NSW Police have smashed a syndicate that allegedly swindled more than $2.6 million from up to nine businesses across the country after accessing email servers to generate payment invoices with fake bank details.

Two men were arrested and charged after Thursday's raids, with the force's cybercrime unit saying the scam should serve as a stark reminder for firms to review payment processes.

"These were all small to medium businesses," squad commander Matthew Craft told reporters in Sydney on Friday.

"Successful businesses with what they thought were adequate security and cyber practices in place.

"It's about awareness to business email compromises. If staff are aware, they're more likely to be resistant to it."

Detective Superintendent Craft cautioned users to keep their wits about them while surfing the web outside their usual work or school environments.

"We are all extremely connected online," he said.

"There's no need to be afraid of that but what we do need to practise is some very general cybersecurity."

It would be "naive" not to expect increased internet activity amid the COVID-19 restrictions to lead to more fraudsters targeting those who were less technologically savvy, Det Supt Craft said.

But users can steer clear of online stings by updating their computer software and security settings and considering email links before clicking on them.

"A legitimate business will not ... request personal information from you via email, SMS or the phone," Det Supt Craft said.

Australian Associated Press