to Scamwatch. IDCARE (1800 595 160) offers free help to make a recovery plan.

A simple routine for bookkeepers

Check new suppliers' ABNs when you set them up, and check the whole supplier list each quarter so cancelled ABNs and lapsed GST registrations show up before the BAS. ClearABN does that for a Xero, MYOB or QuickBooks export or a pasted list, and the free tax invoice checker looks at a single invoice against the register on its date.

Separately, never change a supplier's bank details from an email alone. Confirm by phone on a number you already had, and note who you spoke to.

Register facts, not advice

ClearABN reports what the Australian Business Register shows. A clean ABN result doesn't mean an invoice or its bank details are genuine. If you think you've been scammed, talk to your bank first.