![\"Illustrative](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/10\/jnj.png\" "\\"\\"")
<\/figure>\nOverview<\/h2>\nA recognizable buyer is used to attract suppliers<\/h3>\n
The Johnson & Johnson quotation request email scam impersonates corporate procurement. It approaches a business as a potential customer rather than threatening the recipient with an account problem.<\/p>\n
The reported request names an ND-FlowShield WTW-305 pump and asks for 40 units. Replies are directed to quotes@jnj-supplies[.]com.<\/p>\n
Johnson & Johnson is a genuine company with genuine supplier relationships. This warning concerns the fraudulent approach using its identity, not the company’s procurement operation.<\/p>\n
A formal PDF makes the request look procedural<\/h3>\n
A document named J8J Product descriptions.pdf accompanies the message. The request asks for commercial information such as prices, lead times, delivery conditions, and quotation validity.<\/p>\n
Those are normal subjects for an RFQ. Their presence does not verify the sender, establish a purchase commitment, or authorize a supplier to bypass customer checks.<\/p>\n
The image above is an original illustration of the document format, not the campaign’s PDF. Its example address is deliberately nonfunctional.<\/p>\n
The risk begins with accepting a false buyer identity<\/h3>\n
The opening request draws the supplier into correspondence. Later requests for sensitive information, payments, or special purchasing arrangements are possible escalations, not transactions demonstrated by the initial document.<\/p>\n
- \n
- A large buyer’s name encourages the recipient to treat the inquiry as a valuable lead.<\/li>\n
- A technical item description gives sales staff something concrete to quote.<\/li>\n
- A separate reply domain can channel correspondence away from established company contacts.<\/li>\n
- A PDF, signature block, or tax reference can be copied into fabricated paperwork.<\/li>\n
- Business details shared during quoting can help an impersonator make the next approach more convincing.<\/li>\n<\/ul>\n
Do not submit a quotation or payment through this approach. First establish whether the real company initiated the request, using a contact route the email did not supply.<\/p>\n
Why a Fake Customer Can Be More Persuasive Than a Fake Bill<\/h2>\n
Sales teams are supposed to respond to new opportunities. An unsolicited inquiry is not automatically suspicious, and many genuine customers begin with an email.<\/p>\n
That ordinary openness is what makes procurement impersonation effective. The recipient may be rewarded for responding quickly, especially when the request names a recognizable organization.<\/p>\n
The sender also gives staff a task they know how to complete. They can check inventory, request pricing, estimate shipping, and prepare a professional response.<\/p>\n
Each task invests more time in the opportunity. Once several colleagues are involved, stopping to question the buyer can feel like losing work already done.<\/p>\n
A precise model number makes the request look informed. But specificity is not the same as authenticity, and a plausible product name does not prove a buyer needs it.<\/p>\n
This distinction is especially important if your business does not sell the requested item. An unexpected specification should prompt questions, not a rush to source it.<\/p>\n
A fake prospect can exploit helpfulness as easily as fear. You can remain welcoming to new business while insisting on independent verification before taking consequential steps.<\/p>\n
The useful question is not whether a multinational might buy pumps. It is whether this particular person is authorized to make this particular request.<\/p>\n
How the Johnson & Johnson Quotation Request Scam Works<\/h2>\n
Step 1: An apparent procurement manager introduces an order opportunity<\/h3>\n
The sender adopts the role of a purchasing professional and presents a formal RFQ. That role gives the message an immediate business purpose.<\/p>\n
Instead of asking for money at once, the opening asks the supplier to demonstrate capability. A quotation feels like a low-risk way to begin a relationship.<\/p>\n
The claimed manager’s identity should be treated as unverified. A real person’s name, if copied, would not establish that the person sent or authorized the message.<\/p>\n
Before responding, check your customer records and ask the relevant account owner whether there is an existing relationship with the supposed buyer.<\/p>\n
A familiar company name is a reason to verify carefully, not a reason to skip verification.<\/p>\n
Step 2: The attachment supplies the appearance of a real tender<\/h3>\n
The document adds structure to the request. Commercial fields and submission conditions make it resemble paperwork that has already passed through an internal procurement process.<\/p>\n
That presentation can encourage staff to focus on compliance with the form rather than the legitimacy of the person sending it.<\/p>\n
A PDF is a container for content, not a certificate of authenticity. Anyone can create one with a company name, address, and signature block.<\/p>\n
Do not follow a document’s link into a new login page or install a viewer it recommends. A quotation task does not justify surrendering mailbox access.<\/p>\n
No specific malware was established in this reported attachment. Keep file safety separate from the equally important question of whether the buyer is genuine.<\/p>\n
Step 3: The reply destination becomes the center of the relationship<\/h3>\n
The requested quotation goes to a domain that resembles the company’s initials with an added supplies label. That resemblance is meant to feel commercially plausible.<\/p>\n
A domain can include an organization’s initials without belonging to it. Do not infer affiliation from spelling, a logo, or the fact that email reaches the address.<\/p>\n
Compare the destination with contacts obtained through the company’s independently opened website. Ask the real organization to confirm the request and communication channel.<\/p>\n
Do not ask only the suspicious sender to confirm their own address. They can answer yes and provide another document using the same fabricated identity.<\/p>\n
An ordinary website at the domain, if one appears, would not settle the matter either. A web page and a mailbox can be built to support the same story.<\/p>\n
Step 4: The supplier may reveal information or accept new conditions<\/h3>\n
A quotation can disclose staff names, direct telephone numbers, pricing, stock levels, bank instructions, and business identifiers. Not all of that belongs in an unverified first reply.<\/p>\n
Much of this information may be routine within an established relationship. In an impersonation, it can help someone tailor later requests to your actual business.<\/p>\n
If the supposed buyer introduces an administrative fee, special registration payment, or unusual purchase requirement, stop and verify before proceeding.<\/p>\n
Those are potential next stages of procurement fraud. The initial RFQ does not prove that any particular fee, account, or intermediary was already used.<\/p>\n
Never let a promising order become the justification for paying a stranger simply to keep the opportunity alive.<\/p>\n
Step 5: Commercial pressure can override normal approval controls<\/h3>\n
A fast-moving exchange can create the impression that approval is nearly complete. Staff may feel that only one document, payment, or supplier arrangement remains.<\/p>\n
Keep your usual separation between sales, finance, purchasing, and shipping. An email conversation should not authorize all four functions by itself.<\/p>\n
A supposed purchase order also needs verification before goods leave your control. Check the customer, delivery location, payment terms, and any last-minute changes.<\/p>\n
If a request turns out to be fraudulent, stop the workflow across the team. A colleague should not continue sourcing or dispatching after another person spots the problem.<\/p>\n
The goal is to end reliance on the false customer identity before it becomes a financial or operational loss.<\/p>\n
Buyer Identity, Reply Domain, and Document Checks<\/h2>\n
Use the real company’s supplier resources<\/h3>\n