Real lender call or a scam? How to tell, especially late at night

When you’re worried about money, a phone call offering a solution can feel like a lifeline. That’s exactly what scammers count on. They know business owners search for finance late at night, under pressure, and they know that a tired, stressed person is more likely to skip a check. The good news is that a handful of simple rules catch almost every scam — and a genuine lender will never mind you using them.

What does a genuine first call about a business loan sound like?

It should feel like a conversation about your business. A real lending specialist will usually:

• Refer to the enquiry you made, including roughly when and what you asked about.
• Tell you who they are and which business they’re with.
• Ask about your situation: the amount, the purpose, how long you’ve been trading, turnover, property, existing debts and how you plan to repay.
• Explain options and next steps, and what documents would be needed if you choose to go ahead.
• Give you time to think, talk to your accountant or a co-owner, and call back.

What they won’t do is ask for your internet banking password, a one-time security code, or remote access to your computer. Our page on the morning call describes what a genuine first conversation covers in more detail.

What are the red flags?

Scams come in many forms, but they share a few features. Watch for:

Red flag	Why it matters
Asking for internet banking passwords or one-time codes	No legitimate lender needs these; they give access to your money
“Guaranteed approval” regardless of credit or circumstances	Real lenders assess every application
A fee to “release” or “secure” approval before any documents	A classic advance-fee pattern
Payment to a personal account, by gift card or crypto	Legitimate businesses don’t take payment this way
Pressure to act tonight, or the offer disappears	Urgency stops you checking
A text or email with a link to “complete your application”	Links can lead to fake login pages
“Our bank details have changed”	A common way to redirect payments
A call about a loan you never enquired about	Your details may have been sold or spoofed

One red flag on its own isn’t proof of a scam. Two or more together are a strong signal to stop.

How do you check who you’re dealing with?

The simplest rule comes from Scamwatch: check that the person “works for the organisation they say they do, using contact details you find yourself” (Scamwatch). Scamwatch notes that criminals impersonate legitimate investment and finance companies, so a familiar name on its own proves nothing.

In practice:

1. Hang up politely. “Thanks, I’ll call you back.”
2. Find the business’s contact details yourself — from its website, a previous email you know is genuine, or a public register — not from the call, text or email.
3. Call that number and ask to be put through to the person, or confirm they contacted you.
4. Check the business on public registers if you’re unfamiliar with it. ASIC’s registers let you search companies and business names.

Scamwatch’s short version is “Stop. Check. Protect.” — and its advice to “always stop and check before you act” (Scamwatch) is worth repeating to yourself at 11pm.

Prefer to deal with one team you chose? Send your enquiry here — your details go to one team, and there’s no credit check when you first enquire.

Why are after-hours enquiries a target?

Three reasons. First, stress: someone searching for business finance at midnight is often worried and keen for a fast answer. Second, isolation: there’s nobody to ask — no accountant, no business partner, no bank branch. Third, timing: a scammer who calls at 8am, before you’ve had a chance to speak with anyone, can present themselves as the answer to the enquiry you sent last night.

That’s also why the “spray and pray” model is a problem. When an enquiry is sold to many lenders, you can’t tell which of the calls that follow are from businesses you’d actually want to deal with — and a scammer’s call blends right in. When your enquiry goes to one team, an unexpected call from someone else is an immediate warning sign.

What about PayTo requests and payment holds?

Two newer payment features are worth knowing about:

• PayTo lets a business collect payments from your account under an agreement you authorise in your online banking. Australian Payments Plus advises: “Only authorise agreements you recognise and expect” and “check the business name matches who you intend to pay”. If a PayTo request appears after an unexpected phone call, don’t authorise it. See our PayTo page.
• Payment holds. Banks may hold some fast payments for security checks, especially large first payments to new payees. It’s frustrating when you’re in a hurry, but it’s often exactly what stops a scam. Our page on payment holds explains more.

What should you do if you’ve already shared details or paid?

Act quickly, even if it’s late:

1. Call your bank straight away, using the fraud or lost-card number on your card or the bank’s official website. Don’t wait for business hours to try.
2. Change passwords for internet banking, email and accounting software, starting with any you shared.
3. Report it to Scamwatch.
4. Warn your team and bookkeeper, particularly if the scammer has business details and might try again.
5. Keep records — call times, numbers, messages and any payment references.

The business.gov.au cyber security pages have more on protecting your business systems and responding to an incident.

What if the caller knows a lot about you?

That’s unsettling, but it isn’t proof they’re genuine. A lot of business information is public: your ABN and business name on ABN Lookup, company details on ASIC’s registers, your address and phone number on your own website. Some scammers also use details from data breaches or from an enquiry that was sold on.

So judge the call by what it asks you to do, not what the caller already knows. A request for codes, passwords, remote access or an urgent payment is the tell, however convincing the rest sounds. And if you ever feel rushed, that feeling is a good reason to stop.

How can you protect the business going forward?

A few habits make you a much harder target:

• Have a callback rule. Anyone asking for money or account changes gets a call back on a known number, every time.
• Use two-person approval for large or new payees, where your bank allows it.
• Set sensible payment limits on business accounts.
• Keep supplier bank details on file and treat any “change” request as suspicious until confirmed by phone.
• Tell staff that no genuine lender, bank or government agency will ask for passwords or codes.

Illustrative example: two calls on the same morning

Illustrative example only; no real people or businesses are described.

A bakery owner in Sydney sends an enquiry at 11pm on a Tuesday. At 7.45am the next day, she gets a call from someone claiming to be “your loan team”, saying she’s approved and needs to pay a processing fee by bank transfer to “lock in” the funds before 9am. The account name is a person, not a business. She hangs up.

At 9.30am, a specialist from the business she enquired with calls, refers to her enquiry and the amount, and asks about her trading and repayment plan. No fees, no codes, no deadline. To be sure, she ends the call, finds the number on the website she’d used, and calls back. It’s genuine. She reports the first call to Scamwatch.

Deal with people you chose, on your terms

Scams thrive on urgency and confusion. The antidote is simple: slow down, check independently, and deal with a team you chose rather than one that found you.

If you’d like to see what’s genuinely possible for your business, the enquiry is roughly a minute’s work and no credit check is run at the enquiry stage. Your details go to one team — not out to a crowd of lenders — and a real person reads your situation and calls you, happy for you to call back to check. Please fill the form in accurately, so the first call is about real options. See if you qualify.