Source : Perth Now news
A Perth business owner was talking about how an $80,000 payment was stolen by scammers two years ago when the unthinkable happened — his business was targeted again.
Meng Wong, 63, has been running his tourism business since 1992, but in April 2024, he became caught up in an elaborate email scam that saw a payment from an overseas client diverted into a fraudster’s bank account.
The client, a Taiwanese travel agency, had arranged for a group of 20 tourists to visit Western Australia, with Wong responsible for organising a $100,000 tour package.
The agency paid a $20,000 deposit and was due to transfer the remaining $80,000 ahead of the group’s arrival.
But when the money failed to arrive, Wong chased up the payment, only to be told it had already been made.
A closer look at the bank transfer details revealed the money had been sent to an account that did not belong to his company, Blue Travel.
“When we looked back at our emails, we saw that someone was able to intercept our emails and register another two domain names, which were very similar to our respective company’s domain names,” Wong told 7NEWS.com.au.
“And we were communicating using the new domain names that we didn’t know about.”
The scammers had created email addresses closely resembling those of both businesses, allowing them to impersonate Wong and his Taiwanese client.
The Taiwanese agency was told Blue Travel had opened a new bank account due to changes in government policy and was instructed to transfer the outstanding payment there instead.
Believing the request was genuine, the agency transferred the $80,000.
Meanwhile, Wong was receiving emails appearing to come from his client, unaware that someone was impersonating the business.
Neither party realised they had been communicating through fraudulent email addresses until the money went missing.
The money was never recovered, Wong said.
The scam also damaged the relationship between the two businesses, with the Taiwanese client questioning whether Wong himself was involved.
“So when I’m losing money here I’m panicking and yet my customer thinks that I’m conning them,” Wong said.
With the tourists’ arrival approaching, Wong had to find a way to ensure the trip could still go ahead.
The Taiwanese agency agreed to pay local suppliers directly, while Wong gave up his profit margin and covered some additional costs.
A nightmare returns
Wong was recounting the ordeal to 7NEWS.com.au on Monday, thinking the scam was well behind him, when he suddenly saw another email appearing to come from himself — one he had never sent.
A Hong Kong client had alerted him to the suspicious email, which instructed them to stop making payments to his existing bank account.
The email appeared to come from Wong’s legitimate business address, which uses the domain name blueco.com.au.
But several addresses copied into the email used a slightly different domain — blueco-au.com — resembling the tactic used in the 2024 scam.
“We kindly request that you place an immediate hold on all incoming payments relating to our previously issued invoice,” the email read.
“We will provide a revised invoice reflecting our updated information as soon as possible.”
The email claimed the company’s previous bank account was no longer in use and asked the client to remove its details from their records.
It also requested a contact number, saying someone from the accounts team would call to verify the new banking details.
“Could you please confirm the best contact number to reach you on? A member of our Accounting team will be in touch to arrange verbal confirmation of our updated bank account details as part of our verification process,” it read.
But Wong had never sent the email, and his bank details had not changed.
Luckily, the Hong Kong client contacted Wong directly to verify the request before making any payment.
It would have been a $200,000 payment.
The 63-year-old said he was now working with his IT specialist to secure his email account, more than two years after the original scam.
While it remains unclear whether the same scammers were behind both incidents, Wong said the latest attempt showed how difficult it was for small business owners to protect themselves.
Wong said the experience highlighted how difficult it was for small business owners to protect themselves from increasingly sophisticated scams.
He now urges clients to confirm payment details directly rather than relying solely on emails.
But he believes banks should also do more to prevent fraudulent transfers, particularly when the recipient’s name does not match the account receiving the money.
Wong has called for stronger safeguards and greater accountability from financial institutions, warning that scams can damage confidence in Australian businesses as well as cause financial losses.
Wong said small business owners like him had little choice but to stay alert.
“When you’re in a jungle, it’s either you learn to survive or you sit there feeling sorry for yourself,” he said.
Small businesses at risk
Wong’s experience comes as research from business insurance comparison platform BizCover highlights the prevalence of cyber threats targeting Australian small businesses.
A survey of 545 insured Australian small business owners found 43 per cent had encountered at least one potential cyber threat between June 2025 and 2026.
BizCover general manager Brad Miller said many small business owners mistakenly believed they were too small to attract cybercriminals.
“It’s definitely a case that no one is too small,” Miller told 7NEWS.com.au.
“Small businesses are definitely, definitely a target and we need to change the perception.”
Miller said some business owners assumed they had no valuable information to steal, overlooking the fact that criminals could exploit customer data or use it to demand a ransom.
“Ultimately the criminals don’t need to go for big targets,” Miller said.
“They need to go for the most vulnerable target.”
Miller warned that scammers could impersonate trusted suppliers and send convincing emails requesting payments to different bank accounts.
Even familiar-looking invoices should raise suspicion if payment instructions suddenly change, he said.
He urged businesses to independently verify any changes to bank details by calling suppliers on a trusted phone number.
“You don’t click any links, you don’t change bank accounts until you’ve spoken to a contact that you trust at that company,” Miller said.
He also recommended businesses establish clear payment procedures and tell customers to verify any requests to change banking details.
Multi-factor authentication and strong passwords were other important safeguards.
Miller said small businesses could also consider cyber insurance as an additional layer of protection, although coverage varies between policies and may not cover every loss caused by a scam.
