The Invoice That Wasn't
- The message is real. The account isn't.
- Call a number you already had.
- Never the number in the message.
What this episode teaches
- Payment redirection scams live inside real conversations and real payments, at work and at home, and only the destination changes
- You can't spot a redirected payment by reading the message more closely, because the message is real
- Any request to send money somewhere new gets verified by a call to a number you already had, never one from the message
Two ways to read it
If you are the one watching
This one happens at home as often as it happens at work. A contractor, a school, a vendor you have paid a dozen times. The request is real, the thread is real, the relationship is real, and the only thing that changed is where the money lands. That is why reading it more carefully does not help: there is nothing wrong with the words. Before you send money somewhere new, call the person on a number you already had, and ask. Two minutes, every time the destination changes.
If you run the program
The training instinct here is to teach people to spot a fake, and it fails, because the attacker is often inside a legitimate mailbox and the message is genuine. Detection guidance built on typos, display-name mismatches or urgency cues does not survive a compromised real account. What holds is out-of-band verification on a channel the requester did not choose, and the detail that carries the whole control is that the number must come from your own records rather than the message. Worth pairing with a policy threshold above which a callback is mandatory rather than encouraged, so the behaviour does not rest on individual judgement under deadline.
Run the whole library
A new episode every month, captioned in 14 languages, ready to drop into your own LMS. Start a free trial and take the bundle with you.
Start a free trial