Fake invoices can be a common cyberattack that a small business could fall victim to. Sometimes, the attackers succeed as they’re targeting business people who are busy and may not double check everything that comes if it seems legitimate. A few things to pay attention to when you’re processing an invoice.
A bank account change on a familiar supplier
If one of your regular suppliers emails you about new transfer instructions or details, that’s one of the most common types of scams.
Speak to your supplier, it’s best to give them a call as their emails may be compromised, to check if there are any changes. Use the phone number you have for them, not the phone number that’s on the invoice.
The sender’s domain is different
An attack may use a lookalike domain that may swap a letter, add a hyphen or change the ending to .com instead of co.uk. So at first glance, it may look like the correct email address.
Urgency around payments
Your suppliers and vendors are less likely to demand urgent payments unless you discussed this beforehand. There are usually payment terms which could be 30 or 60 days.
If you’re being pushed to make payment within 24 hours or receive requests such as ‘the Finance Director needs this payment by the end of the day’, it’s more than likely a scam to receive funds quickly.
An email-only chain
You’re more than likely established and have spoken to your suppliers. You are likely to have a phone number, a portal login or have regular contact with them.
If your interaction has happened only over email and you or nobody on your team has met or spoken with the business, treat it as suspicious until you’re certain they’re a real business and person.
Remember
Any change to bank details, urgency or any new supplier requires a phone call to double check, not using the phone number that was on the email itself.
