Someone is sending fake invoices in our company's name. What can we do?

First find out how they do it, because the response differs. If the messages carry your own domain without passing through your mail servers, you need e-mail authentication: SPF, DKIM and a strict DMARC policy, so that receiving servers reject the forgeries. If they come from a lookalike domain, with one letter changed for example, you can file an abuse complaint with the registrar and the hosting provider, and consider registering the most obvious variants yourself. If they come from your real mailbox, it has been compromised and you have an incident to handle: reset it, revoke its sessions, check its inbox rules. In every case, warn your customers through a channel they trust, telling them that your bank details never change by e-mail and how to verify; report the fraud to the police; and keep the samples with full headers. Your customers' finance teams will be grateful for a clear warning.

← All 29 questions on Phishing and e-mail aftermathAll topics