Clone Websites Trick Firms Into Paying Fake Invoices

How the attack worked

This campaign relies on cloned websites that copy the look, content, and branding of real companies engaged in international trade. The only changes are to contact details and bank account information, which are altered to route communications and payments to the attackers instead of the legitimate supplier. Victims are drawn in through cold calls, phishing emails, and these fraudulent corporate websites, then guided through what looks like a normal sales process: a commercial offer, a contract, and finally an invoice requesting an advance payment for goods that do not exist.

In some cases, hired sales representatives make the initial cold call and then hand the deal off to a supposed senior manager once negotiations near the payment stage. From that point on, all communication is with the fraudsters, who supply convincing documentation, including offers and contracts on what appears to be official letterhead, with only the payment details swapped out.

Why it succeeded

The scheme works because the documentation looks complete and authentic. Attackers prepare a full set of business paperwork designed to build confidence and mirror a genuine transaction. Because the cloned website and communications closely resemble the real supplier, victims have little reason to suspect anything is wrong until the payment has already gone to a fraudulent account. The reliance on an advance payment model for international goods purchases also creates a natural point where money moves before the buyer ever receives a product to inspect.

What to watch for

• A website that resembles a known supplier but uses a slightly different or lookalike domain name
• Contact details in an email or on a website that differ from previously known legitimate information
• An unexpected cold call that quickly escalates toward a contract and payment request
• A handoff mid-negotiation to a new contact, such as a "senior manager," right before payment terms are finalized
• Invoices or contracts referencing bank details for a "subsidiary" that cannot be independently confirmed

How to build resistance

• Independently verify supplier contact details and bank account information through a trusted, previously established channel, not the one provided in a new email or website
• Treat complete-looking documentation, such as offers, contracts, and invoices on official letterhead, as something to verify rather than accept at face value
• Apply extra scrutiny to any advance payment request tied to international purchases, especially when the relationship began through a cold call or unsolicited email
• Train procurement, finance, and sales-facing staff to recognize these red flags, since these teams are the primary targets of this type of fraud

How do cloned supplier websites lead to fraudulent payments?

Attackers copy content from a legitimate company's website onto a lookalike domain, altering only the contact details and bank account information so victims unknowingly send advance payments to the fraudsters.

What roles are most at risk from this fake invoice scheme?

Procurement, finance and accounts payable, supply chain, and sales staff who handle vendor communications and payment approvals are the primary targets.

How can a company verify a supplier invoice is legitimate?

Independently confirm contact details and bank account information through a trusted, out-of-band channel rather than relying on the details listed in the email or website that initiated contact.

Why do cold calls play a role in this fraud?

Some campaigns use sales representatives to cold-call potential customers and then hand the negotiation off to a supposed senior manager right before payment, adding a layer of social pressure and legitimacy.