Taking Payments and Sending Invoices Securely with Microsoft 365
Many small businesses run their day in Microsoft 365: quotes go out by Outlook, client calls happen in Teams and invoices sit in OneDrive. So it is natural to ask whether you can take payments inside those tools too. This article explains what happened with Microsoft’s Teams Payments app, and more importantly, how to take payments and send invoices securely alongside Microsoft 365, because that is where the real risk to your cash flow sits.
What about the Teams Payments app?
In May 2023 Microsoft announced a Payments app for Teams, in public preview, that let small businesses request payment during a Teams meeting through providers such as PayPal and Stripe. It was launched for businesses in the United States and Canada only, and it was not offered to Australian businesses. If you run a business here, it is not something to plan around.
The good news is that you do not need payments inside Teams to get paid quickly. What matters far more is making sure the money ends up in the right account.
The real risk: invoice fraud and email compromise
The biggest payment threat for Australian small businesses is not a missing feature. It is criminals getting into email accounts, or impersonating them, and changing the bank details on invoices. This is known as business email compromise (BEC).
According to ASD’s Annual Cyber Threat Report 2024 to 2025, business email compromise fraud that caused a financial loss made up 15% of cybercrime reports from businesses, second only to email compromise without a loss. The pattern is familiar: a mailbox is hacked, the attacker watches conversations for weeks, then sends a convincing “updated bank details” email just before a large invoice is due.
How to send invoices securely
Send them from your accounting system
Wherever possible, issue invoices from your accounting or invoicing software rather than as a Word or PDF attachment you build by hand. Invoices generated by the system pull bank details from one controlled place, and many systems let customers pay online through a payment link, which reduces the need to type in account numbers at all.
Lock down the mailbox that sends them
- Turn on multi-factor authentication for every Microsoft 365 account, especially accounts used by finance and accounts staff. Our small business guide to MFA walks through it.
- Check for, and alert on, suspicious inbox rules and automatic forwarding to outside addresses. Attackers use these to hide their activity.
- Flag emails that come from outside your organisation so staff notice look-alike addresses.
- Remove accounts of former staff promptly.
Tell customers how you will never contact them
Put a short line on every invoice and in your email signature: “We will never change our bank details by email. If you receive a request to do so, call us on our usual number.” It costs nothing and protects your customers as well as you.
How to pay suppliers securely
Fraud works in both directions. Your business can just as easily be the one that pays a fake invoice. A few simple controls stop most attempts:
- Verify any change of bank details by phone, using a number you already have on file, never the one in the email.
- Use two people for payments above an agreed amount: one to set up, one to approve.
- Limit who can change supplier bank details in your accounting system, and review any changes.
- Be wary of urgency. “The director needs this paid before 3pm” is a classic pressure tactic.
Using Teams and Microsoft 365 safely around payments
Teams is still a great place to talk with clients about work and invoices. Just keep the money itself in the right systems:
- Never share full card numbers or bank logins in Teams chats, emails or shared documents.
- Share invoices as links from your accounting system, rather than editable files.
- Store finance documents in a SharePoint or OneDrive location with access limited to the people who need it.
- Control guest access in Teams, so external people only see the channels meant for them.
If you are not sure how your Microsoft 365 tenant is configured, our Microsoft 365 services page explains how we set up and secure it for small businesses.
If you think a payment has gone to the wrong account
- Call your bank immediately and ask them to try to recall the funds. Minutes matter.
- Report it to ASD through ReportCyber on cyber.gov.au.
- Change passwords on the affected email accounts and check for unknown inbox rules or sign-ins.
- Warn customers or suppliers who may have received fake emails from your address.
Quick checklist
- Invoices come from your accounting system, with a “we never change bank details by email” notice.
- MFA is on for every Microsoft 365 account.
- Bank detail changes are always confirmed by phone.
- Payments above a set amount need two people.
- Staff know what to do, and who to call, if something looks wrong.
For broader protection, our managed IT security service adds 24/7 monitoring of your systems, so unusual sign-ins and mailbox changes are picked up early.
Is your business email set up to stop invoice fraud?
Our free IT Health Check reviews your Microsoft 365 security, including MFA, mailbox rules and sign-in alerts, and shows you where payment fraud could get in.
Or call 1300 133 770.
