Digital Safety

What to do with an invoice you were not expecting

Estimated Reading Time =

2 minutes

Technical Level =

Basic

Threat Level =

Medium

Attack Type =

Phishing

Editorial illustration for what to do with an invoice you were not expecting

What you will learn

What you will learn

An invoice can look routine while naming the wrong beneficiary or describing work that was never agreed. Check the business context and destination before paying.

An unexpected invoice asks for a business decision, not merely an email response. Before paying, establish whether the purchase exists, whether the sender is the correct supplier, and whether the destination matches approved records. A convincing attachment does not answer those questions.

Understand the idea

Match the invoice to a real order and the person responsible for it. Verify new or changed bank details through a separately held contact route. If the invoice does not fit normal work, keep the payment paused while the owner checks it. Urgency should not remove the approval process.

A simple way to follow the process
  1. Match

    Compare the invoice with an actual order or agreement.

  2. Verify

    Confirm unfamiliar or changed details with a known contact.

  3. Approve

    Review the exact payment destination before release.

A practical example

For example, an NGO receives a hosting invoice days before a claimed service cutoff. The operations lead checks the existing provider account directly and finds no matching charge. The team contacts the provider through its usual support route rather than paying from the attachment.

Visual guide: What to do with an invoice you were not expecting
Compare the invoice with an actual order or agreement. Confirm unfamiliar or changed details with a known contact. Review the exact payment destination before release.

What to do next

  1. Keep the original invoice and message, but do not open unexpected attachments simply to investigate.
  2. Check the invoice number, dates, goods or service, tax details where relevant, and whether it duplicates something already paid.
  3. Confirm the purchase with the internal owner using an established contact route.
  4. Verify beneficiary changes with the supplier through previously approved contact details.
  5. Use the normal independent approval process and record the evidence before paying.

How to check the result

Keep the invoice, claimed supplier, amount, and verification result. Where a payment was already sent, contact the bank or payment provider promptly with the exact transaction details.

The invoice uses a supplier’s real logo and email thread.

Check the order and independently verify any change. Familiar formatting and conversation history do not prove that the sender or payment destination is legitimate.

Sources and useful guides

The following resources provide background and more detailed guidance. Use the sections that match your service and situation.

Scroll to Top