The Urgent Invoice Attachment
At 16:40 on a Friday, the finance manager receives an email that appears to come from the firm's regular supplier. The display name matches, the subject reads 'Overdue invoice - action required today', and the body says the attached PDF is the 'corrected' invoice and that payment must be made before Monday or service will be suspended. The attachment is named Invoice_2291.pdf.exe. The manager is about to open it when a colleague notices the file extension. The firm has antivirus running, but it was last updated nine days ago. The manager has authority to approve payments up to £25,000 and is keen to avoid any disruption.
1. List the red flags in this message and explain what each one suggests about the threat.
Read the worked answer
Red flags:
- Double extension (.pdf.exe) - the file is an executable disguised as a PDF. Opening it would run code, not display a document. This is the strongest signal.
- Urgency and a deadline - 'today', 'before Monday', 'service suspended'. Pressure tactics push the target to act before thinking. This is social engineering.
- Display name matches a known supplier - sender display names are trivially spoofed; the real sender address should be checked, not the name.
- Unexpected 'corrected' invoice - a change to normal invoicing is a classic pretext for a malicious attachment or a payment-diversion attempt.
- Timing (late Friday) - designed to catch someone tired and keen to close the week, reducing scrutiny.
Together these point to a phishing email delivering malware (possibly ransomware or a banking trojan), not a genuine invoice.
2. State the correct immediate actions, in order, and explain why antivirus alone is not sufficient here.
Read the worked answer
Immediate actions, in order:
- Do not open the attachment. Stop.
- Verify out-of-band - phone the supplier on a number from the firm's own records, not from the email, and ask whether they sent it.
- Report the message to IT/security and, if the firm has one, the phishing-report button. Preserve the email as evidence.
- Do not pay anything until verified through a known channel.
- Delete/quarantine only after IT has captured it for analysis.
Why antivirus is not enough: Signature-based antivirus only catches known malware, and its definitions were nine days stale. A new or slightly modified executable may not match any signature. Antivirus is a last line of defence, not a substitute for the user not running the file. The decisive control here was the colleague spotting the extension - human vigilance plus a verification process.