A fake invoice can look exactly right
Scamwatch says fake supplier emails often copy the real supplier's logo and message format, and may link to convincing copies of the real homepage. The sender address can be a near-twin of the real one: a character added, removed or changed. The warning is plain: if you look closely you can usually spot the fake, but only if you look.
Our advice: compare any new address with the one on your last genuine invoice, letter by letter. The Australian Cyber Security Centre gives the same tip, to compare the sender's domain with previous correspondence. Better still, do not rely on your eyes alone, because a tired person on a busy afternoon will miss a swapped letter.
Remember
Facts and sources for this part
- Fake supplier emails often copy the real supplier's logo and message format, and may link to convincing copies of the real homepage. [KS4]
- Scamwatch says to double-check email addresses closely, because scammers can create an address very close to the real one. [KS4]
- The Australian Cyber Security Centre advises checking the spelling of a sender's domain by comparing it with previous correspondence. [KS9]
- Fake sender addresses are often made by adding, removing or subtly changing characters in the real address, so the fake is hard to spot. [KS4]
Look-alike domains and copied websites
A look-alike domain is a web address built to resemble a real one. The Australian Cyber Security Centre lists the tricks: remove a letter, add one, swap two, add a hyphen, use a different ending (such as .net instead of .com), or replace a letter with a similar-looking number or symbol.
Scamwatch adds that scammers now use AI tools to build perfect copies of real websites, with working contact forms, and can have them live within hours of a real company launching a new service. A website that looks right is therefore not proof. For your own business, consider registering look-alike domains of your own name and ask your IT provider about SPF and DMARC, which help detect fake emails pretending to be you.
Remember
Facts and sources for this part
- Look-alike domains can fool people into thinking they are contacting your business. Tricks include removing, adding or swapping letters, adding a hyphen, using a different ending, or replacing letters with similar-looking numbers or symbols. [KS10]
- Scamwatch says scammers use AI tools to build perfect copies of real websites, including working contact forms, and can have them live within hours of a real company launching a new service. [KS7]
- It suggests a business consider registering domains that look similar to its own, to stop criminals using them. [KS9]
- It explains that SPF and DMARC are email controls that detect fake emails by stating which mail servers may send for a domain. [KS9]
- The Australian Cyber Security Centre says that if your own business is being faked, check that the emails came from your exact address, since criminals often use a similar-looking address or domain, which is called domain spoofing. [KS8]
Invented companies and goods that never get paid for
Sometimes the fake is not an invoice but a whole company. The Australian Cyber Security Centre describes criminals who register a domain very close to a large, trusted organisation, then email suppliers asking for a quote on expensive goods such as laptops. They ask for delivery to an address they choose, before payment. The goods arrive with them, and the invoice goes to the real organisation, which never ordered or received anything.
If you sell goods, the risk is yours: you may ship stock and never be paid. Our advice: check that a new, large order really comes from the company it names, by phoning a number from that company's real website, before you ship to an address that is not on file.
Remember
Facts and sources for this part
- Criminals can also invent a company: they register a domain very similar to a large, trusted organisation and ask suppliers for a quote on expensive goods. [KS9]
- In that scheme the goods are delivered to the criminals, but the invoice goes to the real organisation, which never ordered or received them. [KS9]
Checks that catch fake invoices
Scamwatch's rule for any unexpected request about money: do not act on it until you are sure it is real. Its practical steps are: have a clearly defined process for verifying and paying accounts and invoices, phone the supplier on contact details you already hold, never use a number from the suspicious email, and consider a multi-person approval for payments over a set amount.
Our advice: write the process on one page. For example, "a change of bank details is accepted only after a callback to the number in our supplier file, recorded on the change form, and approved by a second person who did not take the call". Then the checking does not depend on anyone's memory or mood.
Remember
Facts and sources for this part
- Scamwatch's advice on an unexpected request about financial details: do not act on it until you are sure it is genuine. [KS6]
- Scamwatch says to look at how the business handles accounts: have a clearly defined process for verifying and paying accounts and invoices. [KS5]
- The same advice is to phone the supplier using contact details you already hold or found independently, never a number listed in the suspicious email. [KS4]
- Scamwatch suggests considering a multi-person approval process for payments above a set dollar amount. [KS4]
Scenario 1: an invoice
An invoice PDF arrives from "Billing, Harbourline Plumbing Supplies" at "billing@harbourIine-supplies.example" (the second "l" in "Harbourline" is a capital I). The amounts and purchase order number are right. The bank details at the bottom are different from last month's, and a line says "new account effective immediately".
Red flags: The sender domain is a look-alike (a capital I replaces a lowercase l); The bank details differ from the previous invoice; "Effective immediately" pushes you to skip checks.
What to do: Hold the payment. Compare the sender domain with the last genuine invoice. Phone the supplier on the number in your file and ask them to confirm the account. If the supplier says they did not send it, tell IT and your manager, and warn colleagues who also pay this supplier.
Remember
- The sender domain is a look-alike (a capital I replaces a lowercase l)
- The bank details differ from the previous invoice
- "Effective immediately" pushes you to skip checks
Facts and sources for this part
- Fake sender addresses are often made by adding, removing or subtly changing characters in the real address, so the fake is hard to spot. [KS4]
- Look-alike domains can fool people into thinking they are contacting your business. Tricks include removing, adding or swapping letters, adding a hyphen, using a different ending, or replacing letters with similar-looking numbers or symbols. [KS10]
- Scamwatch says to double-check email addresses closely, because scammers can create an address very close to the real one. [KS4]
- The Australian Cyber Security Centre advises checking the spelling of a sender's domain by comparing it with previous correspondence. [KS9]
- The same advice is to phone the supplier using contact details you already hold or found independently, never a number listed in the suspicious email. [KS4]
Scenario 2: an email
Priya at a small bakery gets an email: "FINAL NOTICE: Invoice 20871 from Northgate Freight is overdue. Scan the QR code below to pay now and avoid collection." She does not recall using Northgate Freight, but the invoice shows a delivery date last week.
Red flags: A supplier you do not recognise sends a "final notice"; A QR code replaces a normal link, so you cannot read where it goes; Pressure to pay now to avoid collection.
What to do: Do not scan the code. Check your records and purchase orders for a delivery from this company. Ask a colleague who handles deliveries. If you cannot find a real order, do not pay, delete the email after reporting it to whoever looks after your IT, and write down the invoice number in case it comes again.
Remember
- A supplier you do not recognise sends a "final notice"
- A QR code replaces a normal link, so you cannot read where it goes
- Pressure to pay now to avoid collection
Facts and sources for this part
- Quishing is phishing that uses QR codes instead of links. It is harder to catch because the code is an image, so security tools may miss it and you cannot read the link before scanning. [KS11]
- Scamwatch's advice on an unexpected request about financial details: do not act on it until you are sure it is genuine. [KS6]
- Scamwatch says to look at how the business handles accounts: have a clearly defined process for verifying and paying accounts and invoices. [KS5]
- Fake supplier emails often copy the real supplier's logo and message format, and may link to convincing copies of the real homepage. [KS4]
Scenario 3: an email
A sales rep at Hartley Office Furniture (invented) receives a request from "procurement@bluepeak-group.example" for a quote on 60 laptops and 60 desks. The sender says they are a large, well-known company, wants delivery to a warehouse address not on file, and asks to be invoiced after delivery with 60-day terms. The domain was registered two weeks ago.
Red flags: A large order of easy-to-resell goods from a customer you have never dealt with; Delivery to an address that is not on file, before payment; The sender claims to be a well-known company, but the domain is new.
What to do: Do not ship. Find the real company's phone number from its genuine website (not from the email), call, and ask whether they sent this request. Check a domain lookup for the registration date. Get a manager to approve any new credit customer before goods leave.
Remember
- A large order of easy-to-resell goods from a customer you have never dealt with
- Delivery to an address that is not on file, before payment
- The sender claims to be a well-known company, but the domain is new
Facts and sources for this part
- Criminals can also invent a company: they register a domain very similar to a large, trusted organisation and ask suppliers for a quote on expensive goods. [KS9]
- In that scheme the goods are delivered to the criminals, but the invoice goes to the real organisation, which never ordered or received them. [KS9]
- The Australian Cyber Security Centre advises checking the spelling of a sender's domain by comparing it with previous correspondence. [KS9]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
What do SPF and DMARC do?
Show the answer
Right answer: B, They help spot fake emails by stating which mail servers may send for a domain. According to the Australian Cyber Security Centre, they are controls designed to detect fake emails. [KS9]
Question 2 of 3
A first-time customer asks for a quote on 60 laptops and wants delivery to a warehouse that is not on file, invoiced after delivery. The sender's domain was registered two weeks ago. What do you do before shipping?
Show the answer
Right answer: C, Find the real company's number on its genuine website, call it, and get manager approval. Do not rely on the email's own contact details. Check the order against the real company. [KS9]
Question 3 of 3
You receive a "FINAL NOTICE" invoice from a freight company you do not recall using, with a QR code to pay immediately. What is the best action?
Show the answer
Right answer: A, Don't scan it; check your orders and delivery records, and report the email. Check your own records before acting on an unexpected invoice. Do not use the QR code. [KS11]