Invoice Bank Details Email Scam: How It Works

An email about a missing bank detail can feel like ordinary office friction: a customer is ready to pay, one field is incomplete, and accounting needs a quick answer. That familiar story is exactly what makes the “Invoice Do Not Bear Your Company’s Bank Details” email dangerous.

The invoice bank details email scam is not a real payment request. The form is not a banking form. It is a phishing trap built to steal the password to your email account, then use that inbox as a doorway into the rest of your business.

Overview

The “Invoice Do Not Bear Your Company’s Bank Details” email scam poses as a message from a customer, contractor, or accounts department. It says an invoice cannot be processed because it does not show the recipient company’s banking details.

The observed message refers to a progress payment and asks the recipient to fill in a bank-details form as soon as possible. A button appears to offer the missing form, but it sends the victim toward a fake file-sharing page designed to capture an email password.

This is primarily a credential-phishing attack, not a genuine request to update an invoice. The criminals may mention bank details to catch the attention of someone in finance, but the immediate target is often the company email account.

Invoice bank details scam at a glance

• Fake claim: Your invoice is missing company bank details, so a payment cannot be completed.
• Common subject: “Outstanding Invoices and Statement Attached,” although wording can change.
• Call to action: Click a button to fill in or reconfirm the bank-details form.
• What opens: A fake download or file-sharing page, sometimes styled to resemble WeTransfer.
• Information targeted: Email address and password, followed potentially by financial information.
• Main risks: Email takeover, invoice fraud, data theft, password resets, and attacks on coworkers or customers.

The names, company details, signatures, and phone numbers in different copies may vary. Criminals frequently reuse the same story while replacing the visible sender or the website behind the button.

Why This Email Can Look Convincing

Business inboxes are full of invoices, statements, purchase orders, and payment questions. A short message about a missing field does not initially feel extraordinary, especially when it lands near month-end or during a busy project.

The scam also creates a positive kind of urgency. Instead of threatening to close an account, it implies that money is waiting to be paid. A busy employee may click because solving the supposed issue appears helpful to the company.

It borrows the language of real accounting work

Terms such as “progress payment,” “payment certificate,” “invoice details,” and “bank-in the payment” make the request sound connected to a genuine commercial relationship. A detailed signature can add another layer of credibility.

None of those details proves the sender has an outstanding payment. They can be copied from public websites, old emails, business directories, or a compromised mailbox.

The fake page may recognize your email address

Some phishing links carry the recipient’s address as a hidden parameter. The fraudulent page can then display that address automatically, making the login box feel personalized and familiar.

A prefilled username is not proof that a page is connected to your email provider. It usually means the attacker already knew where the phishing message was sent.

How the Invoice Bank Details Email Scam Works

Step 1: The scammers choose a finance-related pretext

The attack begins with a story that fits a working day. The sender claims to be trying to pay an invoice but says the recipient’s company bank details are absent or cannot be certified.

The message may refer to a specific claim number, project, statement, or attached invoice. These details are meant to stop the recipient from asking the most important question: “Do we actually know this payer?”

Step 2: The email creates pressure to respond quickly

The sender may say they already tried to call the office, that a payment is waiting, or that the details must be confirmed “ASAP.” This creates the impression that the recipient is delaying legitimate money.

Urgency also discourages the normal internal checks used for changes to payment information. The criminals want the employee to act from the email instead of contacting the supposed payer through a trusted channel.

Step 3: A button hides the true destination

The email contains a button with wording such as “Fill Bank Details Form.” The label describes a routine task, but the underlying address can point to a recently created or compromised domain unrelated to the claimed companies.

On a computer, hovering over the button may expose the destination. On a phone, press and hold the link without opening it to preview the address. A strange domain is a strong warning, but even a familiar-looking name can be misspelled or deceptive.

Step 4: The victim sees a fake file-sharing page

The landing page may imitate WeTransfer or another recognized document service. It can claim that the bank-details form is sensitive, protected, or available only after the recipient verifies their identity.

That is the pivot in the attack. What began as an invoice question has quietly become a request for an email password. A genuine document sender does not need the password to your mailbox to let you download a file.

Step 5: The fake form captures the email password

When the victim submits the form, the credentials are sent to the scammers. The page may show an error and ask for the password again, redirect to a harmless website, or display a generic document to reduce suspicion.

The absence of an obvious confirmation does not mean the information was safe. The first submission may already have been recorded.

Step 6: Criminals test the mailbox and connected accounts

Attackers may sign in immediately or use automated tools to test the password. Once inside, they can search for invoices, payment discussions, customer lists, password-reset emails, and valuable attachments.

If the password was reused, they may try the same combination against cloud storage, payroll, accounting, shopping, social media, and other services. A single reused password can turn one phishing page into several account takeovers.

Step 7: The stolen inbox becomes a fraud platform

A compromised business mailbox is valuable because messages sent from it inherit the victim’s reputation. Criminals can reply inside real payment threads, replace bank details on genuine invoices, or send new phishing links to coworkers and customers.

They may also create forwarding rules or filters that hide security alerts and copies of their replies. This allows the intrusion to continue even when the mailbox owner sees nothing unusual.

Red Flags That Expose the Scam

The sender and the story do not match your records

Check whether your company issued the invoice mentioned in the email, whether the sender is an approved customer, and whether the claim number exists. A professional signature does not replace those checks.

Look at the full sender address, not only the display name. A reply-to address that differs from the sender, an unrelated domain, or a recently registered web address should stop the conversation.

The message asks for a mailbox password

This is the clearest warning. A payer, supplier, document service, or bank does not need your email password to show you an invoice form. The password authenticates you to your email provider, not to an unrelated file.

WeTransfer’s official phishing guidance says it will not ask users to confirm an email password to download a transfer. A genuine WeTransfer download also points to its real service domain, though a familiar brand name alone is never enough to establish trust.

The request bypasses normal payment controls

Any request involving bank details deserves an independent verification. The FTC recommends clear procedures for approving invoices and checking payment requests, especially when an unexpected message attempts to change the normal process.

Call a known contact using a number already in your records. Do not use a phone number, link, or contact detail supplied by the suspicious email.

How to Check the Message Safely

1. Do not use the button. Leave the message open only long enough to inspect it, without downloading the form or replying.
2. Find the alleged invoice internally. Check your accounting system, sent mail, and approved customer list for the referenced document.
3. Inspect the actual sender and reply-to addresses. Expand the header details and compare the domain with the organization’s official website.
4. Preview the link. Look for unrelated hosting, misspellings, extra words, or a domain that has nothing to do with the claimed service.
5. Contact the payer separately. Use a saved number or existing conversation that predates the suspicious email.
6. Ask finance or IT to review it. A second person can often spot a mismatch that urgency caused the first reader to miss.

If the supposed customer cannot confirm the request, report the message as phishing and delete it. Do not forward it casually, because another employee may click the live link.

What to Do if You Have Fallen Victim to This Scam

1. Change the exposed email password immediately. Open your email provider from a trusted bookmark or by typing its address yourself. Choose a new, unique password that you have never used on another account.
2. Sign out other sessions and revoke suspicious access. Use the account security page to end unknown sessions, remove unfamiliar devices, revoke third-party applications, and generate new app passwords where applicable.
3. Turn on multi-factor authentication. Prefer an authenticator app, passkey, or hardware security key. If multi-factor authentication was already enabled, review whether a new method, phone number, or recovery address was added.
4. Inspect mailbox rules, forwarding, and delegates. Delete unauthorized forwarding addresses, inbox filters, automatic replies, and delegated users. Check the Sent, Deleted, Archive, and Trash folders for messages you did not create.
5. Reset every account that reused the password. Start with banking, accounting, payroll, cloud storage, domain management, and social networks. Use different passwords for every service.
6. Alert your company’s security and finance teams. Ask them to review sign-in logs, payment changes, outgoing messages, OAuth grants, and recent password resets. Preserve the phishing email, its headers, and screenshots as evidence.
7. Warn affected customers or suppliers. If attackers sent messages from your account, notify recipients through a clean channel. Tell them not to use any bank details, links, or attachments received during the compromised period.
8. Contact your bank quickly if payment details were changed or money moved. Ask the fraud department to recall or freeze transfers. For U.S. incidents, report business email compromise to the FBI’s IC3 and the scam to the FTC; use the equivalent national reporting service elsewhere.
9. Scan devices if you opened or downloaded anything. Credential phishing does not always install malware, but a malicious attachment or download can create a second problem. Run a full scan with reputable, updated security software.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Free — one of the most trusted malware removal tools available.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.

Stay Protected: Block Ads and Malicious Sites

Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

How Businesses Can Reduce the Risk

Separate document access from payment approval

Employees should never approve new bank details merely because a document arrived by email. Require an independent callback and, for high-value changes, approval from a second authorized employee.

Keep trusted supplier details in the accounting system. When an email presents different information, treat the difference as an exception that must be verified, not a shortcut that needs to be followed.

Protect email as financial infrastructure

Business email is often connected to invoicing, cloud storage, and password recovery, so it should be protected like a financial account. Use unique passwords, phishing-resistant multi-factor authentication, and alerts for new forwarding rules or unusual sign-ins.

Domain owners should configure SPF, DKIM, and DMARC to reduce spoofing of their own addresses. These controls do not stop every phishing email, but they make it harder for attackers to impersonate the company convincingly.

Give staff a safe way to pause

Finance employees should be encouraged to question urgent requests without being blamed for slowing down a payment. A two-minute verification call costs far less than recovering a hijacked mailbox or fraudulent transfer.

Run short exercises using realistic invoice and document lures. The goal is not to trick staff; it is to build the habit of checking the sender, destination, business context, and requested action.

Common Questions About the Invoice Bank Details Email

Can opening the email alone compromise my computer?

Reading an ordinary phishing message is generally not the same as submitting information or running a file. The greatest risk begins when you follow the link, open a malicious attachment, enable document content, or install something it provides.

Modern email clients can load remote images that tell a sender the message was opened, so blocking automatic remote content still provides privacy value. If you only read the email, report and delete it; if you interacted with its content, follow the recovery steps above.

Is it safe if the fake form no longer loads?

No. A dead page can return later, redirect to a new destination, or work only for selected visitors. Security services and hosting providers frequently disable phishing pages, but the email remains fraudulent even after its link stops responding.

What if the email names a real customer?

That may indicate the attacker used public information, obtained an old contact list, or accessed one party’s mailbox. Treat the message more seriously, but verify it through the customer’s known phone number and review the entire payment conversation for tampering.

Should I reply to test whether the sender is genuine?

No. A reply confirms that your address is monitored and keeps you inside a channel the attacker may control. Start a new conversation using contact information already stored in your accounting or customer-management system.

Official Sources and Further Reading

• WeTransfer: Spam, phishing, and fake WeTransfer emails
• FTC: Fake invoices and phishing aimed at small businesses
• FTC: How to recognize and avoid phishing scams
• FTC: Report fraud and scams

The Bottom Line

The “Invoice Do Not Bear Your Company’s Bank Details” email is not a routine request to complete a payment. It uses a believable accounting problem to steer the recipient to a fake file-sharing page and steal an email password.

Do not use the embedded form. Verify the invoice and sender through records you already trust. If you entered a password, secure the mailbox immediately, inspect forwarding rules, alert your organization, and check whether criminals used the account to target anyone else.