88 emails businesses asked us to release from the spam filter, and what they were

When our email filter isn’t sure about a message, it holds it back. The person it was sent to can ask for it to be released, and each of those requests lands on our service desk as a ticket.

Over the year from 19 August 2025 to 18 August 2026, staff at 17 client businesses asked us to release 88 held emails. Four more came from addresses we couldn’t match to a client, so we’ve left them out of the business count.

That’s not a flood. It’s fewer than two a week across every business we look after. What’s interesting is what people wanted back, because the answer points straight at the accounts inbox.

What was in the 88

We sorted the requests by subject line. Here’s how they fell:

• 39 were invoices, statements, payment notices, orders, quotes, bookings and tax paperwork. That was the biggest group by a long way, and it came from 12 businesses.
• 8 looked like phishing lures: someone “shared a document with you”, a document “submitted for review”, a signature request. We’ve written those up separately.
• The rest were everyday business mail: property settlement updates, tender documents, shared project files, a patient history sent from another practice, donation enquiries for a charity, a staff form and a blank tenancy agreement.

Releasing an email is usually a quick job. 75 of the 88 requests were handled with no time logged, the whole year came to 1.2 hours of logged work, and no single request took more than 15 minutes.

Five requests were for emails the filter had already labelled as spam in the subject line. Staff asked for them anyway. All five were invoices or statements, and all five were at the same business.

Why a filter holds a real invoice

It feels like a fault when a supplier’s invoice disappears. Most of the time it’s the filter doing its job a little too keenly.

Fake invoices and payment requests are one of the oldest tricks in the book, so filters look hard at exactly what a real invoice contains. An attachment. A link to view or pay. A dollar amount. A sending address or accounting system the filter hasn’t seen from that supplier before.

A supplier who changes their invoicing software, starts sending from a new address, or sends a statement with a “view online” button can trip that check overnight. From the filter’s side, a genuine invoice from a new system and a fake one can look very similar.

That’s why the finance group is so big. The filter is being careful with the kind of email that costs the most when it gets through.

What the subject lines looked like

With names, amounts and reference numbers removed, the finance group reads like any accounts inbox:

• Invoice
• Tax invoice from [supplier]
• Monthly account statement from [supplier]
• Payment has been made by [customer] for [amount]
• Thanks for your order!
• You received a new invoice [number]
• Statement is ready: Kindly Sign In

Most of those are exactly what they look like. The last one deserves a second look. A statement that asks you to sign in before you can read it is a common shape for a phishing email, and it was sitting in the same pile as the ordinary invoices.

On one morning, the same business asked for three separate “booking order payment request” emails within 14 minutes. A subject line can’t tell you whether those were real. That’s the point: in the finance group, the genuine and the fake look alike, and the person clicking “release” is the last check.

How the requests were spread

The requests weren’t even. One business sent 16 of the 88. September 2025 was the busiest month with 14, and February 2026 the quietest with 4.

Six requests came in on a weekend, when there’s usually nobody around to ask whether an email was expected.

Businesses with a busy accounts inbox, lots of suppliers and regular orders sat at the top of the list. That makes sense. More finance mail means more chances for the filter to be unsure.

Asking for a release is the right move

If you’ve asked for a held invoice back, you did the right thing. Checking the held pile is far better than assuming nothing important went missing, and most of these requests were for mail the business was expecting.

The part worth tightening is what happens in the few seconds before you ask. The emails a fraudster most wants you to release are the ones about money, and they’re designed to look like the ones you get every day.

A weekly check for accounts staff

This takes ten minutes, once a week. Whoever pays the bills is the right person to do it.

1. Look at what’s being held for the accounts mailbox. If you’re not sure how to see held mail, ask us and we’ll tell you who in your business can.
2. Match each held finance email to something you expected. A supplier you deal with, an order you placed, an invoice that’s due. If you can’t match it, leave it held.
3. Never act on changed bank details from an email. If a held message says a supplier’s account details have changed, ring the supplier on a number from your own records or an old invoice, not the one in the email.
4. Don’t release anything that asks you to sign in to see a statement or invoice. Go to the supplier’s website or portal the way you normally would and check there.
5. Tell us about repeat offenders. If the same regular supplier keeps getting held, let us know rather than releasing each one. It’s better to look at why it’s happening.

Pass it on

Forward this to whoever pays the bills in your business, and ask us who can currently see and release your held mail. It’s a short conversation, and the answer is often a surprise.

If you’d like us to look at what your filter has been holding, get in touch.