The Portal That Wasn't: Why 2026's Invoice Emails Want You to Log In

It's 07:42, the coffee is still too hot, and the shared finance inbox has eleven new messages. Three are invoices. One of them is from a supplier you've used for six years, the PDF is immaculate, the PO number is right, and there's a button that says 'View in supplier portal'.

That button is the entire attack.

The attachment moved; the trick didn't

For years the playbook was a payload: a macro-laden spreadsheet, a zipped HTML file, a link that downloaded something unpleasant. Filters learned. Users learned, sort of. So the operators changed the shape of the thing.

What circulates now is a clean PDF with no executable content at all. It renders fine, it passes attachment scanning without a murmur, and it contains exactly one hyperlink. Security stacks tuned to ask "is this file dangerous?" answer no. Nobody asked where the button goes.

What actually lands in the inbox

The PDF is usually convincing because it is often a real one. Templates get lifted from genuine suppliers, or generated from details scraped off a company website, a tender notice, or a LinkedIn post about a new finance director. Amounts are plausible. Reference formats match.

The link points at a domain built to look adjacent to the supplier: a hyphen inserted, a .co where the real one is .co.uk, a plural where there shouldn't be one, or a 'portal' subdomain that never existed. Some campaigns skip the impersonation entirely and point at a form on a mainstream cloud platform or a compromised WordPress site, which means the URL is hosted somewhere perfectly reputable.

The landing page asks for an email address and password. Sometimes it offers single sign-on, and that is the more dangerous variant — an adversary-in-the-middle setup that captures the session token after MFA and walks straight past it. Then comes the second act: a request to 'confirm' bank details, or a card form claiming a payment failed.

Three mismatches worth teaching the whole team

Display name versus domain. The sender shows as your supplier's name. The address is something else entirely. This is a thirty-second check and still catches most of the traffic.

Sender versus link. If the invoice comes from a supplier, the link inside the PDF should live on that supplier's domain. When those two disagree, someone is lying, and it is rarely the PDF.

Domain age versus relationship length. A domain registered eleven days ago cannot belong to the firm that has invoiced you since 2019. A quick RDAP lookup answers this.

One thing to retire from the training deck: "DMARC passed, so it's probably fine." Authentication proves the sender owns the domain they're sending from. Phishing domains set up SPF, DKIM and DMARC properly all the time — it takes twenty minutes and costs nothing. DMARC is a spoofing control, not a character reference.

Verifying a bank-detail change without stalling month-end

Any request to change payee details should be treated as an incident until proven otherwise, regardless of how calm and helpful the email sounds.

Call back on a number from your own supplier ledger — never the one printed in the email. If the ledger number doesn't answer, use a switchboard number from Companies House or the supplier's own site reached independently. A fraudster who has compromised a mailbox will happily answer the phone number they planted.

Run Confirmation of Payee before the first payment and again after any change. A partial or no-match result is a stop signal, not a curiosity to note in the margin. Two people should approve payee amendments, and the person making the change should never be one of them. Log the timestamp, the verification channel and the name of whoever confirmed it.

The UK's reimbursement regime for authorised push payment fraud, in force since 2024, does cover much of this — but claiming is slow, partial and stressful, and it works far better as a backstop than as a plan.

Tuning the filters without strangling real invoices

Do not block PDFs. Half your supply chain communicates exclusively in PDFs, and a blanket rule will have finance on the phone by lunchtime. Instead, separate first contact from established relationship.

Quarantine PDF attachments from senders who fail DMARC, or from domains you've never corresponded with, and route them to a review queue with a stated turnaround. Allow-list by authenticated domain rather than by display name, and re-check those allow rules quarterly — suppliers get breached too.

Turn on URL rewriting and click-time detonation if your stack supports it. Weight the score for newly registered domains, lookalike and typosquat patterns, and forms hosted on file-sharing or cloud-form platforms that your suppliers have never used before.

Watch reply-to mismatches, and resist overusing the big yellow external-sender banner. It becomes wallpaper within a fortnight. Variance gets noticed; constancy does not.

Finally, measure false positives. If finance asks for a quarantine release every day, the rule is too broad — tighten the condition, not the outcome.

Habits that survive month-end

Filters catch patterns. People catch intent. The overlap between them is where your money stays where it should.