Police are warning south-west residents not to be email scam victims or money mules for international crime syndicates.
Councils, schools, regulatory authorities and businesses have been targeted in the south-west by such scammers in the past two years, with individual case loses of up to $500,000.
Rarely has any scammed money been recovered.
Detective Sergeant Mark James, of the Hamilton police crime investigation unit, said it was clear that email scams and romance sites were working in tandem to target business and individuals.
He said emails had been hacked and cloned, usually with an invoice for payment sent out that appeared legitimate, but BSB and banking account details had usually been altered to a different account.
"Unwitting clients pay the invoice and believe all is well until another account comes from the supplier and they both realise a scam has occurred. By then it is generally too late to recover the funds," he said.
Detective Sergeant James said a recurring theme was scammed funds being transferred to a third party with an Australian bank account.
"These people are usually themselves being scammed via online romance-type sites," he said.
"The third party is told by their online love interest that they will receive funds, sometimes for travel or sometimes to send on to a 'friend' of the online love interest, who is unable to transfer the money themselves.
"These people become unknowing assistants in the crime by accepting the funds and transferring them on."
Detective Sergeant James said the consequences of a person becoming embroiled in such a scam often resulted in their bank accounts being frozen and they were flagged with financial institutions as being involved in cyber-crime.
"That makes it very difficult to open another account, obtain credit or be involved in normal banking processes," he said.
"These consequences can be far reaching and very hard to make good in the short term."
Detective Sergeant James said there were some ways to avoid becoming a victim of such scams.
"If you receive an emailed invoice, double check the BSB and account number before sending the money," he said.
"This can easily be done by a phone call to the business in question or a visit to their website. Hover your computer mouse over the email address in the title bar of the email which will show the actual email not the name given by the person sending.
"If the domain name, ie firstname.lastname@example.org, is different to the company web address there is a strong possibility it may be a cloned email."
The investigator said people should also consider adding two factor authentication, also known as multi-factor authentication, to your email account.
"This is when an SMS is sent to your phone number or a code is generated by an authentication app each time you log into your email account," he said.
"This will prevent your email account from being accessed without your permission if a criminal somehow finds out your password.
"For those involved in online romances – if you haven’t actually met the person and they are asking you to conduct some sort of financial transaction, such as receiving or sending money to them or another, then it's almost certainly a scam. "
Detective Sergeant James urged people to cease all contact with the scammer.
"It was probably a robot sending you those lovely messages and photos and not even a real person," he said.
"Cyber criminals are extremely clever and constantly adapt their strategy to circumvent law enforcement and public awareness.
“If you’ve been the victim of cyber-crime it can be reported via www.acorn.gov.au or speak to local police for advice," he said.