The email has an invoice, a contract, or a “delivery note”. The attachment is named like a document, and it opens like a website page: an address bar, a button, fields for a password. An ordinary invoice file does not behave like that. You look at it as a document, without signing in to a bank on an unfamiliar site.
Do not open an attachment like that, and do not enter anything there. Write to the sender through a channel you already had: a known email, a phone from a past order, the shop app. Do not reply with a button inside this email, and do not call back a number that exists only in it.
What happens
The file pretends to be an invoice, and inside there is a link or a small page. The browser opens it as a site. Next they ask you to sign in to mail, to a bank, or to “confirm receipt”. A login on this page goes the wrong way. A real invoice from a person you work with can be sent again to the usual address, without a surprise in the form of a site.
The sender’s name in the email header is easy to set as someone else’s. Look at the address after the name, but even a familiar address is not a reason to open a strange attachment: the mailbox may have been used by someone who is not yours, or the letter was faked so the name is off by one letter. The check is not the attachment. It is a separate contact you type yourself.
An archive with a password in the text of the email is also not opened “out of curiosity”. A password next to the file does not make the file an invoice. If you are waiting for a document from accounting or from a shop, go into their account yourself, or ask them to send it again to the mail you have already been writing with for a month. Leave a new conversation with a page-attachment closed.
The phone shows the attachment right inside the mail app. It is especially easy there not to notice that a site opened. If you see an address bar and input fields, close it. Do not enter a card or an SMS code. A mail password is never entered on a page from an email: mail does not ask for the password that way. It asks for it on its ordinary sign-in screen, which you opened yourself.
If you already entered a password, change it by going into mail or the bank on your own, not by the button from that email. If mail shows sign-ins, close the sessions that are not yours. Do not press a link “to cancel the sign-in” from the same email.
Which attachment can still wait
Even an ordinary document from an unfamiliar address can stay unopened until you understand whether you were waiting for an invoice. Urgency in the subject is not a reason. A shop where you really bought something shows the order in the app. No order in the app means you do not pay the attachment and you do not confirm it.
Forwarding an email like that to a colleague with “look what this is” moves the trap to them. Do not forward it. Say briefly: a strange attachment arrived, I will not open it, check the order in your own account.
The phone and the computer open an attachment differently, and the risk is one. On the phone the page hides in the mail window. On the computer the address bar is visible. In both places you do not enter a password. If mail itself showed a warning, do not press “open anyway”. The warning is exactly about this case. You do not walk around it out of curiosity.
An old supplier you really are waiting on for an invoice will send it again if you write to the address from the previous letter, typed by hand. One delay of a day is more honest than a sign-in on someone else’s site. An invoice that is not in your correspondence for a month can simply stay unopened.
A phone signature at the end of the letter with a new mobile number does not replace the old channel. Dial the number that was on previous invoices, if you have it written down. A digit that appeared only today under a page-attachment leads to the author of the letter, not to your accounting.
What to check, in order
- Do not open an attachment that leads to a website page instead of a document. Close the window if it already opened.
- Do not enter a mail password, a bank password, a card number, or an SMS code on this page.
- Write to the sender through the old channel: mail you have written with before, or the app where the order is visible. Not by the button from this email.
- Do not call back a phone that exists only in the suspicious email.
- If the order is yours, find it in the shop app yourself. No order means there is nothing to pay from the attachment.
- If you already entered a password, change it with your own sign-in and see whether there are sessions that are not yours.
- Do not forward the email to colleagues. Let them check their own account separately.
- Do not turn the antivirus off because of this email, and do not run “treatment” programs from the attachment.
Where people usually go wrong
- They open it because the subject says “invoice” and a familiar name is there.
- They enter a mail password on the page that opened from the file.
- They reply in the same email and receive another link.
- They pay by the button on this page, without looking in the shop app.
- They forward the file to an office neighbor “just in case”.
An attachment that opens as a site is not a normal invoice. Do not open it, and do not enter anything there. Ask the sender through a channel you already had.
What to do today
Leave the email closed. If the file already opened as a page, close it and do not enter passwords. Check the order or the invoice in the app, or write to the old address you type yourself. If you managed to enter a password, change it with a separate sign-in. Do not forward the file further around the office.
The same trap can be a short link in an SMS: a link that asks you to confirm a payment.
