Four tips to protect your business from cybercriminals

Natasha Gardner • October 23, 2025


In this increasingly digital age, small businesses are becoming more and more vulnerable to the threat of cybercrime. In particular, there has been an increase in supply chain attacks targeting small businesses. Cybercriminals are constantly adapting their tactics and using AI to fuel their attacks. As technology advances, so does the risk to your sensitive data.


This increasing risk means it’s more important than ever to get the basics right. The good news is, AI still can’t beat smart cyber habits. October is Cyber Security Awareness Month, so we’re here to equip you with four essential tips to safeguard your business against cybercrime.


1. Strengthen your first line of defence

Humans can often be the weak spot in a business’s cybersecurity efforts, so it’s important to have a strong first line of defence in your systems to protect your business.


It doesn’t have to be super complex or expensive – the easiest and most effective solutions are free or low-cost. 


To start with, get your security basics sorted:


  • Passwords: Strong passwords are the foundation of your online security. Use long, unique passwords for each account, and consider using a password manager to keep track of them.
  • Multi-factor authentication (MFA): MFA adds an extra layer of protection by requiring additional verification, such as a code sent to your phone, when logging in.
  • Secure products and services: Choose reputable providers that prioritise security. Look for certifications like ISO and SOC2 compliance when selecting software and services.
  • Use public wifi safely: While the most secure option is to use wi-fi at your home or office, there are a few things to keep in mind if that’s not an option:
  • Use your personal mobile phone as a hotspot – it’s significantly safer than café, hotel, or airport networks.
  • Connect to a trusted VPN first, if available.
  • Verify any wi-fi network with the venue before continuing – fake hotspots are a common scam to capture credentials.
  • Don’t access confidential or sensitive information over public wi‑fi.
  • Avoid oversharing personal information online: Attackers harvest publicly available details to tailor convincing phishing and social engineering attacks (email, SMS, voice, and social apps). Even small personal facts (roles, travel, family, habits) help them impersonate people you trust or bypass checks.


2. Educate your team about phishing

One way cybercriminals can exploit small businesses is through phishing scams, in which cybercriminals impersonate trusted individuals or organisations to trick them into revealing sensitive information through deceptive emails or text messages.


A phishing email looks like it comes from a legitimate source, but fraudulently tries to get you to provide sensitive information, such as your password or credit card details. Some of these emails might also try to infect your device by getting you to click a link to a malicious website or attachment.

However, even the most advanced phishing is still toothless if you know enough to pause, think critically about the message, and react appropriately if something doesn’t seem right.


With this in mind, it’s important to educate your team about phishing and train them to:


  • Adopt a zero trust approach: Your team motto where data is concerned should be ‘never trust, always verify’. Bake security into your processes, for example, a payment can’t be processed without specific verification steps (even if it appears to be the CEO asking you to process it!)
  • Identify phishing attempts: Teach your employees how to spot phishing emails by being on the lookout for suspicious links, urgent requests, or grammatical errors.
  • Avoid suspicious links and attachments: Encourage your employees to hover over links before clicking, and to avoid downloading attachments from unknown senders.


3. Learn how to spot a deepfake

Conventional scams are difficult enough to spot, but AI-based scams can be harder to detect and so even more dangerous. Deepfakes allow cybercriminals to create seemingly legitimate audio and video that can be incredibly convincing. Voice cloning replicates somebody’s tone and language to trick someone else into having a genuine phone conversation. 


Cybercriminals can use deepfakes to impersonate executives, clients, or even government officials. Train your team to look for signs of deepfakes, such as:

  • inconsistent eye blinking or pupil dilation
  • artificial-looking noise or distortions
  • poor lip-syncing
  • blurred or irregular shadows


4. Stay informed and vigilant, and report suspicious activity

Cyber threats are constantly evolving, so it’s crucial to stay informed about the latest scams and security best practices. Regularly update your software and apps, apply security patches, and consider subscribing to cybersecurity newsletters or blogs.


Finally, ensure you and your team report any suspicious activity. Work to create a culture where employees feel comfortable reporting anything unusual, even if it turns out to be harmless.


So, what should you do if the worst happens and your business gets attacked or compromised?


First of all, and most importantly – don’t panic. But do act quickly. Don’t be afraid to speak up – the cyber criminal wants you to be too embarrassed to tell anyone. Report the attack to your local Computer Emergency Response Team (CERT) agency or national cybersecurity agency, and if there’s an immediate threat to life or risk of harm, call the police. 


Cybersecurity is everyone’s responsibility. By following these tips and staying vigilant, you can significantly reduce your risk of falling victim to cybercrime.

More GTP Articles

By Jess Sluggett June 10, 2026
From 1 July 2026 , new anti-money laundering (AML) and counter‑terrorism financing (CTF) laws will apply to many accounting firms across Australia. While this is primarily a compliance change for us as your adviser, you will notice some changes in how we work with you. This article explains what’s happening and what it means in practical terms. What’s changing? The Australian Government is expanding its AML/CTF laws (known as “Tranche 2 reforms”) to include professions like accountants, lawyers and real estate agents. Previously, these rules mainly applied to banks and financial institutions. From July 2026, many accounting firms will also be regulated by AUSTRAC (the government financial intelligence agency). These changes are designed to: · Reduce fraud, tax evasion and financial crime · Bring Australia in line with international standards · Close gaps where advisers may unknowingly be used to move or disguise funds Why this matters for your business As your accountant, if we provide certain services (such as setting up companies or trusts, managing funds, or assisting with ASIC transactions), we must now follow strict compliance procedures. This means you may be asked for additional information or documentation. What you can expect to change More identity checks (‘Know Your Client’) We will need to verify your identity and, in some cases, the identity of related parties (e.g. directors, shareholders or beneficiaries). This may involve: · Providing photo ID · Confirming ownership structures · Updating details periodically Even long‑standing clients may be required to complete this process. Additional questions about your business activities We may ask further questions to better understand: · What your business does · Where funds come from · The purpose of certain transactions These are part of our obligations to assess the risk of financial crime. More documentation requests Depending on the service, we may request documents such as: · Contracts or transaction details · Source of funds evidence ● Trust deeds or company records, if we don’t already hold these This is a standard requirement under the new laws. Timing of work may be affected Some services cannot commence until required checks are completed. To avoid delays, we recommend: · Responding promptly to information requests ● Providing complete documentation upfront Ongoing monitoring (in some cases) For certain engagements, we may be required to: · Periodically update your information ● Review transactions or changes in your structure What won’t change Importantly: · Our role as your trusted adviser remains the same · Your information remains confidential and secure ● We will only request what is required under law Why this is ultimately a good thing While these changes will add some extra steps, they are aimed at: · Protecting legitimate businesses like yours · Strengthening the integrity of Australia's financial system · Reducing fraud and misuse of business structures In short, it helps ensure a fairer and safer business environment for everyone. What you need to do now There’s nothing you need to action immediately, but over the coming months you can: · Expect some new onboarding or update requests · Ensure your business records and ID documents are readily available ● Let us know of any changes to your structure or ownership  We’re here to help We understand these changes may feel like “more paperwork”, particularly for long‑term clients. Our goal is to make this process as smooth and practical as possible while meeting our legal obligations. If you have any questions about how these changes apply to your business, please feel free to get in touch.
By Regina Chia June 3, 2026
For many Australians, a holiday home offers the best of both worlds — personal enjoyment and short‑term rental income through platforms like Airbnb or Stayz. However, recent draft guidance from the Australian Taxation Office (ATO) suggests that owners need to take a closer look at how these properties are treated for tax purposes. The ATO’s latest guidance makes it clear that earning some rental income does not automatically mean a property qualifies for full tax deductions . Instead, the focus is on whether the property is genuinely operated as an income‑producing investment or whether it is primarily a lifestyle asset. Investment Property or Lifestyle Asset? While all rental income must be declared, the ATO may restrict expense deductions where a property is mainly used for private purposes and only rented when convenient. If a property is classified as a holiday home rather than a genuine rental property, deductions for expenses such as interest, council rates, land tax, insurance and general maintenance may be denied. In many cases, owners may only be able to claim limited, direct costs associated with specific guest stays, such as cleaning or advertising. What Will Attract ATO Attention? The ATO is particularly focused on properties that: Are unavailable for rent during peak periods such as school holidays Are advertised inconsistently or priced above market rates Generate ongoing tax losses year after year Are clearly prioritised for personal use over rental income While no single factor is decisive, these patterns can indicate that the property is not being run on a commercial basis. Apportionment and Records Matter Where a property qualifies as income‑producing but is used partly for private purposes, expenses must be apportioned fairly and reasonably. Good records are critical, including booking calendars, listings, rental enquiries and notes of private use. The ATO can access booking platform data and readily cross‑check claims.  What Should Owners Do Now? Although the draft guidance is proposed to apply from 1 July 2026, now is the time to review your position. Owners should consider whether their property is genuinely operated to maximise rental income, whether pricing reflects market conditions and whether their record‑keeping would stand up to scrutiny. Final Takeaway The ATO isn’t banning deductions for holiday homes, but it is taking a firmer approach to distinguishing investment properties from lifestyle assets. A proactive review now can help avoid unexpected tax outcomes later. If you own a holiday property and are unsure where you stand, a proactive review could help protect your position and improve your tax outcome. Please contact us if you would like assistance assessing your current arrangements.
By Ryan Schirmer May 27, 2026
Capital Gains Tax (CGT) – What You Need to Know (and What’s Changing) If you own investments like property, shares, or a business, understanding Capital Gains Tax (CGT) is critical—especially with major changes on the horizon. What is Capital Gains Tax? Capital Gains Tax (CGT) is the tax you pay on profits when you sell an asset. It applies to assets acquired after 19 September 1985 Your capital gain is simply: Sale price (what you sell it for) minus Cost base (what you paid + associated costs) If the result is positive → you have a taxable capital gain If negative → you have a capital loss Do you always pay tax on the full gain? Not always. There have historically been concessions to reduce your tax bill, depending on when you bought the asset and how long you held it. The Two Main CGT Methods (Historically) 1. Indexation (Pre-1999 assets) This older method adjusted your cost base for inflation so you were only taxed on the real gain. Only applies to assets acquired on or before 21 September 1999 Adjusts the purchase cost using CPI This method is no longer available for newer assets. 2. The CGT Discount (Current system) This is the most common method used today. If you: hold an asset for more than 12 months, and are an eligible taxpayer (individual, trust, or super fund) You may reduce your capital gain: 50% discount for individuals and trusts 33.33% discount for super funds Example: If you make a $100,000 gain, you may only pay tax on $50,000 How CGT is Taxed Your net capital gain is added to your income It’s taxed at your marginal tax rate Capital losses can’t reduce other income—but can be carried forward Major CGT Changes Coming (From 1 July 2027) The government has proposed significant reforms that will change how CGT works. 1. The 50% Discount is Being Replaced From 1 July 2027: The current 50% CGT discount will be removed Instead, we return to a form of indexation Meaning: You’ll only be taxed on gains above inflation This is designed to tax the “real” gain only 2. A New Minimum 30% Tax Rate A key change: A minimum tax rate of 30% will apply to capital gains What this means: If your tax rate is below 30% → you still pay 30% If your rate is above 30% → you pay your normal rate The 30% is a floor, not a cap 3. Existing Assets – How Will They Be Treated? If you already own assets, the rules will split your gain into two periods: Before 1 July 2027 Existing rules apply (including the 50% discount) After 1 July 2027 New rules apply (indexation + 30% minimum tax) In practice: You may need a valuation at 1 July 2027 to determine the split 4. What About Pre-1985 Assets? Historically: Assets bought before 20 September 1985 were completely CGT-free From 1 July 2027: Any future growth in those assets will become taxable Past gains remain tax-free 5. Special Rule for New Housing To support housing supply: Investors in new residential property may choose between: The old 50% discount, or The new indexation method + minimum tax What This Means for You These changes could significantly impact: Investment property owners Share investors Business owners Family groups and trusts Key implications: The timing of asset sales will become more important Valuations at 1 July 2027 may be critical Tax outcomes could increase for lower-income taxpayers Long-term investment strategies may need review Final Thoughts Capital Gains Tax has always been complex—but the upcoming changes make planning even more important. If you own, or are thinking about selling: Property Shares A business Or any investment asset it’s worth reviewing your position well before 1 July 2027.
By Rohan Brown May 19, 2026
While most of the media focus around the 2026 Federal Budget has been on things like negative gearing and housing, one of the biggest changes has barely been mentioned at all — the taxation of discretionary trusts. And if you’re a small business owner or part of a family that uses a trust, this change could materially affect how your income is taxed in the future. Introduction One of the most significant outcomes of the 2026 Federal Budget isn’t aimed at the so‑called ‘top end of town’. It is aimed squarely at structures that everyday mum‑and‑dad businesses rely on. From 1 July 2028, discretionary trusts will be subject to a minimum 30% tax on taxable income, fundamentally changing how trust distributions are taxed. What Was Announced Under the measures announced in the 2026 Federal Budget:  • Discretionary trusts will pay a minimum of 30% tax on their taxable income • That tax will be withheld by the trustee • Beneficiaries will receive a non‑refundable tax credit for the tax already paid by the trust Why This Is a Big Deal for Individual Beneficiaries Under the current system, a trust distribution to an individual is taxed at the individual’s marginal tax rates, allowing access to the $18,200 tax‑free threshold and currently a 16% tax rate on income up to $45,000. Under the proposed rules, this benefit effectively disappears. Even beneficiaries with total taxable income below $45,000 will still bear an effective 30% tax on trust distributions. Why Small Businesses Are Most Affected Discretionary trusts are widely used by small businesses including trades, farming operations, professional practices, and family‑run enterprises. While paying wages instead of trust distributions may address the tax outcome, if your business does not already have employees it introduces real additional costs such as payroll software, payday superannuation compliance, Single Touch Payroll obligations, and WorkCover premiums. The Investment Company Issue A major concern with the proposed measures is how they apply where a company is a beneficiary of a trust, commonly referred to as ‘Bucket’ companies. Based on information released to date, companies do not appear to receive access to the non‑refundable tax credit. This creates the risk of double taxation and significantly undermines bucket company strategies commonly used to smooth income over multiple years and manage long‑term family tax outcomes. Another Common Structure Being Impacted Many small businesses operate through a company, but where all shares are owned by a discretionary trust. This has historically been prudent tax and succession planning, allowing flexibility, family involvement, and long‑term planning. While companies may continue to declare franked dividends to the trust, distributions from the trust to family members appear to be subject to the same minimum 30% tax outcome — even where that income represents the operating profit of the business. Practical Example Consider a modest family business earning $120,000 through a Trust. Under current rules, the Trust could be distributed across family members on low marginal tax rates, or at the least between Mum and Dad, therefore they would each have taxable incomes of $60,000. Currently Tax on that before Medicare and other offsets would be $17,576 combined. Under the new measure that same profit would result in tax of $36,000, an increase of $18,424 in tax paid! For a business operation we would strongly suggest wages be paid of at least $45,000 to each of Mum and Dad. If the same profit is from Trust where all income is from investments there may not be the justification of wages. Final Thoughts Although these measures are not scheduled to commence until 1 July 2028 and further legislative details are still to be released, the implications for small business owners and families using trusts are significant. This article is general information only and does not constitute tax advice.
By Natasha Gardner May 13, 2026
We’re seeing an increase in company clients receiving correspondence that closely resemble ASIC annual company renewal notices . While these notices can look official, they’re often sent by private businesses that are not associated with ASIC. They typically offer optional services at a cost well above the actual ASIC renewal fee. Before paying anything, we recommend taking a moment to check the following:  Who it’s from – Genuine ASIC renewal notices come directly from ASIC, or from our office if we act as your registered agent. The details – Official ASIC correspondence will include your Corporate Key and clear ASIC branding. The tone – These notices often use urgent or threatening language to encourage quick payment. If you receive an invoice or notice and aren’t sure whether it’s legitimate, please contact our office before making payment. We’re happy to review it with you and help ensure you don’t pay for unnecessary services.
More Posts