Facture électronique : les premières arnaques repérées
ZATAZ has identified a new wave of phishing attacks exploiting the upcoming mandatory adoption of electronic invoicing in France. Scammers are mimicking official notifications with convincing fake websites and logos, leveraging the familiarity of invoices and the pressure of deadlines to trick users into clicking malicious links and potentially providing sensitive information or making fraudulent payments. The transition to electronic invoicing has created a new attack surface, requiring heightened vigilance and careful verification of all communications.
France is preparing to implement a major shift in business practices with the rollout of electronic invoicing. Starting September 1st, 2026, companies, particularly large and medium-sized enterprises, will be required to receive electronic invoices. By September 1st, 2027, this requirement will extend to small and micro-enterprises. This transition promises streamlined processes, reduced manual data entry, faster accounting, and improved document traceability. However, it also presents a significant opportunity for cybercriminals.
ZATAZ has uncovered a sophisticated phishing campaign targeting businesses transitioning to electronic invoicing. Attackers are creating convincing fake websites mimicking official electronic invoicing portals, complete with logos and branding to appear legitimate. These websites are often built using artificial intelligence, allowing for rapid creation of realistic-looking interfaces. The emails themselves closely resemble official notifications, referencing transaction codes and deadlines to create a sense of urgency and encourage immediate action.
One tactic involves a fake ‘hosting’ website dedicated to macramé and knitting – a seemingly ordinary activity designed to build trust and mask the malicious intent. The URLs used are deliberately suggestive, such as ‘notification courriers electronic,’ further reinforcing the legitimacy of the operation. The goal is to collect user credentials, sensitive business information, or even banking details, potentially leading to fraudulent payments or redirection to malicious infrastructure.
Beyond simply clicking a link, these fake portals can attempt to steal login information or gather business data. A fraudulent invoice can also be used as a pretext for making unauthorized payments or redirecting users to compromised websites. The combination of a legitimate-looking logo, detailed invoice information, and a looming deadline transforms a seemingly official notification into a tool for social engineering.
To combat this threat, ZATAZ emphasizes the importance of verifying the origin of any communication. Instead of clicking a link in an email, users should access their electronic invoicing portal through their usual channels. Thoroughly investigating the sender’s identity, domain used, existence of a legitimate order, and the amount requested are crucial steps before taking any action. The transition to electronic invoicing, while beneficial for businesses, has unfortunately created a new and evolving attack surface that requires constant monitoring and proactive security measures.