Spotting online business loan scams before they cost you

Online lending has made finance faster for genuine businesses — and it’s made impersonation easier for criminals. Scammers copy lender websites, send approval emails that look official, and phone business owners at their most stressed moment, when a quick yes feels like a lifeline. The good news is that most loan scams follow a handful of patterns. Once you know them, they’re surprisingly easy to spot.

What are the most common business loan scams?

Scam	How it works	The giveaway
Upfront fee scam	You’re told you’re approved, but must pay an “insurance”, “legal” or “release” fee first	Real lenders don’t ask you to transfer money before funds are paid
Credential theft	A caller or link asks for your banking password or a one-time code to “verify” your account	No legitimate lender needs these
Cloned lender	A website or email copies a real lender’s branding with a slightly different address	Check the URL, ABN and phone number independently
Payment redirection	An email says a lender’s or supplier’s bank details have changed	Confirm changes by phone on a known number
Fake guarantee	You’re “guaranteed approval regardless of credit” for a fee	Nobody can guarantee approval before assessing you
ID harvesting	A form asks for full ID and statements before telling you who it is	Legitimate lenders identify themselves first

Scamwatch, run by the National Anti-Scam Centre within the ACCC, collects scam reports so it can warn others and take action. It’s worth checking for current alerts if something feels unusual.

How do you check that a lender is genuine?

1. Look up the ABN on the free ABN Lookup at abr.business.gov.au. It shows whether an ABN is active or cancelled and the entity behind it.
2. Check the web address character by character. Scam sites often add a word, swap a letter or use a different domain ending.
3. Find the phone number yourself, from the lender’s own site that you typed in, and call it. Don’t use numbers from an unexpected email or SMS.
4. Ask questions. A real lender will explain who it is, what the product costs and what happens next. Pressure and secrecy are red flags.
5. Read before you sign. Real loan documents set out fees, repayments and obligations in detail.

Why are passwords and one-time codes off-limits?

Your banking password and the one-time codes your bank sends are the keys to moving money. Legitimate lenders get bank data through read-only connections you approve with your bank, or through statements you download yourself — see open banking and CDR. If anyone asks you to read out a code, enter your password into a link they sent, or install remote-access software “to help with the application”, stop immediately.

How does payment redirection catch businesses out?

This one targets established businesses rather than applicants. A scammer gains access to an email account — yours, a supplier’s or a lender’s — or creates a look-alike address, then sends a convincing message saying bank details have changed. The next payment goes to the scammer.

Protect yourself by:

• confirming any change of bank details by phone, using a number you already have
• turning on multi-factor authentication for business email
• being suspicious of urgency around a change in payment details
• checking the sender’s full email address, not just the display name

The Australian Signals Directorate’s cyber.gov.au has guidance on recovering from business email compromise and reporting it.

What’s changing in scam protection?

The ACCC describes the Scams Prevention Framework as placing obligations on banks, telcos and digital platforms to act against scams at every stage, from prevention and detection through to disruption, reporting and response, with most obligations commencing on 31 March 2027. It’s a step towards more protection across the system, but it doesn’t replace your own checks. The habits on this page remain your first line of defence.

What should you do if you think you’ve been scammed?

1. Contact your bank immediately if you’ve sent money or shared banking details. Speed matters.
2. Change passwords and turn on multi-factor authentication for banking, email and accounting software.
3. Report the scam to Scamwatch, and report cybercrime such as email compromise through cyber.gov.au.
4. Check your credit reports for enquiries or accounts you don’t recognise.
5. Warn your team and suppliers if your email may have been used to send scam messages.

How does eBusiness Loans keep things clear?

We’ll always tell you who we are and how to reach us. Our online enquiry is free, involves no credit check, and never asks for banking passwords or one-time codes. If someone claiming to be us asks for an upfront fee or your login details, don’t respond — call us on 03 8692 5559 instead. You can read more about how we handle information in data security and privacy and how identity checks work in online ID verification.

What does a legitimate first contact look like?

A genuine lender or finance specialist introduces themselves by name, tells you the business they work for, explains why they’re calling — usually because you enquired — and is comfortable with you hanging up and calling back on the published number. They talk about your needs before asking for documents, and they never ask you to pay anything to proceed.

Ready to apply through a process you can verify?

The safest application is one where every step makes sense. Start a 60-second enquiry with eBusiness Loans: no credit check to enquire, no spraying your details around a list of lenders, and a real specialist who calls you, explains the process and answers questions before anything is shared. Please fill in the form accurately so we can match you with the right lender the first time — and if anything ever feels wrong, call us to check.