A polished invoice viewer is not proof of legitimacy. Domain ownership, form behaviour and the requested sign-in reveal the stronger evidence.
The scenario
A link opens what appears to be an invoice, shared PDF or protected business document. The page displays a recognisable cloud or software brand and asks for an email address and password before the document can be viewed.
The evidence that matters
- The login form is hosted on a domain unrelated to the organisation being impersonated.
- The page uses copied brand assets while its hostname belongs to someone else.
- The form sends credentials to an unrelated collection endpoint.
- The document, amount or deadline is used to create urgency before identity is verified.
What does not prove phishing by itself
An email field, a PDF design or a company logo can all appear on legitimate pages. Confidence should rise only when those elements conflict with domain ownership, form destination, brand context or independent threat intelligence.
Known service domain, expected sign-in route and a verifiable sender relationship.
Copied identity, unrelated hostname and a form that collects secrets outside the genuine service.
Recommended response
Do not enter credentials. Open the claimed service through its known application or manually typed official address, then check whether the document exists. If a password was submitted, change it from a clean device and revoke active sessions.
Further reading: CISA guidance on stopping phishing attacks.