The fake invoice had no spelling mistakes

Over three days in August, more than a million fraudulent emails went out to businesses in a single campaign.

Each one looked like an ordinary bit of office admin. An invoice from a real IT supplier, with an invoice number, an issue date, a due date, a currency and an amount — nearly $50,000, payable by bank transfer. The sender’s name was the recipient’s own chief executive. So was the name in the signature, and the name on the reply address.

Underneath sat a short email thread: a couple of senior people in the company discussing the invoice and agreeing it should be paid. None of those people had written any of it. The supplier’s web address was a lookalike — the real name with a couple of extra bits bolted on, close enough to pass at a glance.

How they knew a machine had written it

The security researchers who unpicked the campaign found the usual signs of a generated template: an oddly uniform structure, neatly labelled sections, verbose notes left in the code — and heavy use of the long dash.

We should admit that this blog uses rather a lot of those, and invite you not to judge us by that test. Which is exactly the point.

The old tells are gone. For years the advice was: look for the spelling mistakes, the stilted English, the strange greeting. That advice was never great, and now it is actively misleading. Generated fraud is fluent. It is polite. It gets your supplier’s invoice format right. A clumsy email is now less likely to be a scam than a perfect one.

Small businesses are on both sides of this

The numbers from the UK banking industry’s annual fraud report give a sense of scale: £576.4 million lost to scams where people were tricked into sending payments in 2025, up 19%, across nearly a quarter of a million cases. Of that, £75.6 million was business money.

And a small business meets this fraud from two directions.

As the payer. A “supplier” emails to say their bank details have changed. The email is from what looks like their address. The invoice matches the last one. You pay it, and the real supplier is still waiting for their money a month later.

As the name being used. This is the half people forget. Fraudsters don’t only pretend to be suppliers to you. They pretend to be you — to your customers. Your logo, your invoice layout, your sign-off, a lookalike of your email address, and a polite note that “our bank details have changed.”

Your customer pays a stranger. Then they ring you, upset, and ask why you have not sent the goods.

The defence is not better spotting

The instinct is to train yourself to recognise fakes. That race is lost — the fakes are getting better faster than people get better at spotting them.

What works instead is boring, procedural, and almost completely immune to how well an email is written:

Never act on a change of bank details that arrives by email. Ring the person on a number you already had — not one in the email.

That single rule defeats almost every version of this, because the fraud only works if the money moves before anyone talks out loud. A fluent email cannot answer a phone call to a number it did not supply.

And for the half where somebody is pretending to be you, the fix belongs on your website.

The sentence your website should say

Put it somewhere your customers can find it — on your contact page, on your payment or terms page, near your bank details if you publish them:

We will never change our bank details by email. If you ever receive a message saying we have, please don’t pay it — ring us on the number on this page.

That sentence does three jobs at once. It warns your customers before the fraud reaches them, rather than after. It gives them a number to check against that didn’t come from the email. And if a customer is ever caught out anyway, it is on record that you told them how to stay safe.

It costs nothing. Almost nobody has it.

The fair question

devkoi builds the pages; it does not run your email, your bank account or your domain’s security settings, and it cannot stop anyone sending an email that pretends to be you.

What it can do is the website half, which is the half a small business can actually control: put the warning where customers will read it, and make sure the phone number they will check against is right, prominent and on every page.

What to do this week

1. Add the bank-details sentence to your website. Today. It is one message.

“Add to the contact page and the footer: ‘We will never change our bank details by email. If you get a message saying we have, don’t pay — ring us on 0123 456 7890.’”

2. Make sure your real phone number is on every page, as text. That number is what a worried customer will check against. If it is missing, or buried in an image, they will use whatever number the fraudster gave them.

3. Adopt the rule for your own payments. Any change of bank details from a supplier: phone them, on a number from your own records or their real website, before a penny moves. No exceptions for urgency — urgency is the trick.

4. Tell your staff the old tells are dead. Perfect English, correct invoice numbers and your boss’s name in the signature prove nothing. Only a phone call proves anything.

5. Look at your own email address with a stranger’s eyes. How easy would it be to register something one letter different? It is worth asking whoever runs your email about the settings that help other businesses’ systems spot forgeries of your address — they have dull names, and they matter.

6. If you publish payment details, publish them in one place only. One page, clearly labelled, alongside the warning. A customer should never have to guess which set of numbers is real.

---

The grammar test was always a bit of a lucky break: fraudsters happened to write badly, so we learned to read badly-written things as dangerous.

That luck has run out. What replaces it is not a sharper eye but a simple habit and a sentence on a page — the kind of defence that does not care how good the forger’s English has become.