Email Security for Hospitality Businesses — Avoiding Invoice and Supplier Fraud

Why Hospitality Is a Target for Email Fraud

A busy restaurant or hotel manages relationships with dozens of suppliers — food and beverage distributors, linen services, cleaning contractors, equipment providers, booking platforms, and more. Regular invoices arrive by email. Payment terms are established. Relationships are ongoing.

This environment is attractive to fraudsters for a specific reason: it is normal to receive invoices from many different sources, and it is normal for details to change occasionally. A new account number from a supplier does not automatically raise suspicion — it might be a genuine change, or it might be fraud.

Business email compromise (BEC) and invoice fraud cost Australian businesses hundreds of millions of dollars each year. Hospitality businesses, with their complex supplier networks and often lean administrative teams, are regularly targeted.

How Invoice Fraud Works

The most common form of invoice fraud targeting hospitality businesses follows a predictable pattern.

An attacker either compromises a supplier's email account or creates a convincing lookalike email address (for example, an extra letter or hyphen that is easy to miss). From this address, they send your accounts or management team an email explaining that the supplier's bank account details have changed, providing new banking information for future payments.

If the email is trusted and the new details are entered into your accounting system, your next payment goes directly to the fraudster's account rather than your supplier. By the time the legitimate supplier follows up on the unpaid invoice, the fraudster has withdrawn the funds.

Losses in individual cases can be thousands to tens of thousands of dollars. Recovery is difficult — once a bank transfer is made, reversing it is often impossible.

Recognising the Warning Signs

Business email compromise attempts have become sophisticated, but there are often warning signs.

The email requests a change to payment or banking details — this should always trigger additional verification, regardless of how legitimate the email appears.

There is urgency — fraudsters often create time pressure, suggesting that payment is overdue or that a discount is available if payment is processed immediately.

The email address is slightly different from the real supplier's — look carefully at the full email address, not just the display name. Attackers often use domains that look similar (for example, "netluma-invoicing.com" instead of "netluma.com.au").

The request arrived unexpectedly — a banking change notification that was not preceded by any other communication or conversation with the supplier.

The email contains unusual formatting, grammar issues, or unfamiliar language — not all fraud attempts are sophisticated. Many contain subtle errors that stand out on close reading.

Technical Email Security Measures

Beyond human vigilance, technical measures significantly reduce email security risk.

Spam and phishing filtering — business email platforms with intelligent filtering (such as Microsoft 365 with Defender for Business, or equivalent) detect and quarantine many malicious emails before they reach staff inboxes. This includes many spoofed sender addresses and phishing attempts.

SPF, DKIM, and DMARC — these are technical email authentication standards that verify whether an email claiming to come from a domain is actually authorised by that domain. Configuring these correctly for your business email domain makes it harder for fraudsters to impersonate your domain in emails to others — and helps receiving servers identify spoofed emails sent to you.

Multi-factor authentication on email accounts — if a staff member's email account is compromised through credential theft, MFA prevents the attacker from accessing it even with the correct password. Protecting email accounts with MFA is one of the single most effective security measures available.

Email alerts for forwarding rules — attackers who do gain access to an email account often set up forwarding rules to silently copy emails to themselves. Monitoring for new forwarding rules being created is an important detection measure.

Procedural Controls

Technical measures alone are not sufficient. Procedural controls — simple rules that everyone follows — are equally important.

Phone verification for any change to payment details — this single rule stops most invoice fraud. Before updating any supplier's bank account details, call the supplier on a number you already have (not one provided in the suspicious email) to confirm the change. This verification step takes a few minutes and can save thousands of dollars.

Two-person approval for large payments — for payments above a threshold, requiring two people to authorise rather than one reduces the risk of a single compromised staff member or a single moment of inattention enabling a fraudulent payment.

Supplier contact list maintenance — keeping a verified list of supplier contact information that is not dependent on emails received means you can always reach suppliers through a channel you trust.

New staff briefing — new accounts and management staff should be briefed on invoice fraud before they have access to payment processes.

Reporting Suspected Fraud

If your venue receives a suspicious email or suspects a fraudulent payment has been made, prompt action matters.

Contact your bank immediately if a payment has been made to a fraudulent account — rapid reporting increases (though does not guarantee) the chance of recovery.

Report the incident to the Australian Cyber Security Centre (ACSC) through ReportCyber. The ACSC provides guidance to businesses affected by cybercrime.

Work with your IT provider to understand how the fraud occurred and what additional controls should be implemented.

A Practical Approach

Email fraud prevention in hospitality does not require significant investment. The highest-value steps are:

• Multi-factor authentication on all business email accounts
• A clear, enforced rule that any banking change request requires phone verification before action
• Basic phishing awareness for staff who handle payments or supplier correspondence

These measures, consistently applied, prevent the vast majority of invoice fraud attempts. The cost of not having them — even one successful fraud — far exceeds the effort of putting them in place.

For a broader view of cybersecurity and IT support for hospitality businesses, visit our Hospitality IT page.