The fake unpaid invoice email

This is an illustrative training example, not a real invoice from Claro or any supplier. In this scenario the email is dressed up as a routine bill from a vendor or your own finance department, with a subject line like 'Invoice Overdue' or 'Payment Required'. It usually carries a PDF attachment or a 'view invoice' link, plus a polite but firm note that payment is now past due.

The pretext leans on how ordinary invoices are. Paying suppliers is normal business, so a bill rarely feels suspicious on its own. The message adds just enough pressure, a late fee, a threatened suspension, or a note that an account will go on hold, to nudge you toward paying before you stop to check the details.

It reaches finance and operations staff in the flow of everyday work, often mixed in with genuine invoices during a busy billing period or near month-end. Because these teams handle a high volume of similar documents, one more request blends in easily, and the sender may even reference a real project or a familiar supplier name to lower your guard.

It is convincing because the trap is in the details rather than the design. The attachment might be a macro-enabled document that runs code when opened, or the link might lead to a fake payment portal. In the most damaging versions the bank account number has been quietly changed, so a routine-looking payment lands in the attacker's account instead of your real supplier's.