Invoice and Payment Phishing Emails
Fake invoices, failed payment notices and remittance advice emails trick people into opening malware or sending money. How invoice phishing works and the checks that stop it.
Invoices and payment emails are part of everyday work, so phishers imitate them constantly. A fake invoice may carry malware, lead to a fake portal that steals your login, or simply ask you to pay into a criminal's account.
Common invoice lures
- "Invoice attached" from an unknown or lookalike supplier.
- "Overdue payment: final reminder" with legal threats.
- "Payment failed, please update your details."
- "Remittance advice" or "Proof of payment" with an attachment.
- "Our bank details have changed" from a real or lookalike supplier. See invoice fraud and changed bank details.
- An HTML attachment, which often opens a fake sign-in page. See HTML attachment phishing.
- A payment you were not expecting.
Checks that stop invoice phishing
- Match it to a real order, contract or delivery.
- Check the sender address and domain. See checking the sender.
- Be wary of attachments that are HTML, zipped, or ask you to enable content.
- Confirm bank changes by phone on a number you already have.
- Use two-person approval for payments and new payees. See phishing aimed at finance teams.
Never pay a first invoice or changed account details based on email alone.
Unsure about an invoice email? Paste it into CyberWatch AI Scan for a free check.
For more, see how to recognise phishing in our complete guide.
Frequently asked questions
What does invoice phishing want?
Usually one of three things: your login (through a fake portal), malware (through an attachment), or a payment (to a criminal account).
How do I check an invoice?
Match it against a real purchase order or contract, and confirm with the supplier using contact details you already have.
What if the invoice is from a real supplier's email?
Supplier accounts can be compromised. Always confirm bank detail changes and unexpected invoices by phone.
Sources
- Cybersecurity for Small Business, US Federal Trade Commission
- Small business guide: cyber security, UK National Cyber Security Centre
- Suspicious email actions, UK National Cyber Security Centre
