An invoice you don’t recognise has just landed in the accounts inbox. It says the balance is overdue. There might even be a note from someone senior in your business asking for it to be paid.
Don’t pay it yet. The next half hour is for checking. A real invoice will still be real in 30 minutes, and a fake one only works if you move fast.
What a real one looked like
A professional services firm we look after received exactly this earlier this year.
An email arrived in a shared inbox that appeared to come from one of the firm’s own senior people. The display name matched. The note said they hadn’t been able to finish the transfer on their banking app, and asked for a supplier to be paid by direct deposit using the bank details further down.
Underneath sat a forwarded “overdue invoice” from the supplier’s accounts team. It warned that unpaid balances could be referred to collections and invited the firm to pay online using “the credentials previously provided”.
Staff spotted it, marked it as phishing and sent it to us. That was exactly the right call.
What gave it away
The sender’s address. The display name belonged to a real person at the firm, but the actual address came from an unrelated outside domain. The firm’s advanced email protection had put a warning banner on it saying just that, and noting that the email was asking for an invoice to be paid.
The dates. The forwarded invoice was dated about three months before the covering note. An invoice that’s been sitting that long rarely turns into a same-day emergency.
The pressure. Overdue, collections, “your prompt attention”. Urgency is the whole trick.
The excuse. A senior person who can’t complete a transfer themselves, asking someone else to pay to bank details supplied in the email.
What our service desk checked
We looked up the message in the email filter’s console and found it already in quarantine, classified as a scam. We asked the staff member whether it had arrived as one email or two, because the date on the forwarded invoice didn’t fit. Then we rang to follow up.
The whole thing took our team about 15 minutes. Nobody had to recover anything, because nobody had acted on it.
The next half hour, step by step
1. Hold the payment. If it’s already queued in your banking or accounts software, stop it. Let whoever approves payments know there’s a question over it.
2. Don’t reply and don’t click. No links, no attachments, no “view invoice” button. Replying just starts a conversation with whoever sent it.
3. Don’t use any contact details from the email. Phone numbers, email addresses and “our finance team” details in a fake email lead straight back to the scammer. Ring the supplier, or your colleague, on a number you already had: from an invoice you’ve paid before, your accounting software, or their website typed in yourself.
4. Check the sender’s address letter by letter. Ignore the name shown and look at the address itself, especially the part after the @. The Australian Signals Directorate describes two common tricks: a domain that’s spelled almost like the real business’s, and a real person’s name used as the display name on an ordinary webmail account.
5. Look at the thread, not just the top message. Check dates, names and whether the history makes sense. Anyone can paste text that looks like a forwarded email.
6. Send it to your IT provider as an attachment. Forwarding as an attachment sends us the original message rather than a copy of its text. In Outlook, select the email, then on the ribbon choose More Respond Actions, then Forward as Attachment. Then report it as phishing using your email’s report option, or the button your IT provider has set up.
7. Warn the people involved, but not through that thread. Ring or walk over to the person being impersonated, and tell your accounts team. If the email claimed to come from a real supplier, ring them too. ASD notes that criminals don’t only pretend to be businesses, they also use real employees’ email accounts that have been compromised, so the supplier may need to know.
Our service desk is open 8am to 6pm weekdays, with after-hours support by phone, so there’s someone to send it to while it’s still fresh.
If money has already gone
Move quickly, in this order:
- Ring your bank. ASD’s advice is to contact your financial institution as soon as possible, because they may be able to stop the transaction.
- Report it through ReportCyber. Your report goes to the relevant police. Keep the reference number starting with “CIRS”, because your bank or insurer may ask for it.
- Tell your IT provider. If anyone clicked a link and entered a password, that account needs checking, including for mail forwarding rules nobody set up.
Don’t delete the email. Whoever investigates will want it.
Make the next one easier
One rule stops most of these: a change of bank details or an urgent payment request is never actioned on email alone. It gets a call-back on a number you already had, every time, no matter who it appears to come from.
Write that down, tell everyone who can make a payment, and give the senior people permission to be rung about their own requests. Most of them would much rather take that call than explain a missing transfer.
The one step for today: if an invoice like this turns up, forward it to your IT provider as an attachment and hold that payment until it’s been checked.
If you’re not sure who that should go to in your business, talk to us.