Invoices are going out in your name from a web address that isn’t yours.
A customer forwards an invoice. Your logo, your wording, a payment address, and a sender domain that differs from yours by one letter, one extra word, or a different ending. Or the reverse: an invoice reaches your office from a supplier’s name on a domain that is almost theirs.
You pay for email, you have a password and a sign-in approval, and that’s handled. Those protect your domain’s mailboxes. They never cover a different domain that someone else registered, because that domain is not yours. Nothing inside your account has to be wrong for this to happen.
Read the sender line before anything else
The Federal Bureau of Investigation’s guidance names the habits that catch this: be alert to hyperlinks that contain misspellings of the actual domain name, confirm that the sender’s address matches the sender it claims to be, and check this on a phone, where long addresses get cut off. It also recommends setting company computers to show full email extensions, so the whole address is visible.
- Open the message and read the full sender address letter by letter, not only the display name.
- In Outlook on the web or the new Outlook, open More actions, then View, then View message details to read the headers. In classic Outlook, open the message in its own window, then File, then Properties. Look for a Reply-To address that differs from the sender.
- Compare the invoice to your records: the invoice number, the order or job it refers to, the amount, and the payment instructions. The Federal Trade Commission tells staff to check all invoices closely, and notes that scammers send invoices for products or services a business never ordered.
Look up who registered the domain
The Internet Corporation for Assigned Names and Numbers runs a public registration lookup at lookup.icann.org. Type in the look-alike domain. Registration data, such as the registrar, can appear there, though much contact information is hidden for privacy. Write down what you see and the date you looked.
A domain that was registered recently and differs by a letter from yours is a sign worth recording. It isn’t proof by itself, and the lookup tells you nothing about who is behind the domain.
What you can and can’t do about the domain itself
- You can’t shut it down. It belongs to someone else. You can report it to the registrar the lookup names, and the evidence you saved gives them something to act on.
- You can register the close variants of your own domain so nobody else can. The FBI’s 2016 guidance recommends registering all company domains that are slightly different from the real one.
- You can report it. File a complaint at ic3.gov, whatever the dollar amount, and at ReportFraud.ftc.gov. Forward the phishing email itself to reportphishing@apwg.org, the address the FTC gives for phishing email.
Tell your customers, and tell them how
Call the customers who got the invoice, and pick up the phone yourself. The FTC’s guidance to a business that has been impersonated is to notify customers quickly, send the message without hyperlinks, and restate your policy on payments. For example: you only accept payment at the instructions printed on invoices that come from your own addresses, and you will never email new bank details.
Put one line on your own invoices and your website saying where invoices come from and how to confirm one by phone. Customers who already paid the wrong invoice need a different page: money sent to a fraudster.
What these checks can and can’t tell you
Reading the headers tells you where the message says it came from. It doesn’t show whether your own mailbox is clean. If a customer reports a message that came from your real address as well, that is a separate problem and a separate page.
When we look at this with you, we check your mailbox’s rules and sign-in history to see whether anything happened inside your account, and we check the mail records that say who may send as you. The answer to the first question is either “nothing inside the account” or a specific entry with a date, and we say which.
A look-alike domain sits outside your account, so the work is on the domain, your customers, and the people who pay your invoices.
Related
Sources
- FBI Internet Crime Complaint Center: Business Email Compromise (PSA 240911)
- FBI Internet Crime Complaint Center: BEC, The $50 Billion Scam (PSA 230609)
- FBI Internet Crime Complaint Center: Business Email Compromise (PSA 160614)
- Federal Trade Commission: Run a small business? Pay your bills, not scammers
- Federal Trade Commission: Cybersecurity for small business, business email imposters
- Microsoft Support: View internet message headers in Outlook
- ICANN: Registration data lookup tool
Talk to a person about what you noticed.
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.