BitFlip Technologies
Get in touchContact
Menu
Security Notes

Spot phishing and fake invoice scams

By Travis Baldwin, Founder & Principal ConsultantLast reviewed 3 min read

The short version

  • Slow down on any message that rushes you about money, passwords or gift cards.
  • Check the real sender address, not just the name it shows.
  • Never change payment details because of an email. Call the vendor on a number you already have.
  • If someone clicks, change the password from a different device right away and tell someone. Speed matters.

What phishing looks like now

The badly spelled "prince" email is mostly gone. Today's phishing is polished. It uses real company logos and your vendors' names, and sometimes it comes from a real vendor's email account that has itself been broken into. So "it looks legitimate" is no longer proof that it is.

The goal is almost always one of three things: get you to type a password into a fake login page, open an infected attachment, or send money somewhere it shouldn't go.

Warning signs

  • Pressure and secrecy. "Urgent," "today only," "don't mention this to anyone."
  • A sender address that doesn't match. The display name says your supplier, but the address is a free email account or a look-alike domain, such as bitfIip.com with a capital I in place of the L.
  • A login page you didn't ask for. A "shared document" or "voicemail" that wants you to sign in before you can see it.
  • Unexpected attachments, especially invoices, zip files, or documents that ask you to "enable content."
  • Requests for gift cards, wire transfers or new bank details. Real suppliers and real bosses rarely ask for gift cards.

The fake invoice scam

One scam targets businesses in particular. A criminal gets into a supplier's email account, or sets up a look-alike address, and quietly watches real conversations. Then, right when an invoice is due, they send a polite note: "We've changed banks, please use these new details." The invoice is real. The account number isn't.

The FBI calls this business email compromise, and it's among the costliest crimes reported to its Internet Crime Complaint Center (IC3). Money sent this way is often moved on within hours, which is why the defense has to be a habit, not a hunch.

A simple payment rule for your office

  1. Any new payee, or any change to bank details, is confirmed by phone using a number you already have on file, never one taken from the email asking for the change.
  2. A second person approves payments above an amount you choose.
  3. No gift cards as payment, ever. Make it a rule everyone knows, so nobody has to make a judgment call under pressure.

Write the rule down and share it with everyone who touches payments. A written rule makes it easy for staff to say no, even to a message that seems to come from the owner.

If someone clicked

  1. Don't panic, and don't hide it. The sooner you act, the less damage is done.
  2. Change the password for the affected account, from a different device if you can, and sign out of all other sessions.
  3. Check your email's forwarding rules. Attackers often add a hidden rule that copies or deletes your mail. Remove anything you didn't set up.
  4. If money was sent, call your bank immediately. Banks can sometimes stop or recall a transfer if they hear about it quickly.
  5. Report it to the FBI at ic3.gov, and run a security scan on the device.

Reporting phishing

Use your email provider's "Report phishing" button, then delete the message. Fraud and scams can also be reported to the Federal Trade Commission at ReportFraud.ftc.gov, and CISA's guide to recognizing and reporting phishing has more examples.

More Security Notes