Payment Scams Are Getting Smarter: How to Protect Your Business Before Christmas
Scammers rely on rushed approvals and people being away, and December has plenty of both. Here are the checks that matter most, drawn from Xero's own security guidance.
If it involves money or access, confirm it somewhere else before you act. That one rule covers most of what follows.
Xero's security team published practical guidance in October for Cybersecurity Awareness Month. We've pulled out the parts that matter most for owner-run businesses.
Start With the Basics
Use a different password for every account. Turn on multi-factor authentication wherever it's available. Xero says it's mandatory for all Xero users.
Give everyone their own login, so you always know who did what.
Know the Red Flags
Xero lists four. Any one of them is a reason to stop and check.
Urgency. "This needs paying today." Pressure to skip the checks is the point of the message.
Seniority. "The boss wants it now." A senior name makes people hesitate to question a request.
A request outside your normal process. New bank details sent by email is the classic.
A conversation that jumps channels. It starts in email, then moves to text or WhatsApp.
Voices and Videos Can Be Faked
- Agree a code word with the people who approve payments.
- Call back on a number you already have, never the one in the message.
- Set a payment threshold. Above it, a second person must approve.
- Think about what's public. Details about who approves payments are useful to someone pretending to be them.
- Don't rely on spotting glitches. The fakes keep getting better.
Be Careful What You Paste Into AI Tools
Agree which AI tools your business uses. Keep sensitive information, like bank details, payroll and client data, out of free public tools.
If Something Goes Wrong
- Contact your bank straight away.
- Change your passwords.
- Report it to the Australian Cyber Security Centre.
- Tell your team, so nobody else acts on the same message.
- Forward suspicious Xero-branded messages to phishing@xero.com.
So What Does This Mean for You?
Scams work because they look like routine. You don't need to spot every trick. A small process beats good instincts: a code word, a call-back and a second approver.
And you don't have to be the only check. If a supplier's bank details change or a request feels off, send it to us before you pay.
Want a Second Set of Eyes on How Payments Are Approved in Your Business?
We'll talk it through with you.
Talk to the Diverse Team