A Perth tourism business owner who lost $80,000 to an elaborate email scam in 2024 has been targeted by what appears to be an identical fraud, this time while he was in the middle of recounting the original ordeal to journalists.
Meng Wong, 63, has operated his tourism company, Blue Travel, since 1992. The first attack cost him a substantial client payment and nearly destroyed a long-standing business relationship. Now, scammers appear to have come back for a second attempt.
How the original $80,000 email scam unfolded
In April 2024, Wong was coordinating a $100,000 tour package for a Taiwanese travel agency that had organised a group of 20 tourists to visit Western Australia. The agency paid an initial deposit of $20,000 and was due to transfer the remaining $80,000 before the group arrived.
When the final payment did not appear in his account, Wong followed up with his client, only to be told the transfer had already been made. Examining the transaction details, he discovered the funds had gone to a bank account that had nothing to do with Blue Travel.
Reviewing their email correspondence, both parties pieced together what had happened. Fraudsters had registered two domain names closely resembling those used by Wong and the Taiwanese agency. Without either business realising it, all communication had been rerouted through these fake addresses.
The scammers, impersonating Wong, had contacted the Taiwanese agency and explained that Blue Travel had opened a new bank account due to changes in government policy. Trusting the instruction, the agency transferred the $80,000 to the fraudulent account. The money was never recovered.
"When we looked back at our emails, we saw that someone was able to intercept our emails and register another two domain names, which were very similar to our respective company's domain names," Wong said. "And we were communicating using the new domain names that we didn't know about."
The fallout extended beyond the financial loss. The Taiwanese agency initially questioned whether Wong himself had orchestrated the fraud. "So when I'm losing money here I'm panicking and yet my customer thinks that I'm conning them," he said. To salvage the tour, the agency agreed to pay local suppliers directly while Wong absorbed costs and forfeited his profit margin.
Second attack strikes while Wong was telling his story
This week, Wong was speaking about the 2024 incident when a Hong Kong client alerted him to a suspicious email that appeared to have come from his own business address, which uses the domain blueco.com.au. Wong had never sent the message.
The email instructed the client to place an immediate hold on all incoming payments linked to a previously issued invoice. It claimed Blue Travel's existing bank account was no longer active and asked the recipient to delete the account details from their records. It also requested a contact number, stating that someone from the accounts team would call to confirm new banking information.
Critically, several email addresses copied into the message used a slightly different domain, blueco-au.com, a near-identical variation designed to go unnoticed. The tactic mirrored exactly what had been done in the 2024 attack.
What small business owners should watch for
The scam targeting Blue Travel is known broadly as a business email compromise, where fraudsters intercept or replicate business communications to divert payments. The method is particularly effective because both parties believe they are dealing with a trusted contact throughout the process.
For small business owners already navigating significant financial pressures, a single diverted payment of this scale can cause serious damage. Key warning signs include unexpected requests to change bank account details, emails urging urgency around payment holds, and domain names that differ from a known contact's address by even a single character or punctuation mark.
Experts consistently advise businesses to verify any change to payment details by calling a known phone number directly rather than relying on contact information provided within a suspicious email.
