Fake invoice and fake boss emails: how to stop them
- The most costly scams ask you to pay a fake invoice, change bank details, or buy gift cards for the boss.
- A simple rule stops almost all of them: confirm money requests by phone, using a number you already have.
Steps
- Never change bank details from an email. If a supplier says their bank changed, call them on the number from your own records first.
- Use two people for payments. One person enters the payment, another approves it. This blocks many tricks.
- Be careful with the boss asking for gift cards or urgent transfers. Walk over, call, or message on another app. Real bosses do not mind you checking.
- Check the sender. Look at the full address, not just the name. Crooks use addresses that differ by one letter.
- Act fast if you paid. Call your bank right away and ask to recall the payment. Speed matters. Then tell your IT provider and report it to the right place, such as the FBI's IC3 site or your local police.
A made up example
Marco runs a small bakery supply shop. An email arrives from what looks like his flour supplier: "Our bank changed. Please pay this week's invoice to the new account below." The email looks right, but the address has one extra letter. Marco calls his supplier at the number on his old invoices. They never sent it. The call took two minutes and saved a week of cash.
Why this works on smart people
These emails arrive at the busy moment and look normal. The fix is a habit, not being smarter.
When to call a pro
- You already sent money.
- Someone sent fake emails using your company name.
- You suspect a mailbox was hacked and rules were set to hide replies.
- You want a payment approval process set up in your accounting tool.
Need IT support for your business?
Call Ava, or book a free check. We look at your setup and tell you what we would fix first, in plain words, whether or not you hire us.
●●● ●●●-●●●● Book a free check
Common questions
Can I get the money back?
Sometimes, if you call your bank immediately. The first day matters most.
Where do I report it?
Tell your bank, your IT provider and the police. In the United States you can also report to the FBI's IC3 and the FTC.
How do I make my staff stay alert?
Share real looking examples, like the one above, and make confirming by phone the normal rule.
Keep reading
- How to spot a phishing email
- My emails land in my customers' spam folder
- What to do if you clicked a bad link
Where we help
Minority- and Black-owned businesses are welcome here, and so is every other small business.
Book a free 30-minute review
Tell us what is not working. We will look at your setup and tell you what we would change, whether or not you hire us.
Book the review ●●● ●●●-●●●●