Spotting Phishing Emails and Fake Invoices
Small offices are a favourite target for fake invoices and payment-change requests. A few habits stop most of them before money moves.
Phishing is a form of social engineering in which attackers deceive people into revealing sensitive information or installing malware, often through email. In a small office the most expensive version is not a strange-looking message from a stranger but a convincing email that appears to come from a supplier, a client or the boss, asking for a payment.
Business email compromise
Business email compromise describes attacks where criminals use email, often from a hijacked or look-alike account, to trick a company into sending money or data. Typical stories include:
- A supplier "changing bank details" just before a payment is due.
- A manager asking, urgently and privately, for a transfer or gift cards.
- An invoice that looks normal but carries a slightly different account number.
Warning signs
- Urgency, secrecy, or pressure to skip the usual process.
- A sender address that is almost right: an extra letter, a different ending.
- Links whose real address, when you hover over them, does not match the text.
- Attachments you were not expecting, especially ones that ask you to enable something.
- A request to log in "to view the document" on an unfamiliar page.
The one rule that stops most fraud
Never change payment details on the strength of an email alone. Call the supplier on a phone number you already had, from an earlier invoice or your own records, not the number in the new message. Make it an office rule that applies to everyone, including the owner, so nobody feels awkward checking.
Make reporting easy
People click on things. What matters is that they say so quickly. If someone entered a password on a suspicious page, change that password at once, check that a second factor is on, and look at the account for changes such as new forwarding rules. Thank people for reporting; blame teaches them to hide mistakes.
Two people for payments
Where your bank allows it, require two people to approve new payees or payments above a level you choose. It adds a minute to legitimate payments and a serious obstacle to fraudulent ones.
Illustration only: an email arrives from "accounts@" a supplier's domain with one letter swapped, saying their bank has changed and attaching a new invoice. The right response is to call the supplier on the number in last month's invoice before paying anything.
Filed by Harriet Lowell · revised 2026-11-09