Someone sent a fake invoice from our email address. What do we do?
Warn the client before they pay, by phone. Then find out how it was sent. Either your address was forged from outside, which a DMARC record at reject stops, or someone signed in to one of your mailboxes, which means changing that password and checking its rules.
Last read from the sources at the foot of this page.
What does it mean for a business?
A fake invoice from your address asks your client to pay a new account. The Canadian Anti-Fraud Centre describes the pattern.
it may look like an email from existing contractor providing new payment directions and requesting payment of an invoice.
Was the address forged or was a mailbox broken into?
Look in the Sent folder of the person it appears to come from. If the invoice is not there, check that mailbox for rules you did not make. The Anti-Fraud Centre warns that fraudsters set a rule to copy incoming mail to themselves.
No copy and no rule usually means the address was forged from outside.
Fraudsters will infiltrate or spoof a business or individual's email account and create a rule to send copies of incoming emails to one of their own accounts.
What should you do now?
- Phone the clients who received it.Use numbers you already have on file. Tell them not to pay.
- If a client has paid, they should call their bank at once and ask for a recall.
- If a mailbox was used, change its password, turn on two-step sign-in and remove rules and forwarding you did not set.
- If the address was forged, publish a DMARC record and move it to reject.
- Report it to the Canadian Anti-Fraud Centre or the FBI Internet Crime Complaint Center.
Where is the change made?
Your email account settings, for the password, two-step sign-in and mailbox rules. Your DNS settings, for the DMARC record that tells inboxes to refuse forged email.
What else do people ask about this?
Are we responsible if a client pays a fake invoice?
That depends on the facts and the contract. Warn clients as soon as you know. Keep a record of what you did and when. Tell your insurer if you have cyber cover.
How do we stop it happening again?
Publish DMARC at reject so forged copies are refused. Turn on two-step sign-in for every mailbox. Tell clients that you never change bank details by email.
Where does this come from?
- Canadian Anti-Fraud Centre, Frauds targeting businessesantifraudcentre-centreantifraude.caRead 16 October 2026
See what is open before anyone else does.
We read your domain from outside and show each way in with a check anyone can re-run.