🧠 What is “Invoice Spoofing” in Cybersecurity?

Invoice spoofing occurs when attackers impersonate a vendor, contractor, or partner by sending a fake invoice that looks nearly identical to the real thing. They use stolen logos, cloned email signatures, and look-alike email domains (like “payrolI-services.com” where the “L” is actually a capital “i”). The goal is to trick a business into paying the wrong bank account. Attackers often study email conversations, timing, vendor relationships, and payment cycles so the invoice arrives exactly when expected. Small businesses fall victim because the message appears routine—just another bill in the inbox—making these attacks blend into daily operations.

What to Do:

Require a verbal or out-of-band confirmation for any invoice with updated banking details. Train staff to hover over the sender’s address and check for tiny spelling changes. Use dedicated accounts payable email addresses with strict filtering. Enable DMARC, DKIM, and SPF to reduce spoofed emails. In Microsoft 365 or Google Workspace, turn on “external sender” banners. Maintain a vendor verification list with known, confirmed bank details and never rely solely on email instructions to change payment info. Review payment logs weekly for unusual amounts or new payees. Consider workflow approvals in accounting software to prevent single-person payment authorization.

0 comments

Tech Framework

skool.com/techframework

Please post your questions and comments about business-related IT or Cybersecurity, and a member or moderator will answer them.

Members

Online

Admins