Zac the IT Guy · Red Flag Friday
How to spot a fake invoice email
Fake invoice scams, also called payment redirection scams, are one of the most expensive scams hitting small businesses. The email looks normal, the amount looks right, but the money goes to a scammer. Here's how to spot one.
By Zac Tassone, Managing Director of Zectron Web & IT Services
The short version
- Bank details have "changed" and the email says it's urgent.
- The sender address is close to right but not quite.
- You don't recognise the invoice, or the wording feels off for that supplier.
- Always confirm new bank details with a phone call to a number you already have.
- If in doubt, check with your IT person before you pay anything.
Red flag 1: "Our bank details have changed"
This is the big one. Scammers either break into a supplier's real email account or set up a look-alike, then send an invoice with new bank details. Legitimate businesses do change banks, but very rarely, and never in a hurry. Treat any change of bank details as suspicious until you've confirmed it.
Red flag 2: Urgency and pressure
"Please pay today", "overdue", "final notice" or "our accounts person is away so please use this account instead". Pressure is designed to stop you from checking. A real supplier will understand if you take ten minutes to confirm.
Red flag 3: The sender is almost right
Look closely at the email address, not just the name shown. Scammers use addresses one letter off, like a missing letter, an extra dash, .co instead of .com.au, or a free email account. On a phone, tap the sender's name to see the full address.
Red flag 4: Something feels off
An invoice for something you didn't order, a supplier who suddenly writes differently, odd formatting, or a PDF that asks you to log in to view it. Trust that feeling. Most people who get caught say afterwards that something didn't seem quite right.
The one habit that stops it
Before you pay a new account or changed bank details, call the supplier on a phone number you already have, from a past invoice, their website or your contacts. Never use the number in the email, because that goes to the scammer. Make it a rule for everyone in the business who pays bills, and back it up with two people approving any bank detail change.
If you've already paid
Call your bank straight away. The faster they know, the better the chance of stopping or recovering the payment. Then report it through ReportCyber at cyber.gov.au and let the real supplier know, because their email may have been hacked. Change your own email password and turn on multi-factor authentication if you think your account was involved.
More tips
Need a hand with this?
If you're a business and this sounds familiar, my team at Zectron Web & IT Services can sort it. Or book a coffee and we'll talk it through.