How to spot a fake invoice email before you pay it

A fake invoice email rarely looks suspicious. It looks like the supplier you pay every month, with a small change: a new bank account, a new phone number, or a request to pay today. The attacker is counting on you being busy.

Six checks before you pay

1. Look at the real sender address, not the display name. Tap or hover over the name to see the address behind it, and check for a changed letter or an extra word in the domain.
2. Treat any change of bank details as suspicious until proven otherwise. Call the supplier on a number you already had, not one in the email.
3. Be wary of urgency. A demand to pay in the next hour is a reason to slow down.
4. Compare the invoice with the last real one: amount, layout, account number and the wording.
5. Check that the invoice matches an order or a delivery you know about.
6. Ask a second person to approve any payment above a limit you set.

Make it harder for the attacker

• Switch on a second sign-in step for every email account, starting with finance and managers.
• Write a short payment rule: changes of bank details are confirmed by phone, by two people.
• Use email filtering that flags look-alike domains.

No filter catches everything, so the payment rule matters as much as the software. Our cyber security service covers both.