One invoice. That’s often all it takes. A sole trader gets an email that looks like it’s from a regular supplier, the BSB and account number have changed by a digit or two, and $4,000 lands in a stranger’s account before anyone notices. The Australian Cyber Security Centre hears this story constantly, and small operators, tradies, consultants, photographers, bookkeepers, are disproportionately the ones telling it. Cyber security basics sound like an IT department problem. For a one-person business they’re closer to locking the shop at night. Nobody thinks about it until the one time it mattered.
We’ve spent a fair bit of time this year looking at what actually protects small operators versus what gets spruiked at them by software vendors with a subscription to sell. The gap between the two is bigger than you’d think, and closing it doesn’t cost much.
Why sole traders are a soft target
Criminals running these scams aren’t picking targets one by one. They’re running volume plays, sending the same fake invoice or phishing email to thousands of small ABNs at once, because even a low hit rate pays off when the cost of sending is close to zero. A sole trader with no dedicated IT support, using a personal laptop for both invoicing and online banking, is an easier mark than a company with a security team, not because the sole trader is careless but because nobody’s job is to check.
The Office of the Australian Information Commissioner runs the Notifiable Data Breaches scheme, which tracks breaches large enough to require reporting. Small businesses rarely show up in those figures directly, mostly because a sole trader whose email gets compromised doesn’t meet the reporting threshold and often doesn’t realise there’s a scheme at all. That’s not evidence it isn’t happening to them. It’s evidence the reporting net has a hole in it roughly the size of a one-person operation.
Our take: the risk isn’t that sole traders are targeted more than big firms. It’s that they absorb the hit alone, with no help desk, no cyber insurance policy, and often no spare cash to cover a loss.
Passwords, and the password manager argument
We’ll say the mildly unpopular thing here: most sole traders do not need a $15-a-month password manager subscription, and the industry oversells how essential one is. The core problem a password manager solves, people reusing weak passwords across accounts, can be solved almost as well by the password manager already built into Chrome, Safari, Edge or your phone’s operating system, for free. These built-in tools generate strong unique passwords and sync them across your devices. They’re not perfect, and a dedicated manager has nicer features for sharing credentials with staff, but a sole trader with no employees usually doesn’t need that.
What actually matters more than the tool is the habit: a different password for your business email, your banking, your accounting software and your social accounts, so one leaked password doesn’t become four compromised accounts. Add multi-factor authentication, the second step where a code goes to your phone or an authenticator app, on your email and banking at minimum. The Australian Cyber Security Centre lists this as one of its top mitigation strategies for good reason. It stops the overwhelming majority of account takeovers even when a password does leak.
Verdict: use whatever password manager is already sitting in your browser before you pay for a fancier one.
Email is still the front door
This hasn’t changed much since the early 2000s, when “phishing” first entered the vocabulary as a slightly silly-sounding word for a very old con. Scammers impersonate someone you trust, create urgency, and ask you to click, pay or reply before you think. The costumes have improved. AI tools now let scammers write fluent, typo-free emails that mimic an accountant’s or supplier’s actual tone, which has quietly removed the “bad English” tell a lot of people relied on without realising it.
The practical defence hasn’t changed as much as the threat has. If an invoice email asks you to pay to a new account, ring the supplier on a number you already have on file, not one in the email, and confirm verbally. If a message claims to be from the ATO, your bank or a well-known delivery company and wants you to click a link urgently, go to the organisation’s website directly instead of clicking through. Scamwatch, run by the Australian Competition and Consumer Commission, publishes current scam patterns and is worth a glance every so often, the same way you’d glance at a weather warning.
Set up a separate business email address if you haven’t, away from your personal one. Mixing the two means a breach of an old forum account from 2014 can eventually lead back to the inbox that handles your invoicing.
Software updates, the boring bit that works
Nobody enjoys the “restart to install updates” prompt, and most of us click “remind me tomorrow” on reflex. For a sole trader running the business from a personal laptop, that habit is riskier than it feels, because security patches close specific, known holes that attackers actively scan for.
Windows 10 is the clearest example sitting in front of Australian small business right now. Microsoft ended free support in October 2025, meaning no more free security patches for that operating system. There’s a paid Extended Security Updates programme for consumers that now runs through to October 2027, which buys time, but it’s a bridge, not a destination. If you’re still running a business on Windows 10, budget for an upgrade path over the next year rather than assuming the bridge is permanent. We’ve looked at what’s worth buying when that upgrade comes due in our tablets buyer’s guide, and the same planning logic applies to laptops.
Turn on automatic updates for your operating system, your browser, and your accounting software. It’s unglamorous and it’s also one of the highest-value five minutes you’ll spend on security all year.
Backups, the insurance policy nobody buys
Ransomware doesn’t care how big your business is. It encrypts your files and asks for payment to unlock them, and small operators get hit constantly because, again, volume. The single best defence isn’t an antivirus product, it’s a backup that the ransomware can’t also encrypt.
The practical version of this for a sole trader: keep a backup copy of your invoices, client records and tax documents somewhere that isn’t permanently connected to your main computer. Cloud storage that keeps file version history works, so does a portable drive you plug in weekly and then disconnect. If you’re shopping for the latter, our rundown of external SSDs and portable storage covers what’s currently worth buying at a given budget.
The 3-2-1 rule, three copies of your data, on two different types of storage, with one copy off-site, predates cloud computing but still holds up. It’s one of those rare pieces of tech advice from twenty years ago that nobody’s improved on, just made easier to implement.
Your home network is your business network
Plenty of sole traders run the whole operation over the same Wi-Fi their kids use for gaming and streaming. That’s not inherently reckless, but it does mean your business is only as secure as your router’s default settings, which, if nobody’s ever logged in and changed them, might still be using a weak factory password from the box.
Log into your router at least once, change the default admin password, and check it’s running current firmware, the software that runs the router itself, not just your devices. If you’re due for a network refresh anyway, it’s worth reading up on what newer standards actually offer; our explainer on WiFi 7 in Australia is honest about how much of the hype is genuinely useful for a home-office setup versus marketing noise, and the short answer is less than the marketing suggests for most single-operator businesses.
If you take calls or meetings from cafes, be wary of public Wi-Fi for anything involving banking or client data. A mobile hotspot off your phone plan is safer and, these days, barely slower.
Cyber security basics to sort out this week
If all of this feels like a lot, it doesn’t need to happen at once. A sensible order: turn on multi-factor authentication for email and banking first, since that alone blocks most account takeovers. Then check your operating system and accounting software are set to auto-update. Then sort a backup that isn’t permanently plugged in. Everything else, the password manager, the router firmware, the separate business email, can follow over the next month without anything bad happening in the meantime.
None of this requires buying enterprise software or hiring a consultant, despite what a fair bit of the small-business security marketing implies. It requires about ninety minutes of unglamorous admin, done once, and then revisited every six months or so. If something does go wrong regardless, ReportCyber through the Australian Cyber Security Centre is the place to report it, and it’s worth doing even if you don’t expect to get your money back, because the pattern data helps everyone else’s defences improve too.
We reckon the businesses that get burnt aren’t usually the ones using outdated software, they’re the ones who assumed their size made them invisible. It doesn’t. If anything, it makes you easier.
— Dale Whitfield, Founding Editor, Tech Geek
Featured image: Richard Nowell, CC BY-SA 4.0.
