Skip to content
CTS Field Notes

Field Notes

The Invoice Is Not the Test

A polished request is not proof it belongs in your process. Use an independent verification path before money, credentials, permissions, or sensitive data move.

CTS Companies 3 min read

The Invoice Is Not the Test

A professional-looking invoice lands in an inbox. It has the right tone, a familiar logo, perhaps even a name someone recognizes. The first question is usually visual: does this look legitimate?

That question is understandable, but it is not the one that protects a business. The better question is: does this request belong in an expected business process?

Modern phishing is often designed to pass a quick visual inspection. A convincing invoice, a security notice, or an urgent executive request may look entirely ordinary. The useful defense is not becoming a forensic email analyst before lunch. It is having a simple way to verify an unusual request without relying on the request itself.

Verification should use a path the request does not control

The common thread is simple: use a known route outside the email, text, or call that created the urgency. A process that relies on replying to the same message, clicking the same link, or calling the phone number supplied by the requester is not really independent verification.

  • Invoice or payment request: Confirm through a known vendor contact, vendor portal, or independently verified phone number—not the email thread.
  • Security alert: Open the actual product or service directly through a bookmark, app, or known URL. Do not use the alert’s link to find out whether the alert is real.
  • Payment-detail change: Require out-of-band confirmation with a known contact before changing banking information. FBI IC3 guidance specifically recommends a secondary channel for account-information changes.
  • Account-access request: Treat unexpected permissions, password resets, MFA changes, and device enrollment as high-risk events that need an owner and an independent check.
  • Urgent executive request: Confirm through a second channel before money, credentials, or sensitive data move. Urgency is a reason to verify faster, not a reason to skip verification.

This is less glamorous than teaching people to spot a suspicious font. It is also more durable. Brand styling changes. Attackers improve their writing. A known verification path remains useful.

Examples worth recognizing now

Several patterns are especially worth putting on a short “pause and verify” list: fake vendor invoices and payment-change notices; counterfeit security alerts using familiar product names; consent requests that open a real Microsoft or Google permission screen; and executive, support, or authority impersonation that leans on urgency. The goal is not to assume every unexpected message is malicious. It is to recognize the requests that should not be completed on trust alone.

The consent-request example deserves special attention. FBI IC3 warned in September that malicious actors can use OAuth consent phishing to direct a user to a legitimate provider’s permission screen for an application the attacker controls. If the user approves broad access, the attacker may obtain account access without stealing the password or defeating MFA. A real sign-in page is not proof that the requested application is safe.

AI raises the same underlying problem. It can help impersonators make a message, call, or video seem more persuasive, but it does not change the response: verify identity and the requested action through an independent route. IC3’s recent impersonation warnings emphasize that urgency, spoofed identities, and new technologies can be used to manufacture credibility.

A low-friction verification habit is a security control

The practical goal is not to make employees afraid to act. It is to make the safe action easy. A company should know who can verify a vendor payment change, where staff should check a suspicious service alert, and which second channel is available when a senior person sends an unexpected request.

That is a better security program than asking everyone to trust their instincts. An invoice is not the test. The test is whether the request survives the normal business process that was already supposed to protect the company.

Sources