RED FLAGS Fake invoices may come from lookalike domains, unfamiliar vendors, changed payment instructions, vague descriptions, unexpected attachments, or urgent payment language. VERIFY Compare vendor name, invoice number, purchase details, bank information, and sender address against trusted records. DO NOT PAY FROM EMAIL ALONE Payment changes and urgent invoice requests should be verified through an approved process or known vendor contact. WHAT TO DO Report suspicious invoices and avoid forwarding them broadly. Include the original email, attachment name, and any payment deadline stated. COMMON SCAM Attackers may reply to real threads after account compromise, making the message look legitimate. Still verify payment changes.