Xero invoice scam message examples
Example scam messages
Subject: Action required: Xero subscription payment declined. Your latest payment could not be processed and your organisation will be moved to read-only access tonight. Restore full access now at xero-billing-portal[.]example.
What gives it away:
- Hovering the link shows a domain that isn't xero.com; lookalike login pages exist purely to steal your credentials
- Same-day 'read-only tonight' pressure is manufactured; a real billing problem is still there, calmly, when you sign in at xero.com yourself
- Genuine prompts never ask you to confirm your login through an emailed link
Subject: New invoice from your supplier via Xero. A new invoice has been shared with you. Download the attached file (Xero_Invoice_8834[.]zip) to review the details and remit payment this week.
What gives it away:
- The zipped attachment is the danger: Xero-branded emails carrying zipped files that install malware are a known campaign pattern
- Real invoices are viewed by signing in to Xero, not by running a downloaded archive
- The email names no supplier and no amount; the vagueness lets one template target thousands of businesses at once
How to check a message you've received
Never tap a link in an unexpected message. Instead, paste the text into the free message checker for an instant verdict, or check a suspicious link with the link & website checker. To verify directly, contact Xero through its official app or the number on its real website — never the details in the message itself.
Understand the scam and the brand
Not sure about a message?
Paste it in and get an instant scam verdict with the exact red flags highlighted — free, no signup.
Frequently asked questions
Is this Xero message real or a scam?
The messages on this page are defanged examples of Xero impersonation scams — real reported patterns, not genuine Xero messages. To judge a specific message you've received, paste it into the free Scam Scanner checker for an instant verdict, or verify it directly through Xero's official app or website.
How can I tell a fake Xero message from a genuine one?
Genuine messages: Genuine Xero emails come from a xero.com address (such as @xero.com, @post.xero.com or @support.xero.com) — but a sender address can be spoofed, so judge the message, not just the sender. The examples below break down the tells that give a fake away — unexpected links, urgency, and requests for payment or details. If anything asks you to click a link or hand over information, treat it as suspicious until you've verified it independently.
What should I do if I already clicked a link or paid?
Act quickly: contact your bank, then follow the step-by-step recovery guide at /what-to-do. It walks you through who to contact — your bank, IDCARE and the right reporting channel — in the order that matters most.