Fewer Scams, Bigger Losses: Scam Risks for Small Businesses 

Scams are an ongoing threat to Australian small businesses. Recent data from ScamWatch indicates that scam numbers are dropping – however, looking only at report volumes does not tell the full story. 

BizCover has analysed ScamWatch data from 2024 and 2025, focusing specifically on scam categories most likely to disrupt small businesses: phishing, hacking and identity theft. 

To better understand these trends, we spoke with Akshaye Kalkura, BizCover’s Chief Information Security Officer, who gave insights into what this means for small businesses in 2026. 

“For small businesses, this information is highly relevant and important,” says Kalkura. “Lower report volumes do not necessarily mean businesses are safer. Instead, it indicates that when scams succeed, they are causing more financial damage than previous years.” 

Key takeaways 

• Scam reports fell 20.8%, yet total losses still rose 3.4%. The average loss per report increased 30.4%. 

• Phishing remains the most reported fraud type in 2025, despite a 33% decline in reports. 

• Investment fraud account for the largest financial losses, totalling $172.2m in 2025. 

• Jobs and employment fraud recorded the strongest growth, with reports up 102.5% and losses up 81.5%. 

• Loss growth is shifting toward younger Australians, particularly 18- to 24-year-olds, where losses rose 87.4%. 

• While female losses declined 9.9%, male losses rose 15.9% despite fewer reports. 

• Online channels now account for the largest share of losses at $130.4m in 2025. 

Scam reports fall as financial losses rise 

One of the most concerning trends is the average loss per report. The average reported loss rose by 30.4%, increasing from $1,350 in 2024 to $1,762 in 2025. 

So while total scam reports fell from 211,609 in 2024 to 167,667 in 2025 (declining by 20.8%) financial losses increased from $285.8 million to $295.4 million. This reflects a 3.4% rise overall. 

“Threat actors are increasingly focusing on tactics that can generate larger payouts. For small businesses, a single successful incident can have a much bigger financial impact than in previous years,” observes Kalkura.  

And it doesn’t end with an unexpected hit to business’s budget. A successful scam can affect many other parts of a business’s operations, such as payroll and supplier payments. But it can also put customer data at risk. This can have serious consequences for clients and the business’s reputation, increasing cyber security exposure, data breach risk and overall digital risk across connected systems. 

Top 10 most reported scam types 

In 2025, phishing remained the most commonly reported scam type among the categories analysed, with 65,361 reports recorded throughout the year. Shopping scams ranked second with 24,752 reports, followed by identity theft, which recorded 20,944 reports.  

And while phishing reports declined by 33% from 2024 to 2025, the total financial losses associated with phishing increased by 51.7%. At the same time, the average loss per phishing report more than doubled, rising from $209 in 2024 to $476 in 2025. 

“Phishing attacks have evolved well beyond the generic spam emails people used to associate with scams,” says Kalkura. “Today’s phishing campaigns are often highly targeted and designed to mimic legitimate communications from suppliers, banks or internal teams. When attackers gain access to credentials or payment systems, the financial impact can escalate quickly for small businesses.” 

Kalkura points out that AI is also changing how scams are carried out today.  

“AI tools allow fraudsters to generate highly convincing emails, invoices and messages that closely resemble legitimate business communications. That makes it harder for business owners and their employees to spot phishing attempts and increases the likelihood that a single message could lead to a costly mistake.” 

AI also allows fraudsters to launch attacks at scale across digital platforms, increasing both speed and sophistication. 

For small businesses in 2026, this reinforces the importance of having strong cybersecurity measures in place, such as multi-factor authentication, secure password management, and clear internal processes for verifying payments or requests for sensitive information. 

Most financially damaging scam types in Australia 

While some scams occur more frequently than others, the financial impact of different scam types varies significantly. In 2025, investment schemes were responsible for the largest share of financial losses, generating $172.2 million across the analysed scam categories. 

This figure represents more than half of all recorded scam losses, far and away exceeding every other scam type included in the analysis. Although investment scam losses declined 10.5% from 2024 to 2025, they are still the most financially damaging type of scam. 

The next highest financial losses were recorded for phishing attacks, which generated $31.1 million, followed by jobs and employment scams at $24.9 million. Rounding out the top four were false billing scams, which accounted for $23.6 million in losses. 

Across all incident categories analysed, the average loss per report was $1,762. However, investment scams stand out for their significantly higher financial impact, with an average loss of $25,376 per report. 

“High-loss schemes often succeed because they exploit trust and urgency,” explains Kalkura. “In an investment scam, for example, scammers will usually try to build up credibility to gain a victim’s trust. Then they will turn up the pressure, making the target act fast, so that they can steal the money before the fraud is realised.” 

Kalkura notes that businesses can also be exposed when staff are approached through professional networks, email, or online platforms with investment opportunities or financial offers that appear legitimate. 

“Whether it’s an investment opportunity, a supplier request, or an invoice that appears genuine, the amounts involved tend to be higher – which is why these incidents result in much larger losses per report.” 

For small businesses, this is a good reminder to always verify financial requests, conduct due diligence before transferring funds, and ensuring employees understand the risks associated with unsolicited financial offers or payment requests. 

Jobs and employment scams double 

Jobs and employment scams recorded the strongest year-on-year growth of all analysed scam categories in 2025, highlighting a rapidly expanding area of scam activity. 

Reports of these scams rose by an astonishing 102.5%. Financial losses also increased significantly, climbing 81.5% to reach $24.9 million in 2025. 

The sharp increase reflects the popular use of online job platforms, social media, professional networking sites and remote hiring processes, which bad actors can exploit to reach large numbers of potential victims. 

For small businesses, these scams are particularly relevant in 2026 because they can intersect with recruitment, onboarding and payroll processes. Businesses advertising roles or interacting with candidates online may be impersonated by scammers, while employees responsible for hiring or HR administration may encounter fraudulent applications or communications. 

“Job scams have expanded alongside the shift to online recruitment and remote hiring,” says Kalkura. “Attackers can easily impersonate legitimate companies, create convincing job listings and communicate with candidates through email or messaging platforms. When people are expecting recruitment communication, they may be less likely to question requests for personal information or payments.” 

What are jobs and employment scams? 

Kalkura sums it up like this: “Jobs and employment scams occur when scammers pose as legitimate employers or candidates, recruitment agencies, or well-known companies in order to trick victims into providing money, personal information or banking details.” 

These scams often involve fake job offers or recruitment processes, where applicants may be asked to pay upfront fees for training, background checks or equipment that never materialises. 

In other cases, scammers pose as job candidates, submitting fraudulent applications to obtain sensitive company information, request advance payments, or gain access to internal systems during the hiring process. 

In some cases, employment scams can also take the form of pyramid schemes, where participants are required to pay upfront costs and earn money primarily by recruiting additional participants rather than selling legitimate products or services. 

How scammers are targeting businesses 

BizCover’s deep dive into the ScamWatch data also reveals how cybersecurity threats are increasingly embedded within everyday business tools, from email systems to cloud-based digital platforms.  

Online scams accounted for $130.4 million in total losses, representing the largest share of monetary loss across the analysed scam categories. This was followed by phone-based scams, which generated $70.1 million in losses. Email scams came in at third place and accounted for $54.6 million. 

By comparison, more ‘traditional’ approaches were responsible for much smaller losses. In-person scams totalled $22.2 million, while text message scams accounted for $15.7 million. Mail-based scams were relatively rare, generating $2.3 million in losses. 

This trend is not surprising given that many businesses rely heavily on online platforms, email systems and remote communication tools for daily operations. 

“Digital communication has become central to how most Australian businesses operate nowadays, and scammers are exploiting that,” says Kalkura.  

Kalkura notes that because many scams now arrive through legitimate-looking digital channels, they can be difficult to identify without the right safeguards. 

“Businesses need to focus on strengthening the basic controls that protect digital communication,” he explains. “Measures such as multi-factor authentication, email filtering, and secure payment verification processes can all help to reduce the risk of an attack succeeding.” 

Who is most at risk of scams? 

Understanding who is most affected can provide important insights for businesses and employees looking to reduce their exposure. The analysed data shows notable differences across age groups, gender and geographic regions, highlighting how scam risks and financial impacts vary across the population. And some of the results may surprise you.  

Scam losses rising among younger Australians 

While older Australians still account for the largest total scam losses overall, the fastest growth in losses is occurring among younger age groups. 

Losses among 18- to 24-year-olds surged 87.4% between 2024 and 2025, skyrocketing from $8 million to $15.1 million. This represents the largest year-on-year increase of any age group analysed. 

By contrast, losses among Australians aged 65 and over declined 12.6%, although this group still recorded the highest total losses overall in 2025 at $75.9 million. 

Men account for the majority of scam losses 

The data also shows a notable difference in losses between men and women. 

In 2025, males accounted for $183.2 million in losses, compared with $111.5 million among females across the scam categories analysed. 

While the number of reports involving male victims declined by 18.5%, total losses among men increased 15.9% year-on-year. By comparison, female losses declined 9.9% over the same period. 

On average, male victims lost $2,374 per report, compared with $1,378 for females, indicating greater financial severity per incident among male victims. 

Where scam losses are most severe by state 

The financial impact also varies significantly across Australian states and territories. 

In 2025, Western Australia recorded the highest average loss per scam report at $2,750. This represents a massive 90.4% increase year-on-year. 

Queensland ranked third for loss severity, with an average loss of $1,799 per report. This occurred despite an 18% decline in the number of reports, indicating that individual incidents became significantly more financially damaging, with average losses rising 52.5%. 

In terms of total financial impact, New South Wales recorded the highest overall losses in 2025 at $98 million, followed by Queensland ($57.7 million) and Victoria ($54.5 million). 

Scams reported as occurring outside Australia recorded the highest loss per report overall at $6,578, highlighting the particularly high financial risks associated with cross-border scams and international fraud networks. 

“State-level differences in scam losses can reflect a combination of factors, including population size, business activity and exposure to certain industries,” says Kalkura. “Regions with a higher concentration of businesses, online commerce or international trade may see greater financial losses when scams occur.” 

However, no matter where a business based or what industry it’s in, fraud prevention practices should always be in place.  

The final verdict 

For small businesses, the data demonstrate the ongoing need for proactive risk management on a consistent basis. Scams increasingly exploit the same channels businesses rely on every day – like email, online platforms and digital payment systems. 

“Fraud activity is constantly evolving, and businesses need to evolve their defences as well,” says Kalkura. “AI is changing the playing field in 2026. But at the same time, many scams succeed not because of sophisticated technology, but because they exploit vulnerabilities in everyday business processes.” 

Kalkura says practical steps can help to reduce the likelihood of a successful attack. 

“Simple safeguards can make a major difference,” he explains. “Staff training, using multi-factor authentication, and establishing clear procedures for payments or requests for information can all help lower exposure.” 

As scammers continue to adapt their tactics, these simple steps can help to protect business operations, finances, employees and customers into the future. 

Methodology  

This analysis is based on publicly available data from the Australian Competition and Consumer Commission’s ScamWatch reporting service, comparing scam reports recorded in 2024 and 2025. The analysis focuses on scam categories most likely to present financial or operational risk to Australian small businesses and their employees. This included: phishing, identity theft, hacking, false billing, investment scams, remote access scams, jobs and employment scams, shopping scams, and other online account-related scams.  Consumer-focused scam types such as romance and lottery scams were excluded to maintain a business risk perspective. Report counts, total financial losses and average loss values were calculated using ScamWatch data for the relevant years. All figures reflect reported incidents only and may not represent the full scale of scam activity, as not all scams are reported. Data was analysed and aggregated to identify trends in scam volume, financial severity, contact methods and demographic patterns.