Fake Invoice Emails: 6 Real Examples and How to Spot Them

Is this invoice email a scam?

Probably, if you don't recognize the vendor or the amount, if it pushes you to pay or call today, or if it asks you to open an attachment or sign in to see the bill. Don't use the link, attachment or phone number in the email. Check the invoice in your own account or call the vendor at a number you already have.

What to do if you got one

• Don't open the attachment, click "View invoice" or call the number in the email.
• Check for the charge yourself: log in to the vendor's site or app by typing the address, or look at your bank or card statement.
• Ask your accounts payable team or manager before paying any invoice you didn't expect.
• Report it: at work to your IT or security team, at home to the FTC at ReportFraud.ftc.gov.

A fake invoice email is a phishing email dressed up as a bill. It wants one of four things: a payment to the wrong account, your login, a phone call to a scammer, or a click that installs malware. Most use a name you trust, an amount large enough to worry you, and a deadline. The six examples below are written out as they usually arrive, with the red flags in each.

1. The past-due invoice from a vendor you don't use

Subject: Invoice #INV-20418 overdue: final notice

From: Accounts Receivable <ar@northline-billing.com>

The message: "Our records show invoice INV-20418 for $2,846.00 remains unpaid. Please review the attached statement and remit payment today to avoid a late fee and referral to collections."

Red flags

• You've never heard of the company, or you have and this isn't how they bill you.
• A "final notice" with no earlier notice before it.
• The attachment is a ZIP, an HTML file or a document that asks you to enable editing or macros.
• The threat (late fees, collections) is there to stop you from checking first.

2. The PayPal invoice with a phone number to dispute it

Subject: You have a new invoice from Billing Department

From: PayPal <service@paypal.com>

The message: "Invoice for Norton 360 Total Protection, 3 devices: $499.99. If you did not authorize this purchase, call our billing support at the number below within 24 hours to cancel and receive a refund."

Red flags

• The sender can be PayPal's real address. Scammers create accounts and use the real invoicing tool, so a clean sender line proves nothing.
• The product has nothing to do with the business named on the invoice.
• The real ask is the phone call. The "support agent" asks for remote access to your computer or your bank login to "process the refund."
• To check, log in to PayPal by typing paypal.com. A real request from someone you don't know can simply be declined there. Compare it with this PayPal phishing example.

3. The antivirus or Geek Squad renewal you never ordered

Subject: Your subscription has been renewed: Order #GS-883104

From: Geek Squad Billing <renewals.geeksquad@outlook.com>

The message: "Thank you for renewing your Geek Squad Total Tech Support plan. $389.99 will be charged to your account on file within 24 hours. To cancel or request a refund, call 1-888-xxx-xxxx."

Red flags

• A free email address (Outlook, Gmail) for a company that would use its own domain.
• No link to log in, only a phone number. This is callback phishing, the email version of the scams in fake voicemail messages.
• The same email circulates under Norton, McAfee and Best Buy names with different prices.
• If you have one of these plans, check it in the vendor's app or on its real website, never through the number in the email.

4. The vendor whose bank details "changed"

Subject: RE: Updated remittance details for October invoices

From: Dana Whitfield <dana.whitfield@acme-suppIy.com>

The message: "Hi, please note our bank has changed. All future payments, including the attached October invoice, should go to the new account below. Kindly confirm once updated."

Red flags

• The domain is one letter off: a capital I in place of an l in "supply." Read it slowly, or see more in these email spoofing examples.
• It may reply inside a real thread. If the vendor's mailbox was taken over, the address can be exactly right.
• Any change to payment details is the red flag on its own. This is business email compromise, and it goes after the people who pay the bills.
• Confirm by calling the vendor at a number from your records, not the email signature.

5. The "view your invoice" link to a sign-in page

Subject: Invoice_Q4_0931.pdf shared with you

From: Finance Team via DocuSign <dse@docusign-notice.net>

The message: "A document has been shared with you for review and signature. Invoice amount: $14,250.00. Review document."

Red flags

• A shared-file notice for an invoice you weren't expecting, from a sender domain that isn't docusign.net or docusign.com.
• The button opens a page asking for your Microsoft 365 or Google password before you can "view" the file. A real signing link doesn't need your email password.
• Hover over the button before you click. The address it shows is the truth. Compare it with this DocuSign phishing example.

6. The "pay now" invoice with a payment link

Subject: Invoice 1047 from Brightway Facilities Services

From: Brightway Facilities Services <quickbooks@notification-intuit.co>

The message: "Dear customer, please find your invoice below. Amount due: $1,180.00. Due date: today. Pay now by card or bank transfer."

Red flags

• A lookalike sender: notification-intuit.co is not an Intuit domain.
• "Dear customer" from a company that supposedly knows you well enough to bill you.
• The payment page asks for full card details or your bank login. Real invoicing tools let you pay without signing in to your bank.
• No purchase order number, contract reference or contact person your team recognizes.

What to do if you clicked, called or paid

• You opened an attachment or link: disconnect from the network and tell your IT or security team right away. Minutes matter.
• You entered a password: change it from a device you trust, starting with your email account, and turn on multi-factor authentication.
• You called the number and gave remote access: hang up, shut down the computer, and have IT check it before you use it again.
• You paid: call your bank or card company now and ask them to stop or reverse the payment. For a wire or ACH payment to a business email compromise, also report it to the FBI at IC3.gov.
• Report it at work even if nothing happened. Your report is how the security team warns everyone else who got the same email. Here's how to get employees to report phishing emails.

How to check any invoice email

• Do I know this vendor, and did we buy this?
• Does the sender's domain match the company's real website, letter for letter?
• Is it asking me to call a number, open a file, sign in, or change where we send money?
• Can I find the same invoice by logging in to the vendor's site myself?

If any answer is no or yes in the wrong place, stop and check with the vendor or your finance team through a channel you already trust. Hook Security's phishing simulations give employees practice spotting messages like these and reporting them.

Fake invoice email FAQ

Can opening a fake invoice email hurt my computer?

Reading the email in your inbox is rarely the problem. The risk starts when you open the attachment, enable editing or macros, click the link, or call the number. If you already opened an attachment, tell your IT team.

Why did I get a real PayPal invoice I don't recognize?

Scammers can open PayPal accounts and send invoices through PayPal's real system, so the email comes from PayPal's real address. Don't pay it and don't call any number written in the note. Log in to PayPal yourself and decline it there.

How do I report a fake invoice email?

At work, use your report button or forward it to your IT or security team. At home, report it to the FTC at ReportFraud.ftc.gov. Then delete it.

What's the difference between a fake invoice and business email compromise?

A fake invoice is a bill for something you never bought. Business email compromise uses a real or convincingly faked supplier or executive to redirect a payment you do owe. Both end with money sent to the wrong account, and both are stopped by confirming through a known phone number.

Keep reading

• Phishing email examples with red flags: real screenshots from Microsoft, Amazon, PayPal and more.
• Common email scams: ten scams and the tell in each.
• Fake voicemail scams: what happens when you call the number back.