Scam reports may be down in Australia, but for small business owners, the risk is becoming more expensive when something slips through. That is the main takeaway from BizCover’s analysis of ScamWatch data for 2024 and 2025.
While total reports fell 20.8% from 211,609 to 167,667, total losses still rose 3.4% to $295.4 million. The average loss per report also increased 30.4% to $1,762, suggesting that fewer reports do not mean businesses are better protected.
“For small businesses, this information is highly relevant and important. Lower report volumes do not necessarily mean businesses are safer. Instead, it indicates that when scams succeed, they are causing more financial damage than previous years,” said Akshaye Kalkura, chief information security officer at BizCover.
For business owners, the concern is not just the scale of scam activity but where it is showing up. Many of the biggest risks are now tied to routine business tasks such as checking emails, processing payments, talking to suppliers, and hiring staff.
Phishing remained the most commonly reported scam type in 2025, with 65,361 reports. But even as report numbers dropped 33%, the losses linked to phishing climbed 51.7%. The average loss per phishing report also rose from $209 in 2024 to $476 in 2025.
“Phishing attacks have evolved well beyond the generic spam emails people used to associate with scams. Today’s phishing campaigns are often highly targeted and designed to mimic legitimate communications from suppliers, banks or internal teams. When attackers gain access to credentials or payment systems, the financial impact can escalate quickly for small businesses,” Kalkura said.
That makes phishing more than a general cyber risk. For small businesses, it can disrupt payroll, supplier payments, and access to internal systems, while also exposing customer information if an attack succeeds.
The same pattern appears elsewhere in the data. Investment scams caused the biggest financial damage in 2025, generating $172.2 million in losses across the categories analysed. The average loss per report in that category reached $25,376, far above the overall average.
“High-loss schemes often succeed because they exploit trust and urgency. In an investment scam, for example, scammers will usually try to build up credibility to gain a victim’s trust. Then they will turn up the pressure, making the target act fast, so that they can steal the money before the fraud is realised,” Kalkura said.
For small business operators, that means the threat is not limited to suspicious links or fake invoices. It can also come through financial offers, requests, or opportunities that appear legitimate at first glance.
Hiring is another area where exposure is growing. BizCover found that jobs and employment scams recorded the strongest year-on-year increase in 2025, with reports rising 102.5% and losses increasing 81.5% to $24.9 million. The company linked that rise to wider use of online job platforms, social media, professional networking sites, and remote hiring processes.
“Job scams have expanded alongside the shift to online recruitment and remote hiring. Attackers can easily impersonate legitimate companies, create convincing job listings and communicate with candidates through email or messaging platforms. When people are expecting recruitment communication, they may be less likely to question requests for personal information or payments,” Kalkura said.
That puts recruitment and onboarding alongside payments and email as another part of daily business activity that now needs closer checking.
“Simple safeguards can make a major difference. Staff training, using multi-factor authentication, and establishing clear procedures for payments or requests for information can all help lower exposure,” Kalkura said.
