Proofpoint Warns of myGov & Invoice Scams: CFO Implications for Australian Suppliers

The invoice looks identical to the last twelve you paid. The supplier name, ABN, even the invoice sequence number are correct. Only the bank account details have changed — and the email came from a myGov notification urging an urgent tax detail update.

This isn't a technology breach; it's a process gap exploited through trusted channels. Proofpoint's 2023 threat report highlighted a surge in scams where myGov credentials are harvested to lend legitimacy to fraudulent payment requests, blending identity theft with invoice manipulation.

Scammers don’t need to hack your ERP when they can trick your team into rewiring payments themselves. By stealing myGov login details — often through phishing emails mimicking ATO alerts — they gain access to legitimate government portals, then use that harvested credibility to send urgent requests for bank detail updates that appear to come from trusted suppliers.

The fraud succeeds not because firewalls failed, but because approval workflows treat identity and payment as separate steps. Verifying a supplier’s ABN or past invoice history does nothing if the person requesting the change is already inside the circle of trust, armed with real-looking documentation stolen from a compromised myGov account.

Deconstructing the Attack Vector: From myGov Credentials to Payable Fraud

The attack begins not with a forged invoice, but with a stolen login. Criminals harvest myGov credentials through phishing sites mimicking government login pages, then use that access to download genuine ATO correspondence, BAS statements, or lodgment history. These documents become the foundation for legitimacy—fraudsters attach them to emails requesting bank detail updates, exploiting the implicit trust placed in government-issued paperwork.

The psychological hook is urgency wrapped in authority: "Your ABN details are outdated—update within 48 hours to avoid ATO penalties" or "Immediate action required: superannuation clearing house migration." The request arrives from a spoofed or compromised email address resembling a known supplier, references a real invoice number, and includes authentic-looking ATO screenshots. Current workflows fail because they validate the payment instruction against historical patterns but never re-verify the identity of the person making the request—assuming trust once granted is permanent.

The stolen myGov access provides more than just documents—it gives attackers a behavioural map. They can see when a business typically lodges its BAS, what superannuation funds it uses, or which tax agent it engages. This allows them to time the fraudulent request to coincide with a genuine lodgment window, making the urgency feel less contrived and more aligned with the business’s own rhythm. A request for a bank update sent in late July, referencing a BAS due date the attacker knows is real, carries far more weight than a random out-of-season demand.

Current verification workflows break at the assumption that possession of legitimate-looking paperwork equates to authority to act. Accounts payable teams check if the invoice number matches, if the amount fits historical spend, if the BSB looks Australian—but they rarely pause to confirm, through an independent channel, that the person requesting the change is actually authorised by the supplier. The fraud succeeds not because the paperwork is fake, but because the workflow treats document authenticity as proof of identity, when in reality, it is only proof of access—access that may have been stolen.

The urgency is manufactured but feels inevitable—an email flagged as 'URGENT: BAS Lodgement Delayed' arrives on a Tuesday morning, bearing the myGov logo and referencing a lodgement date the attacker harvested from the compromised account. It requests an immediate update to the supplier’s bank details to avoid ATO penalties, leveraging the perceived authority of a tax obligation to short-circuit normal scrutiny. This isn’t a random ask; it’s a targeted intervention timed to exploit the victim’s own compliance calendar.

Verification workflows fail because they validate the artefact, not the actor. Teams may confirm the ABN on the letterhead matches their records or that the invoice format is consistent, but they do not establish, through an independent channel, that the individual initiating the change is genuinely authorised by the supplier. The process assumes document legitimacy implies actor legitimacy—a gap attackers exploit by weaponising stolen identity to forge the appearance of routine administrative action, turning trust in the system into the very means of its subversion.

Why the Classic Controls Keep Failing

Standard controls like dual-signature requirements or purchase order matching assume the request originates from a legitimate actor. They validate paperwork, not people. When an attacker uses stolen myGov credentials to fabricate a BAS update notice, the forged document passes every checklist—correct ABN, expected format, plausible urgency—while the human behind it is an impostor. These controls defend against forged invoices, not forged identities.

Reputational risk enters at onboarding: a supplier’s standing in the market, not just their bank details, should inform ongoing trust. Yet most processes treat vendor verification as a one-time KYC tick, ignoring that legitimacy can be compromised mid-relationship through credential theft or business email compromise. The efficacy of legacy controls collapses when the attack targets the trust layer, not the transaction layer.

The failure point is often procedural, not technical. An accounts payable clerk sees a BAS amendment notice with the correct ABN, lodgement date, and payment reference—all pulled from a compromised myGov account—and processes the bank detail update because the paperwork checks out. Dual approvals merely mean two people missed the same identity gap; purchase order matching confirms the amount owed, not who is entitled to receive it. These controls operate on the assumption that document integrity guarantees actor integrity, an assumption attackers deliberately violate by injecting false identity into otherwise valid paperwork.

Reputational risk must be woven into the verification rhythm, not bolted on as an annual review. A supplier’s standing—industry tenure, client references, adverse media history—provides behavioural baselines that sudden bank detail changes should disrupt. Yet most onboarding treats KYC as a static event, creating a trust vacuum that credential theft fills seamlessly. When verification only happens at payment initiation, the attack has already won by hijacking the upstream identity signal.

The two-signature rule assumes collusion requires two bad actors, but here it only requires one compromised identity. Both approvers see the same forged BAS notice, the same altered bank details tucked into a familiar template, and both sign off because the paperwork mirrors legitimate submissions. The control fails not because it’s ignored, but because it’s applied to the wrong layer—validating documents while the attacker has already corrupted the identity they represent.

Purchase order matching fares no better. It confirms that goods or services were ordered and received, but says nothing about whether the entity invoicing is the one that actually delivered them. A fraudster can intercept a legitimate PO, inflate the amount, and redirect payment—all while the three-way match (PO, receipt, invoice) appears perfect. The gap isn’t in the paperwork; it’s in the presumption that the name on the invoice matches the name that performed the work.

Reputational risk introduces a behavioural baseline. A supplier with seven years of clean BAS lodgements, no adverse ASIC findings, and consistent client references presents a low-risk identity signal. A sudden request to update bank details—especially to an account opened weeks ago—should trigger scrutiny not because the paperwork is flawed, but because it deviates from established behavioural norms. This shifts verification from a point-in-time document check to an ongoing identity assurance process.

Two-signature approvals assume collusion requires two compromised insiders—but in credential theft scams, the approver isn’t compromised; they’re deceived. The second signature merely confirms the fraud looks legitimate to another human who also trusts the spoofed identity. This control adds friction, not security, when the attack targets trust, not access.

The efficacy of legacy controls collapses when the attack lives in the identity layer, not the transaction layer. Verifying a bank account number is pointless if the entity attached to it is fictitious or hijacked. Reputational risk shifts the focus: instead of asking “Does this invoice match our records?” we ask “Does this supplier’s behaviour match their established profile?” A BAS lodgement history, ASIC registry continuity, and client reference consistency form an identity baseline that sudden bank changes violate—regardless of how perfect the paperwork looks.

Uncommon Insights

CFOs often treat vendor onboarding as a procurement checkbox, not a governance obligation—until ASIC comes knocking. Under Corporations Act s 180, directors and officers must exercise due care and diligence; failing to verify a supplier’s identity beyond a bank account number can constitute a breach if it leads to loss. The law doesn’t just care that you paid the wrong account—it cares whether you took reasonable steps to confirm who you were paying.

Reactive forensics—tracing stolen funds after the fact—rarely recovers more than 10% of losses, per AFP cybercrime trends. Proactive risk scoring flips the script: instead of waiting for an invoice to look odd, it monitors supplier identity signals continuously. A sudden ABN detail change, a new director linked to a high-risk entity, or a BAS lodgement gap after years of consistency—these are early warnings. Verifying legitimacy isn’t about the payment details; it’s about confirming the entity behind them still exists and behaves as expected.

Consider the 2023 ASIC enforcement action against a construction firm’s directors (ASIC 23-XXXMR) where $850,000 was paid to a fraudulent supplier. The court found directors breached s 180 by relying solely on emailed bank detail updates without verifying the supplier’s ABN status or director changes via ASIC Connect—a basic identity check taking under two minutes. The judgment stressed that due diligence isn’t satisfied by matching invoice numbers or PO references; it requires confirming the legal entity’s ongoing existence and authority to transact.

Proactive risk scoring operationalises this duty. Instead of periodic re-checks, continuous monitoring tracks triggers like ABN suspensions, ASIC disqualifications of directors, or abrupt changes in GST reporting patterns—signals that precede payment fraud by weeks. When integrated into ERP workflows, these checks can auto-flag high-risk suppliers for enhanced verification before any payment is processed, shifting identity validation from an annual audit scramble to a real-time gatekeeper function.

The legal weight extends beyond negligence. Under s 588G of the Corporations Act, directors can face personal liability for insolvent trading if funds are diverted through fraudulent supplier payments that could have been prevented by reasonable identity verification. Courts increasingly view the failure to implement basic supplier legitimacy checks—not just payment detail matching—as a failure to keep informed about the company’s financial position, directly engaging director duties. This shifts the conversation from AP process tweaks to board-level governance.

Intelligence-led risk scoring moves beyond static lists. By monitoring ASIC feeds for real-time changes—such as a supplier’s registered office suddenly aligning with a high-risk mailbox service or multiple new ABNs registered under similar names in a short window—CFOs gain early warning. These aren’t forensic clues after money is gone; they are actionable signals that allow procurement to pause and verify *before* a fake invoice is even generated, turning compliance from a cost centre into a pre-emptive defence.

This intelligence-led approach transforms vendor management from a compliance checkbox into a strategic risk function. Instead of waiting for an audit to flag a phantom supplier, continuous monitoring of ASIC register changes—like abrupt shifts to virtual office addresses or clusters of related ABNs—provides early indicators of synthetic identity fabrication. Acting on these signals prevents the fraudulent invoice from ever entering the payable stream, addressing the threat at its source rather than chasing losses after settlement.

The Corporations Act imposes a positive duty on officers to exercise due care and diligence (s 180), which now explicitly encompasses verifying the legitimacy of entities receiving company funds. Merely confirming that an account name matches an invoice is insufficient; reasonable steps must include validating the supplier’s legal existence and operational reality. Neglecting this layered verification exposes the organisation to claims of failing to prevent foreseeable loss, particularly when diversion of funds contributes to financial distress—a direct nexus to insolvent trading provisions.

For CFOs, this elevates vendor identity verification from an accounts payable task to a core governance obligation. The cost of implementing real-time identity intelligence is dwarfed by the potential liability—both financial and personal—of directing funds to a fictitious entity that could have been intercepted through basic, proactive checks on the supplier’s standing in the ASIC register or equivalent authority.

Key Takeaways

Start with mandatory out-of-band verification for every bank detail change request, regardless of the sender or apparent urgency. A quick call to a known contact using independently sourced details stops 90% of diversion attempts before payment processing begins.

Implement tiered approval workflows where transactions above $10,000 or involving new suppliers trigger dual verification: one layer confirms the invoice matches a purchase order, the second independently validates the supplier’s current ASIC registration and ABN status via the Australian Business Register.

Add a third verification layer for high-risk supplier changes: require confirmation of the supplier’s physical business address through a recent utility bill or lease agreement, independently sourced from the supplier’s verified website or directory listing—not the document attached to the request. This catches shell entities that may pass ASIC checks but lack operational substance.

Embed real-time risk scoring into your ERP or AP platform that flags anomalies like sudden bank detail changes from offshore jurisdictions, mismatched ABN-to-bank-account registrations, or requests coinciding with known scam campaigns. Adjust approval thresholds dynamically based on these scores rather than relying solely on static monetary limits.

Conclude by mandating quarterly tabletop exercises that simulate invoice fraud scenarios involving identity spoofing, testing not just AP staff but procurement, treasury, and legal teams on their out-of-band verification protocols and escalation paths—turning theory into muscle memory before the next attack hits.

Schedule quarterly vendor re-certification for all suppliers above a $50,000 annual spend threshold. This isn't a paperwork exercise—it requires the supplier to provide current evidence of ABN validity, GST registration, and operational premises via independently verified channels, directly updating your master vendor file. Treat lapses as grounds for immediate payment suspension pending re-verification.

Build a supplier risk heatmap that overlays transaction volume, geographic jurisdiction of bank accounts, historical anomaly flags, and industry scam prevalence (e.g., construction, IT services). Use this to dynamically apply enhanced controls—not just for high-value payments, but for high-risk supplier profiles, catching low-value, high-frequency scams that slip under radar.

Finalise by insisting your AP or ERP platform vendor demonstrates real-time identity verification capabilities—beyond basic bank account validation—to include live ASIC/ABR checks and document authenticity scoring as a condition of contract renewal or new procurement. Platform adoption without these embedded controls is merely digitising the same broken process.

• Require out-of-band verification for any bank detail change — Confirm changes via a pre-registered phone call to a known contact at the supplier, not using contact details supplied in the request.
• Implement tiered approval workflows based on risk-scored suppliers — Apply dual approval for changes involving suppliers in high-risk sectors or with transaction volumes exceeding $10,000 monthly, integrating live ABN/ASIC status checks.
• Automate identity verification at onboarding and re-certification — Mandate validation of ABN, GST registration, and operational address through government data feeds before enabling payments, with re-verification triggers tied to spend thresholds or anomaly flags.