An unexpected request for a quote can feel like good news. A potential buyer appears interested, the message sounds professional, and the sender promises to provide project specifications through an online portal.
Unfortunately, criminals are increasingly using that exact scenario to target businesses.
Fortra’s cybersecurity researchers reported a 12-fold increase in malicious emails containing request-for-quotation language between October 2025 and September 2026. These messages commonly target sales, procurement, contracting, and customer-service employees because responding to unfamiliar buyers is a normal part of their work.
The goal is usually not to receive a real quote. It is to convince an employee to visit a fake document portal and enter business login information.
The first email may contain very little that looks threatening. It might ask whether your company is available to bid on a project, supply certain products, or review an upcoming opportunity.
If an employee responds, the supposed buyer sends a second message containing a link to:
The linked page may resemble Microsoft 365, Google Workspace, Dropbox, or another familiar service. It then asks the employee to sign in.
Fortra found that nearly 73% of the RFQ-related lures it classified led to credential-phishing pages. Those pages may attempt to collect passwords, multifactor authentication codes, or active login information.
Traditional phishing often relies on threats, overdue invoices, or alarming account warnings. RFQ phishing uses opportunity instead.
Employees want to respond quickly to a potential customer. A vague message can even seem normal when the sender claims that complete details are inside a protected document.
Warning signs can include:
One sign alone does not prove that a request is fraudulent. Several signs together should prompt verification.
Access to one employee’s mailbox can give a criminal a valuable view of the business. The attacker may search for invoices, customer conversations, payment instructions, vendor contacts, or active projects.
The compromised account can then be used to send highly believable messages to coworkers and customers. Because those messages come from a real company mailbox, recipients may be more likely to trust them.
Possible consequences include:
The FBI recommends independently confirming payment requests and changes to financial instructions rather than relying on email alone.
Look beyond the displayed name. Check the complete email address and compare its domain with the organization’s official website.
Small spelling changes can be easy to miss.
Before opening an external portal, request the buyer’s full company information, project location, telephone number, RFQ number, and a plain-language description of the work.
A legitimate buyer should be able to provide basic context.
Find the company’s website and telephone number yourself. Do not rely solely on contact information supplied in the email.
Call the organization and ask whether the named employee and project are legitimate.
A document link should not require employees to enter Microsoft 365 credentials into an unverified website. When possible, open the known service directly from its official website or application.
Employees should know where to send suspicious emails for review. Reporting the message helps protect coworkers who may have received the same campaign.
Use multifactor authentication, restrict unnecessary access, and monitor for unusual sign-ins. Businesses should also have a clear process for quickly disabling a compromised account and reviewing mailbox activity.
New bank details, payment destinations, or purchasing instructions should be confirmed through a known telephone number and approved by more than one person when appropriate.
Sales teams are expected to move quickly. Security procedures should help them verify opportunities without making every inquiry difficult to handle.
Give employees a simple rule: when an unfamiliar buyer asks them to sign in, download a file, or change a payment process, pause and request verification.
A brief delay is far less costly than a stolen mailbox or fraudulent transfer.
Himala and his team at Cybernetic Networks have been amazing. We have been a customer of Cybernetic Networks for well over 14 years now, both personally and professionally. Himala and his team are professional, reachable and on the cutting edge of technology. We have enjoyed doing business with Cybernetic Networks for many years and still rely on their knowledge, skills and technology every day
Himala and his Cybernetic team have never let me down! For over 10 years now they have been fixing my technical issues, set up all my new networks and computers and have safeguarded me from any hackers or malware. You can trust this company to navigate you as your company grows and to keep you on track with the latest in security and safety
I am a solo practicing neurologist and have had all my IT needs covered through Cybernetic Networks since 2007. They are the best! All of their tech support staff is extremely knowledgeable and efficient. Just as importantly, they are quickly responsive whenever we need their assistance. I couldn’t be happier with their service and give them my highest recommendation!
I couldn't be happier with Cybernetics - they are experts, always respond quickly , and solves any issues I have.
Cybernetic Networks has been advising and supporting all our IT issues and purchases for the last 18 years. They are very responsive and extremely knowledgeable- always providing us with timely services.
It is not often you find small business companies that are not only rewarding to work with, but also have integrity, truth and skill. I have worked with this company for over 20 years, and the service is outstanding. I can easily recommend that if you need an IT company, this is the one to get. Full STOP! Look no further, you will be happy that you did. Sue Myhelic, Gulf Breeze Real Estate, Naples, Florida.
Himala and his team from Cybernetic Networks, Inc. has been an integral part of our successful retail business for the past 20 years. He is extraordinarily knowledgable and always available for our IT needs. Thanks to Himala and his team we are always up and running.
