Security Training
The Invoice Your CEO Never Approved
What Is Happening
An email reaches the people who pay the bills. It shows your CEO's name, says the invoice below is approved and asks for the bank transfer. Under the signature sits a tidy vendor invoice and a short forwarded exchange between your CEO and the vendor.
Microsoft took this exact setup apart in a report dated September 10, 2026. The scammer wrote all of it, and the bank details on the invoice belonged to the scammer. One campaign sent more than a million of these emails in three days in August.
Microsoft also saw signs that AI tools helped build the emails, so clean grammar and correct logos no longer suggest a message is real. Judge a payment request by how it was confirmed, not by how it looks.
Sources
- Microsoft Security Blog, September 10, 2026Protecting Organizations from AI-Assisted Executive Impersonation and Invoice Fraud
- Microsoft Security Blog, November 5, 2026Email Threat Landscape, Q3 2026 Trends and Insights
Want This for Your Whole Team?Ask us about security awareness training for your staff.
Ask About Awareness Training