Reading a Phishing Email Aimed at a Trade Shop

Why this matters

The phishing that reaches a trade shop does not look like a prince asking for help. It looks like your supply house chasing an invoice, the city asking for a permit fee, a map listing warning about a bad review, or your card processor saying payouts are paused. It is written for an office that pays suppliers weekly, files permits monthly and lives on its reviews, and it arrives at 4:40 on a Friday when the office is trying to clear the desk. Phishing is any message built to get you to hand over a password, open something that installs software, or send money, by pretending to be someone you deal with. This card teaches the reading order that catches it, using one real-shaped example.

The example, as it arrives

Here is the email, marked up with the six places to look. It is a composite of the kind supply-house phishing that hits remodellers, plumbers and HVAC shops.

From: Accounts Receivable                       [1]
      <[email protected]>
Reply-To: [email protected]     [2]
To: [email protected]
Subject: RE: Invoice 88213 - FINAL NOTICE       [3]
Attached: INV_88213_statement.html              [4]

Hi Dana,

Our records show invoice 88213 is 45 days past
due. To avoid a credit hold on tomorrow's
will-call order, please review and pay today
through our new secure portal:                  [5]

  View invoice -> northside-supply.com.pay-inv.net

Thanks,
Rick T. | AR Dept | 555-0147                     [6]

Real details make it convincing: the supply house is the one you use, Dana is the office manager's real name (from the shop's website), and there may well be a will-call order tomorrow. None of that is evidence. Attackers research the shop for ten minutes before writing.

The reading order, step by step

Read on a computer, not a phone, whenever money or a login is involved. Phone mail apps show the display name and hide the address, and they make it hard to see where a link really goes, which is exactly why so much phishing works on a phone.

1. Read the sender's address, not the name. The display name says Accounts Receivable; the address at [1] is northside-supp1y.com, with the digit 1 standing in for the letter l. That is a look-alike domain: a web address registered to resemble a real one by swapping, adding or dropping a character (rn for m, a hyphen added, .co for .com). Skip this and you trust a name anyone can type into a mail program. But a correct address does not clear the email: when a supplier's real mailbox has been taken over, the address is perfect, which is why the steps below still run.

2. Check where a reply would go. At [2] the Reply-To is a free mail account at a different domain. Many mail programs show this only when you hit reply, so look before. A supplier's AR desk does not ask you to reply to a personal free mailbox. Skip this and your reply, with whatever you put in it, goes straight to the attacker even if the From line had been genuine.

3. Check the subject against your own records. "RE:" at [3] claims an existing conversation; search your mail for invoice 88213 and check accounts payable. If there is no such invoice, or it was paid, the "RE:" is a costume. If there is a real open invoice with that number, that suggests the supplier's mailbox or your own has been read, which is more serious, not less. Skip this and the fake thread does its job: people trust a reply more than a new message.

4. Treat the attachment type as a verdict. At [4] the "statement" is an .html file. Opened, it draws a login page on your own computer that looks like your email provider or the supplier's portal, and sends whatever you type to the attacker. Suppliers send invoices as PDFs. Treat these as hostile from anyone: .html or .htm, .zip or other archives you did not ask for, disk images, and any document that asks you to "enable editing" or "enable content." Skip this and one double-click hands over your email password, which is the account that resets every other account.

5. Read the link from the right. At [5] the visible text says one thing, but hover (or long-press on a phone and read, do not tap) to see the real address. Then read the domain from right to left: the part that matters is the last two labels before the first single slash. northside-supply.com.pay-inv.net belongs to pay-inv.net; everything to the left is decoration the attacker chose. Skip this and you land on a page that looks exactly like the supplier's, because it was copied from it.

6. Notice where the phone number came from. At [6] the email supplies its own number. Calling it to "check" reaches Rick, who is happy to confirm. Any number inside the message is part of the message. Verify on a number you already had. See related: The Verify-on-a-Second-Channel Rule.

Then name the ask. Every phishing email asks for one of five things: log in, open, pay, call, or buy (gift cards, most often). Here it asks you to log in and pay, under a deadline (the credit hold). An ask to log in from a link, or to pay somewhere new, under time pressure, is the pattern regardless of how clean everything else looks.

The four variants a trade shop sees most

The reading order is the same for all of them. What changes is the costume and the pressure point.

The permit office. "Your permit application is incomplete. Pay the processing fee within 48 hours to avoid cancellation," with a link and sometimes the real permit number scraped from a public permit search. Many US municipalities send from a .gov address, but plenty legitimately use .us, .org or a permitting vendor's domain, so the domain alone does not settle it. Never pay from the email: log into the permit portal you filed through, by typing its address, and look for the notice there. A real deficiency will be in the portal.

The review notice. "A customer left a 1-star review. Respond within 24 hours or it will be published," or "your business profile will be suspended for policy violations." It targets the thing an owner cares about most. The listing platforms show notices inside your account; open the platform yourself and check. A link that asks for your login, or for a fee to remove a review, is the attack. See related: Fake Review Extortion and Review Bombing.

The payment-processor alert. "Your payouts have been paused. Verify your account to resume." This one pays off hugely for the attacker, because the login it steals can redirect your payouts. Type your processor's address yourself; if payouts really are paused, the dashboard says so. See related: The Payout Account Change Alert SOP.

The look-alike thread with your customer. Less common but costly: an attacker who has read your mailbox emails a customer from a domain one character off yours, with "updated payment instructions" for their deposit. You never see it. The defense is on your side of the domain. See related: Setting Up Email Authentication So Nobody Can Send as You.

Worked example: running the order on the Northside email

Dana reads it at her desk, not on her phone, at 4:40 on a Friday.

• Step 1: the address ends in supp1y.com. Suspicious, but she has seen typos before, so she keeps going rather than deciding on one tell.
• Step 2: Reply-To is a free mailbox. A second, independent tell.
• Step 3: she searches accounts payable. Northside invoice 88213 does not exist; the shop's last Northside invoice was in the 87,000s and was paid nine days ago. The "RE:" is a costume.
• Step 4: the attachment is .html. She does not open it.
• Step 5: hovering shows pay-inv.net.
• Step 6: she ignores the number in the signature, opens the vendor file and calls the AR line recorded at onboarding. Northside confirms no past-due balance and no new portal.

Five of the six marks were tells; step 3 alone would have settled it, and step 4 alone would have kept her password safe. That is the reason to run the whole order rather than stop at the first clean result: in a mailbox-takeover version, steps 1 and 2 come back clean, and only steps 3 to 6 catch it. She forwards the email as an attachment (not inline, which strips the headers that show where it came from) to the owner, reports it as phishing in the mail program, and deletes it. Elapsed time: about six minutes, three of them on the phone.

What would change the call

You already clicked and typed a password. Stop reading this and go to The First Hour After a Suspected Breach SOP: change that password from a different, clean device, and check the mailbox for new forwarding rules, which attackers add so they keep reading your mail after the password changes.

You opened the attachment but typed nothing. Disconnect that computer from the network and tell whoever handles your IT; an HTML file usually needs you to type, but other attachment types can install software on opening.

The email is genuine. It happens: suppliers do move to new portals. The order above still works, because you reached the portal by your own path and confirmed by your own number. Being careful with a real email costs you a few minutes.

How to know the office has this

Run it as a drill rather than a lecture. Print this example, cover the annotations, and ask each person who handles mail to find the tells; most find two or three on the first try and all six on the second. A shop that does this quarterly can measure itself. See related: Running a Phishing Drill for the Office. The real check is behavioral: in the next month, does anyone bring you a suspicious email before acting on it? An office that forwards three false alarms is working. An office that forwards nothing is either very lucky or not looking.

References

• See related: The Verify-on-a-Second-Channel Rule
• See related: The First Hour After a Suspected Breach SOP
• See related: Running a Phishing Drill for the Office
• See related: Training the Office to Spot Social Engineering Calls
• CISA guidance on recognizing and reporting phishing