Fake invoice phishing example: how to spot it
It arrives as a notice from a supplier: an overdue invoice, a specific amount and a threat to suspend the service. The attachment is not a PDF. It is a web page that copies the email sign-in screen and keeps the password of whoever opens it.
Dear customer,
Invoice INV-00018342 for $4,863.20 is 15 days past due. If it is not settled today before 5 PM, your service will be suspended (Red flag 3) and late fees will apply.
The invoice is attached. To view it, sign in with your company email account (Red flag 4).
Kind regards,
Collections Department
Five red flags that give the fake invoice away
The domain is not your supplier’s
The display name says “Integral Services”, but the address ends in a similar, unfamiliar domain. Compare it with earlier invoices from the same supplier: the real domain does not change from one month to the next.
Urgency in the subject line
Capital letters, “overdue” and “suspension” in the same line push you to act before you think. A supplier with a real late payment will chase it, but it will not give you hours to fix it.
A threat with a deadline
The 5 PM deadline exists so you do not verify. If the service is critical, call the supplier on the number you already have, not the one in the email.
An invoice that asks you to sign in
A PDF opens without a password. If viewing an invoice takes you to an email sign-in screen, the target is your account, not the payment.
The double file extension
“.pdf.html” is a web page dressed up as a PDF, and it weighs only 3 KB. When opened, it shows a fake sign-in form that sends whatever you type to another server.
What to do if you get one
- Do not open the attachment or reply to the email.
- Look the supplier up in your purchasing system or on earlier invoices and call a number you already have.
- Report it to security with the report button or by forwarding it as an attachment, so the sender gets blocked for every mailbox.
- If the invoice looks real, ask accounts payable to process it through the usual workflow.
If you already opened the attachment
- If you typed your password, change it from the usual portal (not from the email) and ask IT to sign out every open session.
- Tell security even if you typed nothing: knowing who opened the file helps them check the device in time.
- If you paid, call your bank on its official number and ask to stop or reverse the payment as soon as possible.
The same trap on other channels
On WhatsApp
The same debt notice reaches a personal number with a link to “download the invoice”. To show it, the link asks for the company email username and password.
From the supplier’s real account
If someone broke into the supplier’s mailbox, the sender and the invoice are genuine and only the payment details change. A request to pay into a new account is confirmed by phone, never by replying to the email.
With a QR code in the PDF
Other versions carry a real PDF with a QR code “to pay” or “to see the details”. The destination opens on the phone, outside the controls of the company mailbox.
Questions about fake invoice emails
Other scams to recognize
Would your accounts payable team open the attachment?
Whalemate runs email phishing simulations natively, with billing lures like this one in Spanish, Portuguese and English. Whoever opens the attachment or types a password gets a short training on the red flag they missed, and the analytics show which teams concentrate the risk.