The Phishing Invoice
Marek, an accounts assistant, receives an email that appears to come from the company's regular supplier. The display name matches, the subject reads 'Overdue invoice - final reminder', and the body says the bank details have changed and payment must be made today to avoid legal action. The email address is [email protected], whereas previous genuine emails came from [email protected]. There is a link labelled 'View invoice' pointing to a shortened URL. The email is addressed 'Dear Customer' and has a PDF attachment. Marek's manager is on leave and the amount is £8,400.
1. List the warning signs in this email and explain what each one indicates.
Read the worked answer
| Sign | What it indicates |
|---|---|
Display name matches but the address is supplier-invoices-portal.com, not the known brightsupplies.co.uk |
Display names are trivially spoofed; the domain is the reliable identifier. A lookalike/unfamiliar domain is a strong phishing indicator. |
| 'Bank details have changed' | Classic business email compromise tactic - the whole point is to redirect money to the attacker's account. |
| Urgency and threat of legal action, 'pay today' | Manufactured time pressure to stop the recipient checking. |
| 'Dear Customer' | Genuine supplier correspondence to an existing account usually uses a name or account reference. |
| Shortened URL | Hides the real destination, preventing the recipient from judging it. |
| Unexpected PDF attachment | Common malware or credential-harvesting delivery method. |
Together these are textbook phishing / invoice fraud signals.
2. Marek cannot reach his manager. Recommend a course of action that protects the company, and state what he must NOT do.
Read the worked answer
Must NOT:
- Pay the invoice or reply to the email.
- Click the 'View invoice' link or open the PDF.
- Use any contact details given in the email.
Recommended actions:
- Do not act on the email's instructions. The changed bank details are the core of the fraud.
- Verify out-of-band - contact the supplier using a phone number from the company's own records or a previous genuine invoice, never from this email. Ask directly whether their bank details have changed.
- Escalate - report to the manager by another channel (phone/chat) and follow the company's fraud-reporting procedure; £8,400 is well above any casual threshold.
- Report the email as phishing to IT/the security team and delete it (or move to quarantine).
- If any link was already clicked or details entered, report immediately so credentials can be reset.
The principle: verify payment changes through a separate, trusted channel before any money moves.