The Fake Invoice
An invoice for a subscription you never took out, a purchase you did not make, or a supplier's bill with the bank details changed.
What it looks like
- A PDF attached to an email: a subscription has renewed, and a large amount is about to be taken.
- A line saying "if you did not authorise this, call this number" — that is the actual trap.
- For businesses: a familiar supplier's invoice arrives with new bank details.
How to spot it
- Are you actually subscribed? Check your card statement. No charge means no invoice.
- Do not ring the number on the invoice. It belongs to the scammer, and "cancelling" will involve remote access or card details.
- A changed bank account on a supplier invoice is the oldest trick in commercial fraud. Always confirm new details by phoning the supplier on a number you already had.
- Rather than opening the attachment, check your invoices inside the service's own app.
What to do
- Do not pay, do not call, do not open the attachment.
- Sign in to the service yourself and look at your billing history.
- If you run a business, make verbal confirmation of any bank-detail change a rule. One rule prevents a great deal of loss.
If it already happened
- If you called and installed remote-access software, disconnect the device, uninstall it, and change your passwords from a different machine.
- If you paid, call your bank — with business transfers the first hours matter most.
- If it was a company payment, tell your finance team and your bank the same day, and keep the whole email thread.
Common questions
I opened the PDF. Could it have infected me?
Possible but uncommon: the point of this scam is to get you to phone. Still, keep your device updated and remove anything that installed itself.
It looked like it came from our real supplier.
Email accounts get compromised and replies get inserted into genuine threads. That is why bank-detail changes must be confirmed by phone, not by email.