Fake inquiries and phishing aimed at exporters

A solo exporter's inbox is open to anyone in the world, and you're expected to answer strangers quickly. That's exactly what scammers count on. Spotting a suspicious inquiry before you reply is covered on relaysolo.com, in the red-flags section of how to reply to a new inquiry. This guide covers what comes next: the emails designed to steal your logins, put malware on your computer, or get you to send money.

"Please see our order attached"

The UK's National Cyber Security Centre (NCSC) notes that malware is often hidden in phishing emails, and its own case study is an email that claimed to be an invoice needing urgent attention. The US cyber agency CISA calls attachments a common delivery mechanism for malware. For exporters, the bait is usually an order, a purchase order, a "payment copy" or a "shipping document".

• Unknown sender, generic greeting ("Dear Sir/Madam", "Dear Supplier"), and an attachment as the main content.
• The file asks you to "enable editing", "enable content" or "enable macros" to see the order.
• A compressed file (.zip, .rar, .7z), a password-protected archive "for security", or an unusual file type.
• The "order" doesn't mention your actual products, or lists products you don't make.
• Urgency: "please confirm stock today", "payment already made, check attached".

A real buyer will happily paste the product list into the email body, or send a plain PDF after you've exchanged a few messages. Ask for that.

Fake login pages

The other common trick is a link: "view the order on our portal", "your mailbox is full", "a document has been shared with you", "your marketplace account needs verification". The link opens a page that looks exactly like your email provider or a marketplace and asks you to sign in. CISA warns that malicious websites may look identical to a legitimate site. Once you type your password, the attacker can read your email, which is the first step in bank detail change fraud.

The official advice from Australia's cyber agency is simple: go directly to official websites, or use known phone numbers, instead of links in messages. In practice:

• Never sign in from a link in an email. Open the site from your own bookmark or by typing the address.
• Turn on two-step sign-in for your email and marketplace accounts. A stolen password alone then isn't enough.
• If you've already typed your password into a suspicious page, change it at once from the real site, and check your mail forwarding rules.

The overpayment refund

A buyer pays more than the agreed amount, apologises, and asks you to send the difference back, often to a different account or by a different method. Scamwatch lists this as a warning sign, and the US Federal Trade Commission describes the same pattern aimed at small businesses: the original payment later bounces or is reversed, and the refund you sent is gone.

• Don't refund anything until the full payment has cleared in your account and your bank confirms it can't be reversed.
• Refund only to the account the money came from, by the same method.
• Or simply offer to credit the extra against the next order.

"Another company wants to register your brand"

An email from a "registration centre" in Asia says another company has applied to register your company or brand name as a domain name, often a .cn address, and asks whether you authorised it. If not, you must register the names yourself, through them, quickly. Australia's consumer regulator warned about exactly this pattern, and pointed businesses that genuinely want a .cn domain to the accredited registrars listed by China's domain registry, CNNIC.

If you don't plan to sell under that domain, you can ignore these emails. If you do want the domain, buy it through a registrar you choose yourself, not the one that emailed you.

Invoices you never ordered

Official-looking letters or emails asking you to pay to "confirm" or "update" your entry in a business register, a trade directory or a trademark list are a long-running scam. Switzerland's federal government warns that such letters are presented as official invoices; Finland's business registry reported a letter impersonating the European Commission and its e-Justice portal, asking for a fee to confirm company details; the UK Intellectual Property Office warns about misleading invoices for trademarks: "Do not pay them."

• Pay only invoices for things you know you ordered, from a supplier you know.
• Look for small print saying it's an offer, not an invoice.
• If it names a government body, find that body's real website yourself and check.

Check a buyer is real

Before you produce samples or goods for a new buyer, a few minutes of checking is worth it:

• Look the company up in its country's official company register. Examples: the UK's Companies House (free), and for the EU, national registers linked through the European e-Justice Portal.
• Does the email domain match the company's real website? Is it a free email address for what claims to be a large company?
• Call the switchboard number from the company's own website, or the register, and ask for the person by name.
• Does the request make sense? Odd quantities, no interest in price, or a rush to ship before payment are reasons to slow down.
• Agree payment terms that don't leave you exposed while you get to know the buyer. Free samples only for buyers you've checked.

Reporting phishing

• United Kingdom: forward suspicious emails to report@phishing.gov.uk.
• United States: forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org, and report fraud at ReportFraud.ftc.gov, as the FTC advises.
• Elsewhere: your national cyber security centre or CERT usually has a reporting address.
• Also report it to your email provider using its "report phishing" button.

If money has already gone, the steps are different and urgent; see what to do in the first hour.

How RelaySolo helps with this

RelaySolo doesn't scan emails for malware or detect phishing; keep your email provider's protections and your own judgement. What it does: in the inbox, buyer emails are translated into your language, which makes a strange "order" easier to read critically, and an inquiry's details are pulled into a card so you can see at a glance whether it mentions your actual products. Each buyer's history is on a client page, on your own computer rather than our servers (where your data lives).

The Mac app is free to try for 30 days for your first company. Create an account on relaysolo.com to download it.

Sources

• UK National Cyber Security Centre, Phishing attacks: defending your organisation; GOV.UK, Report suspicious emails and websites.
• CISA, Avoiding social engineering and phishing attacks.
• Australian Signals Directorate, Learn how to spot scams.
• US Federal Trade Commission, How to recognize and avoid phishing scams and Fake check scams and your small business.
• Scamwatch (Australia), Buying and selling scams and unsolicited offers to register domain names overseas (2013).
• Swiss federal government (SME portal), Commercial register: beware of profiteers; Finnish Patent and Registration Office, BRIS warns companies of scam letters (2023); UK IPO, Misleading invoices: don't be fooled.

Read next

• Bank detail change fraud; all of Fraud and safety.
• How to write a proforma invoice and delay and price-increase emails, in Samples, orders and documents.
• Letter of credit, in Getting paid; Incoterms 2020, in Quoting and trade terms.
• Plain English and working weeks and holidays, in Working across markets. How we check sources: about this handbook.