Skip to main content

SME fraud – The Smart Play Against Scams

Over €17 million lost by SMEs through email-related scams in the last two years, as FraudSMART launches new awareness campaign

FraudSMART has partnered with the Irish SME Association (ISME) to launch a new SME fraud awareness campaign, spearheaded by business owner and former Irish rugby international Tommy Bowe to urge SMEs to be on the alert and put measures in place to protect their business. As part of the campaign, FraudSMART is spotlighting the latest scams being targeted at businesses and offering practical fraud prevention tips through events, media appearances and a series of short videos being released on social media in the coming weeks.

How are SMEs targeted by fraudsters?

Most businesses would like to think that they are protected against fraud but SMEs can be particularly vulnerable compared to larger companies due to more limited resources, less investment in security infrastructure as well as lower financial buffers to withstand any losses. Fraudsters take advantage of busy work schedules and create a sense of urgency in the hope that an employee will react without thinking and won’t take the time to do necessary checks.

Tommy Bowe, Niamh Davenport, Neil McDonnell, CEO of ISME

“According to a recent survey we conducted with ISME, more than two-thirds (68%) of SMEs have been targeted with scams within the past twelve months and 89% of these businesses report being targeted through email. However, while the vast majority of businesses have some security measures in place, such as verification processes for new bank account details (94%), almost a third (31%) of businesses do not have specific fraud awareness guidelines and training programmes for employees.”

Fraud Prevention Guide for Businesses

FraudSMART has a free fraud prevention guide for businesses outlining the common types of financial fraud affecting Irish SMEs and providing advice on how to avoid them. Download here.

Irish small and medium enterprises (SMEs) lost over €17 million (€17.4m) in the last two years through email-related scams, according to recent figures shared by FraudSMART members and invoice redirection and CEO impersonation scams remain the top threats to businesses with average losses of €11,500.

According to a survey FraudSMART conducted with ISME in March 2025, more than two-thirds (68%) of SMEs have been targeted with scams within the past twelve months and 89% of these businesses report being targeted through email.

The two most common types of fraud targeted at businesses are:

Invoice re-direction fraud

These often start with what appears to be a legitimate email from a supplier known to the business advising of new bank details for payment, but which has been hacked or closely copied by fraudsters. This can create a false sense of security and make it difficult for businesses to detect. They usually don’t request any payment upfront but ask for the bank account details on file to be changed for future invoice payments and provide a new IBAN and BIC code for the ‘new account’. When a legitimate invoice is issued by the supplier the business ends up paying it into the ‘new account’ controlled by the fraudster and it’s often only some time later when a payment reminder is sent by the supplier that the scam is detected.

CEO impersonation fraud

CEO impersonation fraud is where a fraudster impersonates a company’s senior executive in order to convince an employee to disclose sensitive information or make an unauthorised financial transaction.

“These findings emphasise just how exposed SMEs are to financial fraud. This is not a marginal issue – it’s a major business risk. Employees in particular are often the ones targeted by fraudsters and therefore have a key role to play at the frontline of fraud prevention. I urge all SMEs to put training in place to ensure their workforce, at every level of the business, are constantly aware of current fraud risks and how to avoid falling victim to scammers.”

Tommy Bowe, Niamh Davenport, Neil McDonnell, CEO of ISME

FraudSMART tips to protect your business

  1. Policies and procedures: Ensure a verification process is in place for requests to change supplier bank account details.
  2. Dual authorisation: Ensure that two people from the business are required to complete a third-party payment electronically.
  3. Fraud awareness and training: Ensure staff are given appropriate training on cyber security.
  4. Invoice checking: Review invoices thoroughly and ensure there are no irregularities.
  5. Updated operating systems: Ensure that the latest updates for your computer and mobile operating systems are up-to-date.
  6. Think before you post: Avoid sharing too much personal information on social media.

What to Do If You’ve Been Targeted:

If you think you have fallen victim to a scam, contact your bank immediately using the number on the back of your card, or the contact details provided on your bank website and contact An Garda Síochána. Reporting suspicious activity helps prevent further fraud and protects others from falling victim.

For more information and practical advice on how to protect yourself from different types of scams,
visit our Fraud & Scams page.