Experience IT EXPERIENCE IT 078 247 2221 support@experience-it.co.za WhatsApp
Staying Safe Online

Is This Email Real?
Spotting a Fake Invoice

Criminals send emails that look exactly like they came from a supplier you know — asking you to pay an invoice into a new bank account. Here is how to check, in under a minute, before any money moves.

A 5 minute read
Anyone can follow this
Any device

🛑 If you remember one thing, make it this

Never change where you send money because an email told you to.

Bank details changing is the scam. If an invoice arrives with a new account number — even from a supplier you have paid for years — phone them on the number you already have and ask. Not the number in the email. The one in your phone, on their website, or on an older invoice.

Why these emails fool people
1
The trick

The name you see is not the address

Every email has two separate parts to the sender: the display name and the actual address. The display name is just text — the sender types whatever they like. Anyone in the world can send an email that shows up as Standard Bank or the name of your own bookkeeper.

Most email programs show only the display name to save space. That is exactly what the scammer is counting on.

What you see at a glance
EI
Experience IT
Today, 09:14
Invoice INV-20418 — updated banking details
What is actually there once you look
EI
Experience IT
accounts@experience-it-invoices.co.za
Invoice INV-20418 — updated banking details
Good morning,

Please note our banking details have changed as of this month. Kindly use the account below for all future payments. Payment is due today to avoid your account being placed on hold.

The name matched perfectly. The address did not. Our real address ends in experience-it.co.za — this came from experience-it-invoices.co.za, a domain a criminal registered last week because it reads convincingly.

Yes, people do impersonate us We have used our own name in this example on purpose. If you ever get an invoice or a request for payment that appears to be from Experience IT, apply exactly the same check — and phone us on 078 247 2221 if anything looks off. We will never mind.
How to see the real address
2
On your device

Tap or click the sender's name

In every email program, the real address is one tap away. You are looking for the part after the @ — that is the only bit that cannot be faked without owning that domain.

📱 iPhone & iPad

Tap the sender's name at the top of the email. The full address appears underneath it.

🤖 Android

Tap the sender's name, or tap the small arrow to the right of the subject line to expand the details.

🖥️ Outlook on Windows

Hover over the sender's name and the address appears. Or double-click the name to open their contact card.

🌐 Webmail in a browser

Click the sender's name or the small arrow beside it to expand the full header.

Do this before you act, not after Make it a habit for any email about money — an invoice, a payment, a refund, a change of details. Five seconds, every time.
3
Read it carefully

Look-alike addresses are designed to pass a glance

Once you can see the real address, read it slowly — character by character, right to left. These are all real tactics:

✔ The real one
accounts@experience-it.co.za
Our actual domain.
✖ Extra words
accounts@experience-it-invoices.co.za
A brand-new domain that borrows the name.
✖ Swapped letters
accounts@experlence-it.co.za
A lower-case L in place of the i. Identical at a glance.
✖ Different ending
accounts@experience-it.com
Right name, wrong ending — a completely different owner.
✖ Name in the wrong place
experience.it.accounts@gmail.com
A free mailbox. We have our own domain.
✖ Real name, fake domain
accounts@experience-it.co.za.billing-secure.com
The real name is there — but the actual domain is the last part, billing-secure.com. This is why you read right to left.
The reply trap Sometimes the From address is genuine but the Reply-To is not — so the moment you hit Reply, your answer goes to the criminal instead. If something feels wrong, do not reply. Start a brand-new email using the address you already have saved.
The warning signs
4
Six things scammers do

Any one of these is worth a phone call

  • 1Banking details have changed. The single biggest one. Legitimate suppliers change banks rarely, and never announce it only by email.
  • 2You are being rushed. "Due today", "final notice", "account will be suspended". Urgency exists to stop you checking.
  • 3It is about money you were half expecting. Scammers watch for real invoices and time their fake around them.
  • 4The greeting is oddly generic. "Dear Customer" or "Dear Sir/Madam" from someone who normally uses your first name.
  • 5The attachment wants something. A PDF that asks you to click through and "sign in" to view it. Real invoices just open.
  • 6It asks you to keep it quiet or to deal only by email. No honest request ever needs secrecy.
The one that catches business owners An email that appears to come from you — the owner or a director — telling your bookkeeper to make an urgent payment while you are "in a meeting" or travelling. Agree now, with whoever handles your payments, that any change to payment details or any urgent transfer gets verified by phone. Every single time, no exceptions, no offence taken.
What to do
5
If you are unsure

Stop, and verify a different way

  1. Do not reply, click, or open the attachment. Leave the email alone.
  2. Phone the company on a number you already trust — from your own contacts, an older invoice, or their website. Never a number in the suspicious email.
  3. Ask them plainly: "Did you send me an invoice today, and have your banking details changed?" It takes thirty seconds and nobody minds being asked.
  4. Tell whoever handles your payments to hold, so nothing goes out while you check.
  5. Send it to us if you would like a second opinion — forward it to support@experience-it.co.za. We would far rather look at ten harmless emails than clean up after one real one.
6
If money has already gone

Move fast — the first hours matter most

Payments can sometimes be recalled if the bank is told quickly enough, before the money is moved on. Do not wait to see if it sorts itself out.

  1. Phone your bank immediately and tell them it was a fraudulent payment. Ask them to attempt a recall.
  2. Phone the real supplier so they know their name is being used — other customers are probably being targeted too.
  3. Keep the email. Do not delete it. The bank and the police will want it.
  4. Report it to the SAPS and get a case number — your bank and your insurer will ask for one.
  5. Change the password on the mailbox that received it, and phone us so we can check nothing else has been touched.
It is not a stupid mistake These emails are convincing, well written, and timed deliberately. Careful people fall for them every week. What matters now is speed, not blame.

Not sure about an email?

Forward it to us and ask. There is no charge for a second opinion, and no such thing as a silly question when money is involved.

Monday to Friday, 08:00–17:00

Call 078 247 2221
© Experience IT — Klerksdorp, North West Home All guides 078 247 2221 · support@experience-it.co.za