Price Quotation Request Email Scam: How the Fake RFQ Works

A new customer appears to be waiting for a price. The email includes purchasing requirements, asks about delivery times and bulk discounts, and looks like the kind of opportunity a sales team should answer quickly.

The problem is that there may be no customer and no spreadsheet. The Price Quotation Request email scam uses an ordinary business workflow to lead employees to a fake document portal where their email passwords are stolen.

Overview

The Price Quotation Request email scam is a business-themed phishing campaign. It impersonates a company representative who supposedly wants a quote for products or services and provides a link to an online Excel file containing the requirements.

The linked “document” is a lure. Instead of opening a genuine spreadsheet, it sends the recipient to a fraudulent page designed to look like Microsoft Excel Online or a secure remote attachment viewer.

A login box then asks for an email address and password before the file can be viewed or downloaded. Anything entered is collected by the scammers rather than sent to Microsoft or the recipient’s real email provider.

The campaign reviewed for this report used the subject “Request for Quotation” and borrowed the identity of a company secretary associated with Aditya Infotech Limited. The real company and the person named in the message are not responsible for the scam. Their public details were used to make the inquiry appear credible.

This distinction matters because a phishing email can contain accurate names, addresses, titles, and telephone numbers. Criminals often copy those details from corporate websites or professional profiles. Correct information inside an email does not make its sender genuine.

Reading the message alone is not harmful. The main risk begins when a recipient follows the document link, enters credentials on the copied portal, approves an unexpected sign-in request, or downloads a file offered by the page.

What the Fake Quotation Request Looks Like

The message is written like a routine request for quotation, often shortened to RFQ. It may ask for unit pricing, estimated delivery, payment terms, product availability, shipping details, or discounts for a large order.

That is a familiar conversation for manufacturers, wholesalers, contractors, distributors, and small businesses. Unlike a prize or refund scam, the promise is not free money. It is believable revenue from a possible customer.

Details used in the observed campaign

The sender asked the recipient to review “specific requirements” in an Excel file and return pricing and delivery information as soon as possible. A corporate signature listed a name, job title, company, office addresses, and phone details.

The link did not lead to an authentic Microsoft-hosted document. It opened a scam-controlled domain showing a spreadsheet in the background and a pop-up labeled “Secure Remote Attachment.” The visitor was told to sign in with an email address and password to continue.

The background spreadsheet is visual theater. It gives the impression that a real file has already loaded and only a final security check stands between the visitor and a valuable order.

Warning signs to check before responding

• The inquiry is unexpected: There was no earlier call, referral, trade-show meeting, or conversation with the supposed buyer.
• The sender address and signature do not match: The name belongs to a real company, but the domain is unrelated, newly registered, misspelled, or from a free email service.
• The document requires email credentials: A buyer does not need your mailbox password to show you a product list or specification sheet.
• The link is not hosted by the stated platform: A page that resembles Microsoft 365 may be running on an entirely unrelated domain.
• The request is broad: It asks for a quote without clearly identifying how the sender found your business or why your products fit the need.
• Urgency arrives before trust: The sender wants a rapid response but provides no verifiable procurement contact or purchase process.

Grammar is not a reliable test by itself. Modern phishing messages can be polished, and a legitimate international customer may write imperfectly. The sender’s independently verified identity, the destination domain, and the business context are stronger evidence.

How The Scam Works

1. Criminals choose businesses likely to answer RFQs

Quotation phishing is aimed at people whose jobs require opening new business inquiries. Public contact pages often identify sales, purchasing, accounts, or office email addresses, making it easy to direct the lure toward an appropriate inbox.

Attackers may also compromise a real mailbox and send the request to its previous contacts. In that case, the address can be genuine even though the current message is not.

2. A real organization is used as the cover story

The scammer can copy a legitimate company’s name, address, registration details, employee names, and branding. A recipient who searches one of those details will find a real business, which appears to confirm the story.

That search only proves the company exists. It does not prove the email came from it. Verification must use contact information found independently on the organization’s official website, not the phone number or reply address supplied in the request.

3. The promise of a sale encourages the click

The message asks for information that cannot supposedly fit in the email. A link labeled as an Excel file, purchase requirement, tender document, or product list creates a natural next step.

Employees are often trained to respond quickly to leads. The attacker exploits that helpful behavior and the concern that a slow reply could send the order to a competitor.

4. The link opens a copied document portal

The landing page imitates Microsoft Excel Online, OneDrive, SharePoint, Dropbox, Adobe, or another familiar cloud service. Logos and spreadsheet graphics can be copied, while the address bar reveals that the page is not controlled by the service it claims to represent.

Some phishing pages insert the visitor’s email address automatically. That small piece of personalization makes the login form feel like part of an existing shared-document session.

5. The fake attachment viewer captures the password

The portal says the document is protected and asks the visitor to authenticate. In reality, a legitimate document-sharing service would redirect authentication through its own official domain. It would not ask a third-party page to collect your email password directly.

When the form is submitted, the credentials are delivered to the campaign operator. A fake loading animation or incorrect-password message may appear while the data is being processed.

6. Attackers test the account and request a second factor

Stolen credentials may be tried against the genuine email service immediately. If the account uses multifactor authentication, the phishing page can ask for a one-time code or the criminal may trigger a push notification.

Approving that request can give the attacker a valid session. Some phishing frameworks relay the real login in real time and steal the session cookie after authentication, which is why users should never approve a prompt they did not start from the official service.

7. The compromised mailbox is used for business email fraud

A business inbox can expose customer lists, supplier conversations, quotations, invoices, and payment schedules. The attacker can learn how the company communicates before inserting fraudulent instructions into a real thread.

One common follow-up is a changed-bank-details scam. A customer receives an authentic-looking message from the compromised account and is told to send the next payment to a new account controlled by the criminal.

The mailbox may also send the same RFQ lure to new targets. Because the message now comes from a real business contact, it can be harder to recognize.

8. The victim sees a harmless page or empty document

After the credentials are collected, the site may redirect to Microsoft, display an unavailable document, or show a generic error. The victim may assume the buyer removed the file and continue working without reporting the incident.

That delay gives the attacker time to add forwarding rules, register a new multifactor method, create application passwords, or search sensitive mail.

Why This Business Phishing Email Is Convincing

The story fits normal work. Businesses receive unsolicited requests, large customers use procurement documents, and cloud files often require sign-in. No single element feels extraordinary.

The message also rewards speed. A quote could become revenue, while pausing to verify it may feel like unnecessary friction. This makes quotation phishing a human-process problem as much as a technical one.

Shared inboxes add pressure. Several employees may assume somebody else already checked the sender, especially when the message reaches sales@, info@, or purchasing@ addresses.

A detailed signature can reduce suspicion without requiring the attacker to create anything original. Public corporate records and employee profiles provide enough material to build a plausible identity.

The copied portal completes the illusion. People focus on the document preview and familiar logo instead of the browser address. On mobile, the full domain may be hidden until the address bar is expanded.

This mechanism resembles the DocuSign Document Review email scam: an expected business task becomes the reason to open a fake cloud login page.

What to Do if You Have Fallen Victim to This Scam

1. Stop interacting with the message and page. Close the tab. Do not retry the password, download another copy, reply to the sender, or call contact details in the email.
2. Change the submitted password immediately. Open the email provider through its official website or app on a trusted device. Use a unique password that is not a variation of the old one.
3. Revoke active sessions and connected apps. Sign out unfamiliar devices, remove app passwords, and disconnect third-party applications you did not authorize.
4. Review multifactor authentication. Delete unknown phone numbers, authenticator registrations, passkeys, security keys, and backup methods. Then enable a strong method if one was not already active.
5. Check forwarding and mailbox rules. Attackers often create hidden rules that copy messages externally, move security alerts, or delete replies containing words such as “invoice” and “payment.”
6. Tell your IT or security team. A workplace administrator can inspect sign-in logs, block the phishing domain, preserve evidence, reset tokens, and determine whether other employees clicked.
7. Review recent sent, deleted, and archived messages. Look for quotation requests, invoices, password resets, or payment instructions you did not send.
8. Warn customers and suppliers when necessary. If the account sent fraudulent messages, contact recipients using another verified channel before they act on them.
9. Protect financial workflows. Alert accounts payable and sales teams. Require an independently verified phone call before accepting new bank details or unusual payment instructions.
10. Scan any downloaded file. If the page delivered a spreadsheet, archive, PDF, script, or installer, update your security software and run a full scan. Do not reopen the file to inspect it.
11. Report the phishing attempt. Mark it as phishing with the email provider and notify the impersonated organization through contact information on its official website. U.S. recipients can also report it at ReportFraud.ftc.gov.

If the compromised mailbox contained regulated customer data, payment information, or confidential business material, involve the organization’s legal and incident-response teams. Notification duties depend on the data and jurisdiction.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Anti-Malware Free — one of the most trusted malware removal tools available.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The whole process takes about 5 minutes.

Stay Protected: Block Ads and Malicious Sites

Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

How Businesses Can Prevent Fake RFQ Phishing

A good process lets employees investigate a potential sale without gambling the security of their mailbox. The goal is not to reject every unfamiliar customer, but to verify the request before opening protected files or sharing sensitive information.

• Confirm new buyers through the official company website and a separately obtained phone number.
• Train staff to distinguish a displayed link from the destination shown in the browser address bar.
• Use a password manager, which should not autofill credentials on an unrelated phishing domain.
• Enable phishing-resistant multifactor authentication where available.
• Open unfamiliar documents in a protected preview or sandbox managed by the organization.
• Block newly registered and known malicious domains at the email and web-filtering layers.
• Require independent verification for changes to payment details, even when the request comes from a familiar mailbox.
• Create an easy internal reporting button so employees can ask for help without losing the potential lead.

The FTC advises people not to click links or download attachments in unexpected messages. If a request might be genuine, contact the company through a website, email address, or telephone number already known to be real.

Organizations should also give employees a safe way to preserve a promising lead while it is reviewed. A sales representative can forward the message as an attachment to security, call the buyer through the official switchboard, or request that the specifications be resent through an approved file-sharing system.

Those steps do not insult a legitimate customer. They demonstrate that the supplier protects business communications and payment data. A genuine procurement contact can confirm the inquiry; a scammer will usually avoid independent verification.

That advice fits business inquiries especially well. A legitimate buyer will understand a brief verification step. A scammer is more likely to push the conversation back toward the link.

The Bottom Line

The Price Quotation Request email scam hides credential theft inside a believable sales opportunity. The spreadsheet preview, corporate signature, and secure attachment prompt are there to make an unrelated phishing domain feel like a normal business portal.

Do not enter email credentials into a document page reached through an unexpected RFQ. Verify the buyer independently, open cloud documents only on the provider’s official domain, and report the message if the story or destination does not hold up.