Insights · Cybersecurity

How to spot a fake invoice email

October 5, 2026 · NACIT engineering team

One of the most common attacks on small businesses is not a virus at all. It is an email that looks like it comes from a supplier — asking you to pay an invoice, or to send payments to a new bank account.

Six signs to check

• The sender’s address is almost right — one letter off, or a different ending
• It asks you to change bank details or pay a new account
• It is urgent: “today”, “final notice”, “before the account is closed”
• The invoice is for something you don’t recognize, or a slightly different amount
• The attachment asks you to “enable content” or sign in to view it
• The tone or signature is a little off from how that person usually writes

The one rule that stops it

Never change payment details based on an email alone. Call the supplier on a number you already have — not the one in the email — and confirm.

What helps behind the scenes

Email filtering, two-step sign-in and short staff training stop most of these before anyone has to decide. If you think someone already clicked or paid, call us right away — speed matters.