Invoice Fraud at Scale: Inside an Executive Impersonation Campaign

In early August 2026, Microsoft detected a campaign of over one million emails aimed at accounts payable teams. Each message asked finance staff to process a payment of nearly $50,000. The request appeared to come from the recipients’ own executives.

The campaign is a clear example of modern invoice fraud. It combined executive impersonation, a fabricated vendor invoice, and a forwarded email thread into one convincing request.

The Campaign

Microsoft reported that the activity ran between August 3 and 5, 2026. The attacker used multiple third-party delivery accounts to send emails to users. Most recipients (87.7%) were in the United States.

Targeted industries included IT services, business advisory, and consumer goods. The objective was Automated Clearing House (ACH) payment fraud. Each email requested an ACH transfer to an attacker-controlled bank account. The attacker used multiple financial institutions to receive funds.

This was not a single-lure scam. The attacker layered several techniques into one narrative designed to lower skepticism. That layering is what made this invoice fraud campaign stand out.

How the Executive Impersonation Worked

The executive impersonation appeared in three places: the sender display name, the reply-to display name, and the email signature. Impersonated roles included CEOs, CFOs, and presidents of the targeted organizations. The message body was short. It approved the invoice included below and offered a PDF copy on request.

Below the signature, the attacker added a fabricated ServiceNow annual subscription invoice. It carried ServiceNow branding, an invoice number, due dates, and bank transfer instructions. The “Billed To” section listed the recipient’s company and executive name. ServiceNow did not issue the invoice.

Two more “forwarded” messages followed. They showed a conversation between the impersonated executive and a fake ServiceNow president. This layered executive impersonation gave the invoice fraud a backstory that looked internally approved.

Microsoft identified invoice fraud indicators that finance and security teams can check:

Microsoft also found indicators consistent with AI-assisted template creation, including HTML comments and uniform structure. Microsoft notes these indicators don’t establish how much of the content AI generated.

Why the Real Domains Were Never Compromised

Microsoft found no evidence that ServiceNow or any other business named in the lures was compromised or involved. The campaign relied on domains and content the attacker controlled.

On July 31, three days before the emails began, the attacker registered service-nowinc[.]com. This lookalike domain supplied the fake ServiceNow president’s email address and contact email. The same day, the attacker registered domainlify[.]net for the reply-to address.

This matters for invoice fraud defense planning. The attacker didn’t need access to a real vendor domain or a real target domain. Newly registered domains were enough to attempt ACH payment fraud at scale.

Where DMARC Enforcement Fits, and Where It Doesn’t

DMARC checks whether a message using your domain in the "From" address passes SPF or DKIM and aligns with your domain. At p=reject, DMARC instructs receiving email servers on how to handle messages that fail. Receiving servers decide how to apply that policy.

DMARC enforcement on a targeted company’s domain wouldn’t have applied here. The emails came from other domains. DMARC doesn't evaluate display names. This form of executive impersonation falls outside its scope. The owner of a newly registered domain can also authenticate its own email.

Enforcement still matters. Without it, an attacker could send invoice fraud emails from your exact domain, with no mismatch between display name and address. Enforcement blocks that route at receiving servers that apply the policy. Attackers must then rely on display names and registered domains.

Microsoft’s own guidance lists SPF, DKIM, and DMARC configuration as one layer among several recommended mitigations. No single control stops invoice fraud or ACH payment fraud on its own.

Reducing Invoice Fraud Risk

Invoice fraud can rely on your real domain or on one built to look like it. Each needs its own control.

DMARC Management covers your exact domain. It identifies all legitimate and unauthorized senders using your domain across departments. It surfaces misconfigurations before they become incidents, which reduces manual investigation. Sendmarc’s team guides your domains to full enforcement, then continues monitoring as your environment changes.

Lookalike Domain Defense covers domains outside your control. It helps you identify lookalike domains attempting to impersonate your organization. A domain such as service-nowinc[.]com is the kind of registration it detects.

Together, these controls help protect brand reputation from phishing, spoofing, and impersonation. They reduce the ways attackers can borrow your company’s identity for executive impersonation and ACH payment fraud.

Check Whether Your Domain Is Protected

Invoice fraud and ACH payment fraud depend on a trusted identity. Start by confirming whether your exact domain is protected from impersonation.

Executive impersonation through lookalike domains needs a separate view. If your team has no visibility into domains impersonating your brand, Lookalike Domain Defense adds continuous monitoring for those registrations.