Invoice Fraud With a Carrot: The 30% Discount Hook

The accounts-payable team at a consumer finance company opened what looked like a routine past-due notice. One invoice, a balance of $50,750.00, and a warning that services would be interrupted if payment did not arrive. Standard invoice-fraud pressure, except for one detail that did not fit the usual script: the sender offered a 30% discount if the balance was cleared that week. Pay now, pay less, and make the problem go away.

That inversion is what makes this case worth studying. Most invoice fraud runs entirely on a stick, a threat of consequences designed to short-circuit the recipient's judgment. This one added a carrot. And a carrot is arguably more dangerous, because it reframes an unusual, out-of-cycle payment as a savvy financial decision rather than a suspicious one. The target is no longer asking "should I pay this?" but "can I afford to miss a five-figure discount by dragging my feet on verification?"

A Clean Bill of Authentication Health

The email did not come from a throwaway domain or an obviously spoofed address. It came from a real, active corporate mailbox belonging to a small business registered a couple of years earlier, an organization with no relationship to the finance company or to the vendor named in the invoice. Every indication is that the mailbox had been taken over and quietly repurposed to send the fraud, a reminder that account takeover turns a trusted sender into an attacker's delivery vehicle, and what makes this a Compromise Accounts play (mapped to MITRE ATT&CK T1586) rather than a domain spoof.

That distinction matters, because it explains why the authentication looked so healthy. SPF returned a softfail, but only because the message was routed through an intermediate relay that was not authorized for the domain. DKIM passed and aligned. DMARC passed under the domain's published quarantine policy. Microsoft's composite authentication scored a full pass, and the message arrived with a spam confidence level of 1. To a gateway that treats a clean authentication verdict as a trust signal, this was a legitimate email from a legitimate business.

It was relayed through a spam-filtering hop at delivery.antispam.mailspamprotection[.]com (185[.]56[.]87[.]13, a Netherlands IP), a service that is not among the recognized reputable enterprise mail gateways. On its own that routing detail is weak, the kind of thing plenty of legitimate small businesses do. It only becomes meaningful when combined with everything else.

Where the Story Falls Apart

Authentication proves that the message really was sent by the account it claims to be from. It says nothing about whether the content of that message is honest. And the content is where this attack unravels.

The vendor name in the signature block did not match the domain the email was actually sent from. It also did not match the reply-to domain referenced elsewhere in the body. Three identities that should have been the same organization were instead three different things: a compromised small-business sending domain, a garbled and mismatched vendor name in the signature, and yet another reply channel buried in the body. A real vendor's past-due notice does not have an identity crisis. This one did.

Attached to the email were two PDFs, an invoice of roughly 148KB and a W-9 tax form of roughly 46KB. Both scanned clean, and that is the point. In this style of fraud the attachments are not malware. They are legitimacy props, ordinary accounts-payable paperwork meant to make a fraudulent wire look like a normal transaction. The danger is never the file. It is the instruction wrapped around it.

The Carrot That Makes Fraud Feel Smart

The 30% early-payment discount is the design choice that deserves attention. Pretexting, the category that covers most business email compromise, is the leading social-engineering pattern in the 2024 Verizon Data Breach Investigations Report, which puts the median BEC transaction at roughly $50,000. That figure sits almost exactly on the $50,750 balance in this message, and the coincidence is not a coincidence. Attackers price these requests to land in the range where a finance team can approve payment without triggering an executive sign-off or a hard stop.

The discount does something the threat alone cannot. It manufactures a rational reason to hurry. A recipient who might pause over a large past-due balance can talk themselves into acting on a limited-time saving, and every hour spent verifying is framed as money left on the table. It is urgency dressed up as prudence.

How Adaptive AI Caught It

No single technical check would have stopped this. SPF's softfail is common enough to be noise, the attachments were clean, and the DKIM and DMARC passes actively argued for delivery. The catch came from correlating signals that each looked benign in isolation.

IRONSCALES Adaptive AI flagged the message on a content-and-identity mismatch: a technically authenticated sending domain whose in-body vendor branding did not match the sender, paired with payment-diversion language and an out-of-band incentive. Themis reads the relationship and the intent, not just the headers, so a first-time sender impersonating a vendor it has no authenticated tie to stands out even when every SPF, DKIM, and DMARC box is checked. That is the difference between verifying who sent an email and understanding what the email is trying to do.

Defending Against Incentive-Driven Invoice Fraud

Treat vendor-identity consistency as a first-class check. If the signature name, the sending domain, and the reply-to path are not the same organization, that mismatch outranks any authentication pass. Route any change to payment terms, banking details, or an unexpected discount through an out-of-band callback to a known contact, never a number or address supplied in the email itself. And train accounts-payable teams to be as suspicious of a surprise saving as they are of a surprise threat, because attackers now use both.

Indicators of Compromise

MITRE ATT&CK Mapping