How to spot a fake invoice email before you pay

A fake invoice email looks like it comes from a supplier you already pay. It asks you to pay into a new bank account, or it carries an invoice file that hides a virus. Before you pay any new bank details, call the supplier on a number you already have. If you have already paid, call your bank and the National Scam Response Centre at 997 straight away.

How this scam works

The criminal pretends to be someone you deal with often, such as a supplier, a contractor or even your own boss. The email looks routine. The only change is the bank account, or an attachment you are asked to open.

Warning signs

• The supplier says their bank account has changed, and asks you to use the new one for this payment.
• The email pushes you to pay today, or says the boss has approved it and you should not call.
• The sender's address is slightly different from the usual one, for example one letter changed, or a free email address instead of the company domain.
• The invoice comes as a file you do not normally get, such as a zip file, or a link to "view the invoice" that asks you to log in.
• The amount, the invoice number or the wording does not match what you ordered.

One sign is enough to stop and check. A real supplier will not mind a phone call.

What to do

1. Never pay new bank details from an email alone. Call the supplier on the phone number you already have on file, not the number in the email.
2. Agree a rule with your suppliers: bank details only change after a phone call or a signed letter.
3. Let your accounts staff know how payments normally work, so they notice when a request is unusual.
4. Do not open unexpected invoice files or log in through links in the email.
5. Not sure about an email? Forward it to our support team before you act on it.

If you already paid

1. Call your bank's scam hotline, or the National Scam Response Centre at 997. The government asks victims to call within 24 hours so accounts and transfers can be blocked.
2. Make a police report.
3. Change the password of any email account that may have been broken into, and turn on two-step login.
4. Tell the real supplier, so they can warn their other customers.

Write down the date, the amount, the account number you paid to and keep the email. The bank and the police will ask for these.

A mail filter stops many fake invoices before staff see them. See our business email with phishing filtering.

Source and credit

We are sharing this guidance from the UK National Cyber Security Centre, Bank Negara Malaysia and the Malaysian government portal. This guide is written by Synctech in our own words.

• Business payment fraud, National Cyber Security Centre (UK): https://www.ncsc.gov.uk/section/respond-recover/business-payment-fraud
• Phishing attacks: defending your organisation, National Cyber Security Centre (UK): https://www.ncsc.gov.uk/guidance/phishing
• What can I do if I have been scammed?, Bank Negara Malaysia: https://www.bnm.gov.my/faqs/scams
• NSRC 997 Hotline, MyGOV Malaysia, updated 31 July 2026: https://www.malaysia.gov.my/en/topics/nsrc-997-hotline

Retrieved 26 October 2026. Synctech is not connected with these organisations. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.