How to vet an unexpected invoice domain safely

An unexpected invoice attached to an email deserves careful scrutiny, even when the message appears to come from a familiar supplier. Payment redirection scams, business email compromise and phishing campaigns often use realistic branding, copied signatures and convincing PDF or Word documents to pressure recipients into acting quickly.

Trusted Sender Score can help assess whether the sending domain has a credible email identity and whether its authentication settings support the claimed organisation. The check is most useful when combined with safe attachment handling, independent verification and a clear refusal to rely on the sender’s message alone.

Pause before opening the attachment

Do not enable macros, run an executable file or enter credentials after opening an unexpected invoice. A PDF can still contain malicious links, while an Office document may request that you enable content. If the invoice is not expected, save the message for analysis and avoid clicking its payment button or contact details.

Check the visible sender name against the complete email address. A display name such as “Accounts Team” is easy to copy, and a lookalike domain may replace a letter with a similar character. A genuine Australian supplier might use a familiar .com.au address, but the domain ending by itself does not prove legitimacy.

Extract the domain carefully

Trusted Sender Score evaluates the domain rather than just the wording of the email. Copy the domain portion after the @ symbol, excluding the sender’s name, display text and any trailing punctuation. For example, in billing@example.com.au, the domain is example.com.au.

Watch for misleading subdomains and spelling variations. supplier.com.au.attacker-domain.com is controlled by the final domain, not by the name appearing earlier in the address. A newly registered lookalike domain deserves extra caution, particularly when the invoice claims to change bank details or demands same-day payment.

Run a trust and authentication check

Enter the domain into the platform’s checking tool and review its reputation indicators, domain signals and authentication results. The sender score metrics can help explain what is being measured, including trust indicators connected with sending behaviour and email configuration.

Pay close attention to DKIM and DMARC. DKIM helps verify that an authorised system signed the message, while DMARC tells receiving systems how to handle messages that fail alignment checks. A failing or missing record does not automatically prove fraud, but it weakens the sender’s claim and should increase the level of verification required.

Compare the result with the invoice

A trustworthy-looking domain does not make every message from it safe. Criminals can compromise a legitimate mailbox, abuse a poorly secured account or send a malicious invoice from an otherwise established organisation. Treat the Trusted Sender Score result as one part of the decision, not as approval to pay.

Compare the domain with previous invoices, purchase orders and supplier records held in your accounting system. For an Australian business, confirm the supplier’s ABN or ACN through an independently located source and check that GST details, business name and payment information match existing records. Do not use the phone number or website link supplied in the suspicious email.

Verify payment details out of band

Contact the supplier using a known telephone number, an existing contract or a trusted contact in your address book. A finance team in Sydney, Melbourne or Brisbane should follow the same control used for any bank-account change: obtain confirmation through a separate channel and have another authorised person review the request.

Pay particular attention to urgency, unusual language and requests to pay into a personal account or an overseas account. If the invoice relates to an Australian supplier, compare its currency, GST treatment, address and purchase-order references with normal commercial practice. A familiar logo and professional formatting can be copied in minutes.

For broader protection against copied logos and deceptive sender identities, review this impersonated brand guidance alongside the domain check. It can help teams recognise patterns that a single reputation result may not reveal.

Record the decision and escalate risk

Keep the original message, full headers, attachment hash if available and the Trusted Sender Score result. Record when the domain was checked and which verification steps were completed. This creates an audit trail for accounts staff and helps identify repeated campaigns targeting Australian organisations.

If anyone opened the attachment, entered credentials or transferred money, notify the organisation’s security or IT team immediately. Reset exposed passwords from a clean device, contact the bank through its official channel and report suspected cybercrime to the appropriate Australian authorities. Security teams managing many domains can also use API incident response to connect sender checks with alerting and response workflows.