Spotting a fake invoice email is mostly about checking the details that are easy to verify. Look at the sender’s address, the language used, and any links or attachments before you act.
If something feels off, pause and confirm the invoice directly with the supplier using a known phone number or a separate email address. That simple habit stops most phishing attempts before they cause a loss.
How to identify a fake invoice email from Johannesburg suppliers
Phishers often copy the look of a legitimate invoice, but they miss small clues. Follow these checks every time an invoice lands in your inbox.
- Sender address: Hover over the email address. A genuine supplier will use a domain that matches their website, for example info@johnsontrading.co.za. Look out for extra characters, misspellings or a generic @gmail.com address.
- Subject line: Scammers add urgency, “Payment overdue, act now”. Legitimate invoices usually have a clear reference, such as “Invoice 2023-045, Johnson Trading”.
- Invoice attachment: Open the file only on a safe machine. Real invoices are usually PDF files that carry the company logo and a consistent layout. A DOCX or ZIP file is a warning sign.
- Bank details: Compare the account number and branch code with the ones you have on file. Even a single digit change can divert money to a fraudster’s account.
- Contact information: Verify the phone number and physical address. A missing address or a different phone number from previous invoices is suspicious.
Fake invoice email detection checklist you can use today
Keep a printed or digital copy of this checklist on your desk. When an invoice appears, run through the items in order.
- Check the sender’s domain matches the supplier’s official website.
- Look for spelling errors in the subject line or body text.
- Confirm the invoice number follows the sequence you expect.
- Verify the bank account details against your records.
- Open the attachment on a sandboxed computer or use a viewer that does not enable scripts.
- Call the supplier using a phone number you have saved, not the one in the email.
- Record the outcome in your audit log for future reference.
What to do when you suspect an invoice is fake
Act quickly but carefully. Here’s a short routine to follow.
- Isolate the email: Move it to a separate folder or mark it as spam. Do not click any links.
- Notify your finance team: Let the person who processes payments know immediately.
- Report the attempt: Forward the email to the real supplier’s official address and to the IT security lead in your business.
- Update your filters: Add the sender’s address to your blocked list to prevent future attempts.
Example scenario: ten-person office in Roodepoort
Imagine a small marketing agency with ten staff members. On a Tuesday morning, the finance officer receives an email titled “Urgent, Invoice 2023-078, Payment Required”. The sender appears to be accounts@metrologistics.co.za, a supplier the agency uses regularly.
The officer pauses and follows the checklist. Hovering over the address shows accounts@metrologistics.co, missing the “.za”. The attachment is a WORD document named “Invoice_2023-078.docx”. The bank account listed ends with “12345678” instead of the usual “12345679”. The officer calls the supplier’s known phone number, confirms no invoice was sent, and deletes the email. No money is lost, and the incident is logged for future training.
Setting up technical safeguards for fake invoice email detection
While human checks are vital, you can add layers of protection through your email system.
- DMARC, DKIM and SPF: Configure your own domain’s records correctly so that forged messages claiming to come from your domain are rejected or marked as suspicious.
- Anti-phishing filters: Enable policies that flag emails with mismatched domains or suspicious attachments.
- Attachment sandboxing: Use a service that opens PDFs or Office files in a virtual environment before they reach the inbox.
- Training reminders: Send a monthly tip to staff reminding them of the checklist and encouraging them to report odd emails.
Why regular reviews of supplier details matter
Suppliers sometimes change bank details or email addresses, but they usually announce it through a phone call or a formal letter. Keep an up-to-date register of all supplier contact information. Review it every quarter.
When the register is current, a fake invoice that shows an unfamiliar address or bank number stands out immediately, reducing the chance of a mistaken payment.
Frequently asked questions
How can I tell if the sender’s email address is spoofed?
Hover over the address to see the full domain. If the domain does not match the supplier’s website or contains extra characters, it is likely spoofed.
Are PDF invoices always safe to open?
Not always. Open PDFs on a machine that does not allow scripts or embedded content and consider using a viewer that isolates the file.
What should I do if I have already paid a fake invoice?
Contact your bank immediately to request a stop-payment or reversal, and report the incident to the genuine supplier and to your IT security lead.
Need a hand with this? Call DGT-IT on 083 294 2260 and we will look at your setup with you.