Protecting your strata office from fraud and cyber attack

Strata offices make tempting targets. You hold trust money for every scheme you manage, pay hundreds of suppliers, and trade emails with owners, committees and contractors all day. One changed bank account number on one invoice can be worth tens of thousands of dollars to a criminal.

This article brings together and updates three earlier StrataMax posts on phishing (2020), invoice fraud (2021) and ransomware (2022). The advice has held up. The losses have grown.

The size of the problem

• The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) received more than 84,700 cybercrime reports in 2024–25, an average of one every six minutes.
• For businesses, the average self-reported cost per cybercrime report rose 50% to $80,850: $56,600 for a small business and $97,200 for a medium one.
• Email sat behind the two most common crimes businesses reported: email compromise with no financial loss (19% of reports), and business email compromise fraud that did cost money (15%).
• In 2024, payment redirection was one of the five scam types with the highest combined losses, and bank transfer was the payment method with the highest losses reported to Scamwatch ($141.7 million).

Fake invoices and payment redirection

This is the scam that hurts strata offices most. A criminal gets into a supplier's or a staff member's email account, waits for a real invoice, changes the bank details and sends it on. Because it comes from a genuine address, in the middle of a genuine conversation, it looks right. The payment goes out, and the money moves quickly through a chain of other accounts. Once it has gone, banks can rarely get it back.

A simpler version uses a look-alike email address or a forged invoice from a supplier you already use. And not all invoice fraud comes from outside: staff altering or inventing invoices is more common than most firms expect.

Warning signs

• A supplier says their bank details have changed, especially by email or on a new invoice.
• Urgency, secrecy, or pressure from someone senior to pay now.
• An email address or domain that is almost, but not quite, right.
• An invoice that arrives late in the day or just before a weekend, when it is less likely to be checked.
• Small differences from the supplier's usual invoices: the ABN, the reference, the layout or the amount.

Controls that work

• Never accept a bank detail change by email alone. Call the supplier on a number you already hold or look up yourself, never one given in the email.
• Use two people. Have a second person approve new or changed creditor bank details, and any payment over a set amount.
• Limit who can edit bank details. In StrataMax, creditor bank account and BPAY details are kept in Creditor Maintenance, and access to those fields can be restricted with StrataMax Security. Give that access only to the people who need it.
• Separate duties. The person who enters an invoice should not be the person who approves and pays it.
• Check the original. When an invoice's bank details have changed, StrataMax warns you before you authorise the payment and lets you open the original invoice attached to the transaction. Look at the invoice image itself, not only the details keyed in from it.

Phishing and email compromise

Most fraud starts with a phishing email: a message made to look like it comes from someone you deal with, built to get a password, a payment or a click. Attackers research their targets first. Your website and LinkedIn tell them who approves payments and who that person reports to.

• Turn on multi-factor authentication for email and for every system that holds money or owner data. A stolen password on its own is then not enough.
• Keep work on work accounts. Treat any instruction from a senior person that arrives by text, personal email or a new channel as suspect until you have confirmed it.
• Filter email. Use mail filtering that flags external senders and blocks dangerous links and attachments.
• Train, and make reporting easy. Show staff what phishing looks like, and make it quick and blame-free to report a suspicious email or a click they regret.

Ransomware

Ransomware locks your files and demands payment to unlock them, and attackers often copy data before they lock it. It usually gets in through a phishing email, a stolen password or an unpatched system.

• Back up with the 3-2-1 rule: three copies of your data, on two different types of media, with one kept offsite or offline. Test that you can restore from them.
• Patch promptly: operating systems, applications, routers and printers.
• One person, one account: no shared logins, strong and unique passwords (a password manager helps), and accounts removed the day someone leaves.
• Close the front door: don't expose remote desktop or file servers directly to the internet. Use secure remote access with multi-factor authentication.
• Keep security software current, and watch for new administrator accounts and unusual access.
• Retire old systems. Replacing legacy technology is one of the four actions ASD's ACSC calls critical for organisations.

For a fuller checklist, ASD's Essential Eight sets out eight mitigation strategies, with maturity levels to work towards.

If it happens

1. Call your bank straight away. The sooner a payment is reported, the better the chance of stopping it.
2. Report it to ASD's ACSC through ReportCyber, or call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). Its incident response advice is free, 24 hours a day.
3. Report scams to Scamwatch, so the pattern can be shared and acted on.
4. Lock the account down. Change passwords, turn on multi-factor authentication, and check for email forwarding rules an attacker may have added.
5. Check your privacy obligations. If owner or tenant personal information may have been accessed, see whether the Notifiable Data Breaches scheme applies. IDCARE supports people whose identity details are exposed.
6. Warn the people involved. Tell affected suppliers and committees, so they can watch for follow-up attempts.

How StrataMax looks after its side

StrataMax is ISO 27001 certified and holds a SOC 2 Type 2 report. Multi-factor authentication is enforced for all staff and administrative access, customer data is encrypted at rest and in transit, and it is stored in Australian data centre regions. The detail is on our Security page.

The controls inside your own office matter just as much. If you are not sure how access to bank details and payment approvals is set up in your StrataMax, contact StrataMax support.

Sources: ASD, Annual Cyber Threat Report 2024–25 and its fact sheet for businesses and organisations; National Anti-Scam Centre, Targeting Scams Report 2024 (media release, 11 March 2025).