How to Spot a Fake Invoice Email Before Paying
An invoice may be a phishing lure even if it resembles your normal supplier.
The aim is to help you complete one clear task, recognize what needs verification, and avoid the most common mistakes. Work through the checks in order, then use the real-world example to apply them to your situation.
This guide is designed as a practical decision checklist. Use the relevant official guidance alongside the steps, especially when rules depend on your country, device or individual circumstances.
1. Compare with your records
Check whether your organization actually ordered the goods or service, and whether the invoice number, supplier name, amount and purchase date match your purchase order or prior correspondence.
2. Verify payment details separately
If a supplier announces a new bank account, phone a trusted contact using a number already in your records. Do not rely on telephone details in the suspicious email. Look for subtle domain spelling changes and unusual reply-to addresses.
3. Handle attachments cautiously
Avoid enabling macros or opening executable files from unexpected invoices. Use your organization’s standard payment-approval process and malware scanning procedures. A PDF format alone does not guarantee that its links are safe.
4. Pause and create an audit trail
Record the verified contact, purchase reference and approval steps. If a transfer was made to a fraudulent destination, notify the bank immediately and follow your incident reporting process.
Verify the source before acting
For the definitions, current capabilities or rules behind this topic, use the original source below. Features, eligibility, safety requirements and local laws can change. A guide cannot replace a provider's official instructions or qualified advice for a consequential decision.