How to Spot Fake Xero Invoice Phishing Emails Targeting Australian Small Businesses

Summary

This guide helps you troubleshoot and resolve: How to Spot Fake Xero Invoice Phishing Emails Targeting Australian Small Businesses. Follow the steps below to fix the issue.

Common Causes

Phishing emails pretending to be from Xero are one of the most common scams targeting Australian small businesses. These messages often claim there is an unpaid invoice, a payment pending approval, or an issue with your Xero account. The goal is usually to steal your Xero login credentials or trick your staff into paying a fraudulent invoice into a scammer-controlled bank account. This guide explains how to spot these fake emails and what to do if you receive one.

Quick Fix Steps

1. Do not click any links or open attachments in the suspicious email.
2. Check the sender's email address carefully for misspellings or unusual domains.
3. Hover over any links to see the actual destination before clicking.
4. Log in to Xero directly by typing https://www.xero.com/au into your browser, not via an email link.
5. Report the email to your IT provider or forward it to your support team.

Detailed Instructions

Check the Sender Address

Scammers often use email addresses that look similar to Xero's but are not official. Look for the part after the @ symbol. Genuine Xero emails come from domains such as @xero.com or @email.xero.com. Be suspicious of addresses ending in @gmail.com, @outlook.com, or misspelled variations like @xero-support.com or @xero-invoices.net.

Look for Generic Greetings

Legitimate Xero invoices usually address you by name or display your organisation name. Phishing emails often use vague greetings such as "Dear Customer," "Dear User," or "Hello." If the email does not mention your business name or the specific invoice number you are expecting, treat it with caution.

Inspect Links Before Clicking

Hover your mouse over any button or link in the email without clicking. A small preview will show the actual web address. If the link does not go to a xero.com domain, or if it uses an IP address or a strange string of characters, do not click it. On mobile devices, press and hold the link to reveal the destination URL.

Be Wary of Urgent Payment Requests

Fake invoice emails often create a sense of urgency, claiming an account will be suspended or a service cut off unless payment is made immediately. Xero will not demand immediate payment via email to an unfamiliar bank account. Always verify payment details by calling the supplier using a phone number you already trust, not one provided in the email.

Check for Poor Spelling and Grammar

While some phishing emails are well-written, many contain spelling mistakes, odd phrasing, or Australian English used incorrectly. Look for words like "color" instead of "colour," or sentences that do not read naturally. However, do not rely on this alone; sophisticated scams can be well-written.

Verify Invoices in Xero Directly

1. Open your web browser and go to https://www.xero.com/au.
2. Click Login.
3. Enter your Xero credentials and check your dashboard for any outstanding invoices.
4. If the invoice mentioned in the email does not appear in your Xero account, it is likely fraudulent.

Check Attachments Carefully

Fake Xero emails may include attachments such as PDFs, Word documents, or HTML files that claim to be invoices. These can contain malware or links to fake login pages. Do not open unexpected attachments, even if they appear to come from a known supplier. If in doubt, contact the supplier through a separate channel to confirm they sent it.

What to Do If You Clicked a Link or Entered Details

1. Change your Xero password immediately.
2. Check your Xero organisation settings for any unfamiliar bank account details or user invitations.
3. Review recent invoices and payments for unauthorised activity.
4. If you entered credentials on a fake site, change passwords for any other accounts that use the same password.
5. Contact your bank immediately if any payments were made to a fraudulent account.
6. Report the incident to ReportCyber at cyber.gov.au.
7. Contact your IT support provider so they can help secure your email and Xero environment.

Tip: Enable two-factor authentication (2FA) in Xero for an extra layer of security. Even if a scammer obtains your password, they cannot log in without the second verification step.

Warning: Never reply to a suspicious invoice email. Replying confirms your email address is active and may lead to more targeted attacks.

Preventing Future Phishing Emails

• Keep your email spam filtering enabled and up to date.
• Train staff to recognise phishing attempts and verify unexpected invoices.
• Use a password manager so you do not reuse passwords across services.
• Regularly analyse email security settings with your IT provider.

If you are unsure about an email claiming to be from Xero, do not act on it immediately. Take time to verify the sender and log in to Xero directly. When in doubt, contact your IT support team and they can help you analyse the message.

Still Having Issues?