RFQ Phishing Targets Sales and Procurement

Attackers are using short business emails that ask companies to provide a quote for an upcoming project. The messages imitate ordinary request-for-quotation (RFQ) activity, then direct recipients to credential-stealing pages. The tactic is especially risky because sales and procurement teams routinely handle these types of requests.

Key findings

• Attackers are using brief RFQ-themed emails to target business email accounts.
• The lure asks whether the recipient’s company can quote for an upcoming project.
• Fortra researcher Cadence Riddle recorded a 12-fold increase in malicious emails mentioning “RFQ” between October 2025 and September 2026.
• Nearly 73% of the observed RFQ lures directed recipients to pages designed to steal login credentials.

Who’s being targeted

• Commonly targeted roles: Sales, Procurement, Business development, Account managers, Finance teams that support bids and quotations.
• Affected industries: Professional services, Sales organizations, Procurement functions, Business-to-business companies.
• Attack channels: email, website.
• Impersonated: Prospective customer or business buyer.

Awareness takeaways

• Treat unexpected quote requests as unverified until the sender and business opportunity have been checked through a known contact method.
• Do not enter work credentials into an RFQ or project portal reached from an unsolicited email; independently navigate to known customer or vendor portals instead.
• Train sales and procurement staff specifically on RFQ fraud because the volume of this lure has risen sharply.

Red flags to watch for

• An unsolicited RFQ is unusually short and lacks normal project or buyer details.
• The request directs the recipient to a login page before providing specifications.
• The sender and linked site do not match a known customer or established procurement portal.