Watch Out for This Sneaky Email Scam That Looks Like an Invoice or Statement

Email scams are no longer full of obvious spelling mistakes and strange offers from overseas princes. Many now look like everyday messages from companies you already know and trust.

One of the sneakiest versions going around at the moment looks like a simple “Accounts has sent you files” email. On first glance it appears to be a normal invoice or statement. For busy business owners trying to clear the inbox with a cuppa in hand, it is very tempting to click.

Here is what this scam looks like, why it works and how to protect your business.

What The Scam Email Looks Like

The example we keep seeing is very clean and professional. The subject line talked about shared files and the main message simply said “Accounts has sent you files.” There was one big View button in the middle of the email and underneath that a line that read “Expires 10/15/2025”, which is the date of the day it was sent

At the bottom there was some basic company text, but no ABN and very little else. There was no personal greeting and no mention of the business name it was sent to. The whole message tried to look like a secure document share from a real company.

Why This Email Feels Believable

This type of scam is effective because the criminals borrow just enough real detail to feel familiar. The company name can be correct and the sending email address can also look correct. The design is clean, modern and free of obvious spelling issues.

File sharing and online invoicing are now normal parts of business life. Many of us are used to suppliers emailing invoices or statements, so this message slides into the inbox looking like just another routine task. That is exactly what the scammers want.

Red Flags to Notice

There are still a number of clues that something is not quite right.

The first clue is the greeting. The email is not addressed to you by name or to your business. It just says “Accounts has sent you files.” Legitimate suppliers usually include at least your name, business name or account number.

The second clue is your own expectations. Think about your normal process with that company. Do you usually receive invoices or statements in this way Were you expecting something on that day If the answer is no, treat it as suspicious.

Another warning sign is the expiry date on the link. The line “Expires (today’s date)” is there to rush you. Expiry dates create pressure, and when people feel rushed they do not slow down to check carefully. For Australian businesses there is an extra hint, because the date is written in American format month day year. If this came from an Australian supplier you would normally expect 15/10/2025 or 15 October 2025.

The footer is also very light on details. Legitimate Australian businesses usually include an ABN, physical or postal address, phone number and website. In this scam message there is no ABN and only minimal information, or a known accounting software’s contact details, which should ring alarm bells.

Finally, notice the lack of context. The email gives you only one main option, the View button. There is no invoice number, customer reference or explanation of what the files contain. Real statements and invoices usually include at least some basic details in the body of the email.

What to Do When an Email Looks Suspicious

When something in an email feels off, even if you cannot quite say why, take that feeling seriously.

• Do not click any buttons or links
• Do not open any attachments
• Go to the company website by typing the address into your browser
• Log in to your account in the normal way and check for messages or invoices
• Call the company using a known phone number from their website, a past invoice or your records

If the company confirms they did not send it, delete the email straight away and move on.

If Someone Already Clicked

Mistakes happen, especially when people are busy or tired. If someone has already clicked the link or entered details, quick action is important. There should be no shame or blame attached to it. Create a culture where your team feels safe to speak up straight away, because speed is the essence in limiting the damage.

If someone has already clicked the link or entered details, act quickly.  Work through these steps:

• Contact your IT support or provider
• Change any passwords that may have been entered
• Let your bank know if there is any chance card or account details were shared
• Run security scans on any affected devices
• Brief your team so they know what to look out for and can spot similar emails

Fast action can reduce the damage and may stop the scam from spreading further inside your business.

Simple Ways To Protect Your Business

A few small habits make a big difference to email security. Train your team to pause before they click, especially on invoices, statements and file share invitations. Use strong unique passwords and a password manager. Turn on multi factor authentication on key accounts such as email, banking and cloud systems. Put clear processes in place for how invoices and payments are approved and talk about scams regularly in team meetings so everyone stays alert.

How CATCO Enterprises Can Help

CATCO Enterprises works with small and medium businesses across Australia and sees these scams in real inboxes every week. We help clients understand common scam types, improve basic security around websites and email, and communicate simple instructions to staff.

If you have received an email like the “Accounts has sent you files” example and are not sure what to do next, reach out. A quick conversation can help you work out the safest next step and keep your business systems as secure as possible.

Taking a moment to double check before you click is one of the best defences you have.

Do you have questions about email security?

CATCO Enterprises is here to help, contact us today on 0409 489 464 for trusted support.