Small and medium-sized businesses across Ireland have lost almost €19 million to email‑based scams in just two years, with the average business hit for €22,000. It’s a staggering figure for any company, but for an SME, a loss like that can be genuinely destabilising.

New data from the Banking and Payments Federation Ireland (BPFI) shows how widespread the problem has become. Two‑thirds of SMEs were targeted by a scam in the past 12 months, yet more than half have no fraud awareness training or guidelines in place. That gap between risk and readiness is exactly what fraudsters are exploiting.

Scams Are Becoming More Sophisticated

Niamh Davenport, head of financial crime at the BPFI, told Newstalk that the nature of scams has changed dramatically. The days of spotting a dodgy email by a typo or strange formatting are long gone. Today’s attacks are polished, convincing, and often tailored to the business they’re targeting.

Some scams are deceptively simple, she noted, and that’s what makes them so effective. When a message looks legitimate and arrives at a busy moment, it’s easy to miss the subtle red flags.

The Biggest Threats: Invoice Redirection and CEO Fraud

Two types of scams continue to dominate:

  • Invoice redirection, where criminals trick businesses into paying invoices to fraudulent bank accounts.
  • CEO impersonation, where scammers pose as senior executives to pressure staff into urgent payments or sharing sensitive information.

Both rely on social engineering rather than technical hacking, which means awareness and training are the strongest lines of defence.

Government Response: Fraud SMART SME

The release of these figures coincides with the Government’s launch of Fraud SMART SME, a new initiative aimed at helping businesses strengthen their fraud prevention practices. The goal is to close the awareness gap and give SMEs practical tools to protect themselves.

Davenport highlighted the urgency: despite fraud being in the news almost daily, 53% of SMEs surveyed still have no formal fraud training. With losses averaging €22,000 per incident, the cost of inaction is simply too high.