How MSPs can protect Australian businesses from payment diversion fraud

Payment diversion fraud is a rapidly growing and potentially expensive threat to Australian businesses. Attacks exploit weaknesses in payment verification processes to trick organisations into transferring funds to criminal-controlled accounts.

According to Australia's National Anti-Scam Centre, Australians lost A$166.8 million to payment redirection scams in 2025, up nearly 10% compared to 2024. With Australian businesses struggling to deal with the threat of payment diversion fraud, managed service providers (MSPs) have an opportunity to expand services and drive revenue by offering protection against attacks.

In payment diversion fraud, attackers impersonate a trusted supplier, executive, employee or business partner to redirect legitimate payments into fraudulent bank accounts.

The attack usually begins with a compromised email account. Cybercriminals gain access to a user's mailbox through phishing, credential theft or malware. They then monitor communications and wait for an opportunity to intervene in financial transactions.

Common payment diversion fraud scenarios include attackers:

• Impersonating suppliers and requesting updated banking details.

• Intercepting invoice communications and changing payment instructions.

• Posing as executives and requesting urgent wire transfers.

• Inserting themselves into ongoing financial conversations.

Unlike ransomware or malware attacks, payment diversion fraud often leaves little traceable evidence. The payment appears legitimate, so an organisation might not know it has been hit until days or weeks later when the real supplier follows up on an unpaid invoice.

Several critical factors are contributing to the growth of payment diversion fraud:

Greater reliance on email-based business processes: Many organisations continue to manage invoices, payment approvals and supplier communications in vulnerable email systems.

Trust in collaboration platforms: Attackers are increasingly targeting collaboration platforms such as Microsoft Teams because users often blindly trust messages on those platforms.

Use of artificial intelligence to create sophisticated attacks: Threat actors are leveraging AI-generated content to create more convincing impersonation emails.

Complex supplier ecosystems: Verifying payment requests becomes increasingly difficult as organisations work with more suppliers, contractors and partners.

Most small and midsize enterprises (SMEs) do not have dedicated security teams capable of defending against sophisticated email compromise attacks. MSPs fill the security gap by providing expertise, monitoring and protection without requiring clients to build internal security operations.

MSPs can help businesses reduce payment diversion risk through several critical services:

Advanced email security

Email remains the primary attack vector for payment diversion fraud. MSPs can deploy security controls that identify phishing attempts, spoofed domains and suspicious communications before they reach users.

Protection for collaboration platforms

Advanced attacks in collaboration tools jumped from 12% of all attacks in 2024 to 31% in 2025, according to the Acronis Cyberthreats Report H2 2025. MSPs can offer protection for platforms such as Microsoft Teams, which are becoming a growing threat vector and an alternative to email for attackers.

Endpoint protection

Compromised devices often serve as the entry point for credential theft and account takeover attacks. Endpoint security helps prevent attackers from gaining the foothold they need to access sensitive communications.

Security awareness training

Employees remain one of the most targeted elements in payment diversion attacks. Regular training helps users recognise suspicious requests, verify payment changes and follow secure financial procedures.

Vulnerability and patch management

Many compromises begin with unpatched software vulnerabilities. MSPs can reduce risk by maintaining secure and up-to-date environments.

Incident response and recovery

When attacks occur, MSPs can quickly investigate compromised accounts, contain threats and help organisations recover operations while minimizing financial and reputational damage.

Payment diversion fraud creates a compelling business opportunity for MSPs because it involves a highly visible risk with clear financial consequences. MSPs can package protection against payment diversion fraud into broader managed security offerings that include:

• Email security

• Endpoint protection

• Extended detection and response (XDR)

• Managed detection and response (MDR)

• Security awareness training

• Vulnerability management

• Backup and disaster recovery

• Compliance and risk assessments

The approach delivers several business benefits:

Increased recurring revenue

Security services typically generate predictable monthly recurring revenue and often command higher margins than traditional IT support services.

Stronger client retention

When MSPs integrate cybersecurity into daily business operations, clients are more likely to maintain long-term relationships with their service providers.

Greater differentiation

Cybersecurity expertise allows MSPs to stand out in a crowded market and compete on value rather than price alone.

Expanded client relationships

Security conversations often open the door to additional services such as compliance, governance, business continuity and risk management.

Acronis Cyber Platform provides MSPs with natively integrated cybersecurity, endpoint management and data protection within a single platform. The integrated approach helps reduce tool sprawl, simplify operations and address multiple attack vectors commonly associated with payment diversion fraud.

Endpoint protection and EDR

Acronis delivers AI-based endpoint protection, endpoint detection and response (EDR) and extended detection and response (XDR) capabilities that help detect and stop malicious activity before attackers can compromise accounts or access sensitive communications.

Managed detection and response

For organisations that require around-the-clock monitoring, Acronis managed detection and response (MDR) services help identify suspicious behaviour and respond to threats before they escalate into financial fraud incidents.

Vulnerability assessment and patch management

Acronis reduces the attack surface that cybercriminals can exploit by enabling MSPs to identify vulnerabilities and automate patch deployment.

Centralized security management

Acronis provides a single console for managing cybersecurity, endpoint management and data protection services, so MSPs can improve operational efficiency and maintain visibility across client environments.

Backup and recovery

If a payment diversion attack is part of a broader cyber incident involving ransomware or data loss, Acronis backup and recovery capabilities help organisations restore business operations quickly and securely.

Many MSPs rely on multiple disconnected tools for cybersecurity, endpoint management and backup. That approach often creates tool sprawl, which leads to operational inefficiencies and visibility gaps.

The natively integrated Acronis Cyber Platform addresses those challenges by bringing essential cyber protection capabilities together within a single solution.

Key benefits include:

• One platform for cybersecurity, endpoint management and data protection.

• One agent instead of multiple endpoint tools.

• One console for simplified administration.

• Reduced operational complexity.

• Improved technician productivity.

• Faster onboarding and service delivery.

• Better visibility across client environments.

• Lower management overhead.

• Improved service profitability.

For MSPs, integration reduces tool sprawl while enabling more efficient service delivery. For clients, it provides stronger protection through a unified approach to cyber resilience.

Payment diversion fraud continues to pose a significant financial threat to Australian businesses. As cybercriminals leverage increasingly sophisticated business email compromise techniques, organisations need more than traditional email security to stay protected.

MSPs are uniquely positioned to help businesses defend against attacks through a combination of cybersecurity, endpoint protection, security awareness training and incident response services.

With Acronis Cyber Platform, MSPs can deliver comprehensive protection through a natively integrated solution that simplifies operations and improves efficiency.  And by helping clients reduce fraud risk, MSPs can create new revenue opportunities and build stronger long-term client relationships.