How to spot a fake invoice email

A fake invoice can come from a lookalike address or a real account that has been compromised. Familiar tone, formatting, and conversation context are not proof that changed payment instructions are legitimate.

Forget 'look for bad grammar' — modern invoice fraud is clean. Look for these instead:

• ■Any change in bank account, routing number, or payment method — verify it through a trusted channel before paying
• ■Urgency plus secrecy: 'please process today', 'the CEO needs this handled quietly'
• ■A reply-to address that differs from the sender address (check the actual header, not the display name)
• ■Lookalike domains: yourvendor-inc.com instead of yourvendorinc.com — one character off
• ■An invoice arriving at an unusual time in the billing cycle, or for a slightly different amount than usual

Verify every payment-detail change by phone or another trusted channel, using contact information you already have on file rather than details supplied in the message. This reduces reliance on a potentially compromised email channel but does not eliminate fraud risk.

Make it policy: no one in your company changes where money gets sent based on an email alone, no matter how legitimate it looks or who it appears to come from.

Some account-takeover attempts produce supported audit records before a fraudulent message, such as suspicious sign-ins, inbox-rule changes, or forwarding changes. Other activity may be unavailable or delayed.

InboxGuards checks those available audit records approximately every 5 minutes and alerts in plain English when a configured account-takeover signal appears. It cannot guarantee an alert before a fraudulent message or payment. $4 per user per month, with customer-admin authorization for read-only access.