Due Invoices Payment Email Scam Exposed: Fake SWIFT Receipt Login Trap

A remittance notice can arrive at exactly the moment an accounts team expects several payments. The promise of attached SWIFT records makes the message look easy to reconcile.

Before anyone opens those files, the claimed payer, invoices, amount, and receiving account should connect with records the business already controls.

Overview

What the payment email claims

The message says payment has been made for due invoices. It may carry a subject such as “Bank Remittance Swift copy for Due Invoices.”

A sender identified only as “Accounts Department” tells the recipient to download SWIFT copies. One or more PDF attachments appear to contain MT103 payment records.

The body is brief and businesslike. It avoids dramatic threats, relying instead on the ordinary expectation that finance staff review incoming remittance advice.

Important details are absent. The email may not name the payer, invoice numbers, amount, currency, beneficiary, project, or employee who arranged the payment.

What happens when the supposed SWIFT copy opens

The attachment may contain a link or direct the browser to a hosted document viewer. A faint invoice or payment page appears in the background.

A centered window says email verification is required. The recipient’s address may already be displayed, creating the impression of a restricted corporate file.

The form asks for the mailbox password before revealing the document. Submitted credentials go to the phishing operator, not a bank or trusted PDF service.

The promised MT103 record may never appear. Its purpose is to make a finance employee authenticate before confirming whether the payment exists.

Details that distinguish proof from bait

Real remittance advice belongs to an identifiable receivable. The email must fit the business relationship rather than create it.

• No customer account matches the sender or claimed payment.
• No invoice numbers or amounts appear in the message.
• The attachments use generic or duplicated MT103-style names.
• The PDF sends readers to an unrelated website.
• A document viewer requests the recipient’s email password.
• The receiving bank account shows no corresponding cleared credit.

A SWIFT-themed image can support reconciliation, but it cannot replace the bank ledger. Funds should be confirmed where they were supposedly received.

Why Finance Teams Are Attractive Targets

Accounts departments routinely handle files from outside organizations. Invoices, remittance notices, purchase orders, and statements arrive from many domains and document platforms.

That variety makes one unusual delivery method less conspicuous. An employee may assume the payer’s bank or accounting software chose the format.

Payment messages also have natural urgency. Staff want to allocate cash, release orders, update credit limits, and answer customers without unnecessary delay.

The subject uses familiar operational language instead of emotional pressure. “Due invoices” and “SWIFT copy” sound like routine bookkeeping rather than a security event.

Multiple attachments can suggest a batch settlement. They may also keep the recipient trying when the first file fails to display.

An MT103 reference carries particular authority because it is associated with international payment messaging. Attackers borrow the label without providing verifiable banking evidence.

Small finance teams may share responsibilities across sales and operations. One employee can mistake an unknown payment for work initiated by another department.

Larger organizations face the opposite problem. High message volume and distributed ownership can make it difficult to recognize every genuine payer immediately.

What an MT103 Copy Can and Cannot Prove

An MT103 is a standardized customer credit-transfer message used within the SWIFT network. Fraudulent emails exploit that technical familiarity to make attachments appear authoritative.

A picture labeled MT103 is not automatically genuine. Templates can be recreated, unrelated records edited, and transaction fields invented.

Even a genuine-looking document must be reconciled against the recipient’s bank account and receivables ledger. The beneficiary, value date, amount, and reference all matter.

A payment instruction does not always equal settled, available funds. Transactions can be pending, rejected, reversed, routed incorrectly, or associated with another beneficiary.

The receiving bank can confirm status using its own systems. A stranger sending an attachment cannot authoritatively declare that money arrived.

Finance staff should never release goods, refund an alleged overpayment, or change customer credit based only on a document supplied by the payer.

If a real customer sent the advice, their known contact can confirm it through an existing conversation. New telephone numbers within the notice should not be trusted.

When no receivable matches, curiosity is not a business reason to authenticate. Preserve the message and let security personnel inspect it safely.

Why Stolen Finance Mailboxes Are Especially Valuable

A finance inbox maps the organization’s money flows. It can expose customers, suppliers, bank accounts, approval habits, payment schedules, and overdue balances.

Criminals search for active invoice threads where a bank-detail change would seem plausible. They can wait until a large payment is nearly due.

A compromised account supplies authentic signatures and conversation history. A fraudulent message inserted into that thread is harder to detect than cold spam.

Forwarding rules can silently copy every future remittance message. Deletion filters may hide replies questioning a changed beneficiary.

The attacker can also collect tax forms, contracts, identity documents, and customer contact lists. Those materials support impersonation beyond the original victim.

Shared cloud access may expose invoice folders or accounting exports. Single sign-on can extend mailbox credentials into collaboration and storage services.

From the real account, the operator may send the same fake SWIFT lure to suppliers. Trust transfers with the sender address.

Recovery therefore requires a financial review as well as password replacement. Recent and scheduled payments must be checked for manipulation.

How the Scam Works

Step 1: An accounts department announces payment for overdue invoices

The email states that due invoices have been paid and asks the recipient to inspect remittance copies. Its wording assumes an existing commercial relationship.

The sender may use a real company name, a copied signature, or a vague department label. None demonstrates control of that organization’s accounts.

Because no exact invoice is named, the template can target many businesses. Each recipient is invited to supply the missing context mentally.

Step 2: SWIFT terminology gives the attachments authority

Files are named to resemble bank transfer records, sometimes including MT103, payment, remittance, or transaction references.

More than one PDF may be attached. The quantity suggests a complete payment package and increases the chance that an employee opens something.

A PDF format feels safer than an executable file. Yet PDFs can contain clickable links that lead directly into a phishing sequence.

Step 3: The file moves the recipient into a web-based viewer

Opening the attachment reveals a button, link, or locked preview instead of usable payment information. Following it launches an external website.

The domain does not belong to the payer, receiving bank, SWIFT, or an approved document service. Visual branding distracts from that ownership problem.

Tracking embedded in the link can identify which employee opened the message and when, improving later targeting.

Step 4: A blurred invoice is placed behind a verification prompt

The landing page displays faint financial content beneath a modal window. That design suggests the requested information already exists and merely needs authorization.

The email address can be prefilled from the original link. Recipients often interpret that personalization as evidence of legitimate access control.

The background may be a static image with no downloadable document behind it. Blurring prevents meaningful inspection before credential submission.

Step 5: The fake portal captures an email password

The user enters mailbox credentials to unlock the alleged SWIFT record. The page transmits them to the campaign operator.

An error may appear after the first attempt. This encourages entry of a second password or helps the attacker confirm a commonly used variation.

If multifactor authentication is enabled, another screen can request a current code or trigger a genuine approval notification.

Step 6: The intruder studies receivables and payment conversations

After accessing the mailbox, the attacker searches for invoices, beneficiary details, bank confirmations, and employees with payment authority.

Rules, forwarding, delegated access, or connected applications may be added for persistence. Security alerts can be hidden from the account owner.

The operator learns which customers owe money and how the finance team normally communicates. That intelligence supports precise fraud.

Step 7: A genuine transaction becomes the next target

The criminal may change banking instructions within an active invoice thread. The request appears to come from a known participant using the expected language.

Another option is issuing a false refund request after claiming overpayment. Shipping or service decisions can also be manipulated through fabricated settlement evidence.

By the time anyone examines the original phishing attachment, the page may be offline. Mail logs and account settings provide the stronger evidence trail.

Invoice, Payment, Attachment, and Mailbox Verification Checks

Match the notice with an actual receivable

Search the accounting system for the payer, open invoices, expected amount, currency, and due date. A legitimate remittance should resolve to a specific ledger entry.

Ask the account owner or sales contact whether payment was expected. They should recognize both the customer and the reason for settlement.

No match means the file should not be opened for discovery. Report the email and preserve its full headers for investigation.

Do not assume another department initiated the transaction. Confirm ownership explicitly before the message moves deeper into the organization.

Confirm cleared funds through the receiving bank

Access the bank using an established bookmark or approved application. Compare the actual credit with the alleged sender, amount, date, currency, and reference.

A screenshot, PDF, or SWIFT-themed copy is supporting material at most. The recipient’s bank ledger remains the authoritative source for available funds.

Contact the bank through a verified number when status is unclear. Never use contact information supplied by the unexpected sender.

Delay shipping, refunds, credit release, or expensive work until reconciliation is complete. Urgency from an unknown payer should not override controls.

Examine the sender and attachment path

Expand the full sender and Reply-To addresses. Compare their domains with the customer records already stored by the business.

Continue an established conversation or call the known contact. A newly introduced signature and telephone number cannot verify themselves.

Treat PDFs as containers, not proof of safety. Inspect whether links leave the document and which registered domain receives the browser.

Security teams can examine suspicious attachments in isolation. Finance employees should not use production mailbox credentials to test whether a viewer is genuine.

Protect mailbox authentication from document prompts

An invoice viewer has no legitimate reason to collect an email password on an unrelated host. Close the page when the domain does not match the identity provider.

If an approved cloud service is named, sign in through its known site first. Locate the shared file inside the existing account.

Pay attention when the password manager refuses to autofill. That behavior often indicates the current host differs from the saved login destination.

Require phishing-resistant multifactor authentication where possible. Strong authentication helps, but employees must still reject unexpected approval requests.

What to Do if You Have Fallen Victim to This Scam

Separate the incident into actions taken: opening a PDF, visiting the viewer, submitting credentials, approving authentication, or acting on the supposed payment.

1. Stop the conversation and document workflow. Close the viewer, do not reply, and do not release goods, credit, services, or refunds.
2. Change exposed credentials. Use the genuine email provider from a trusted device, then replace reused passwords on other accounts.
3. Remove persistent access. End sessions, revoke unfamiliar applications, delete unknown devices, and reset recovery or application-password settings.
4. Audit mailbox configuration. Review forwarding, rules, delegates, signatures, automatic replies, deleted items, and recent outbound messages.
5. Escalate financial checks. Alert finance leadership, confirm recent beneficiary changes, and contact banks about suspicious or misdirected payments immediately.
6. Notify commercial partners. Warn customers and suppliers whose invoices or conversations may have been exposed or manipulated.
7. Inspect affected systems. Run a full Malwarebytes scan after opening attachments. Use AdGuard to reduce malicious advertising and unsafe page exposure.
8. Preserve evidence. Save original messages, headers, PDFs, page addresses, login logs, screenshots, payment records, and the incident timeline.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Free — one of the most trusted malware removal tools available.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.

Stay Protected: Block Ads and Malicious Sites

Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

Administrators should search across mailboxes for identical subjects, attachment hashes, sender infrastructure, and viewer domains. A single report may reveal a wider delivery.

Monitor payment threads after account recovery. Criminals can use previously copied details long after their direct mailbox access has been removed.

Frequently Asked Questions

Does an MT103 attachment prove a customer paid?

No. Documents can be fabricated or describe unsettled activity. Confirm the credit in the receiving bank account and reconcile it with the correct invoice.

Why does the message omit invoice numbers and amounts?

Generic wording lets one campaign reach many organizations. It also encourages recipients to open attachments to discover information a real payer should already provide.

Can a PDF attachment steal my email password?

The PDF may lead to a counterfeit login page. Credential theft occurs when information is submitted there, although downloaded files still deserve security inspection.

What if the fake viewer displayed my exact email address?

The link can carry that address as a parameter. Prefilling a public or targeted address does not establish legitimate authentication.

Should I tell the sender that no payment arrived?

Use a verified customer contact or existing thread, not the new message. If no matching receivable exists, report the email instead.

Could a real customer’s mailbox have sent the phishing email?

Yes. Compromised accounts can distribute malicious attachments. Verify the payment separately even when the visible sender has communicated with you before.

The Bottom Line

The due invoices payment email scam disguises a credential trap as routine remittance work, using SWIFT language, PDF attachments, and a locked financial preview.

Match every payment with a real receivable and bank credit before opening unfamiliar files. No legitimate remittance requires a mailbox password on an unrelated website.