Fake Quote Request Emails: The Scam Aimed at Your Sales Team
For most small businesses, an email asking for a quote is the best kind of email. It might be a new customer, a bigger order or a contract you have been chasing for months. So your team does the sensible thing: they reply quickly, open the drawings and get a price together.
Criminals have noticed. Fake “request for quotation” emails, often shortened to RFQ, have become one of the fastest-growing scams aimed at businesses. Research from the security firm Fortra found that malicious emails mentioning RFQs rose twelvefold between October 2025 and September 2026. In nearly three out of four cases, the email led to a fake page designed to steal email logins.
If your business quotes for work, from parts and haulage to building work and services, this scam is aimed at you.
Why this scam works so well
Most scam emails try to rush or frighten you: an unpaid invoice, a locked account, a parcel that can’t be delivered. Fake quote requests do the opposite. They offer you something you want.
They also land with the people whose job is to respond to strangers. Sales staff, estimators, office managers and procurement teams open documents and links from new contacts every day. Telling them “never click links from people you don’t know” isn’t realistic, because that is their job.
And phishing is still the most common way businesses get caught out. The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 46% of small businesses identified a cyber breach or attack in the previous 12 months, and phishing was by far the most common type.
How a fake quote request works
The newer versions of this scam are patient. Fortra’s researchers describe a pattern that usually goes like this:
- A short, polite first email. It often comes from a named “purchasing manager” or “procurement specialist” and simply asks whether you can quote for a project or confirm you are available. There is no link and no attachment, so it sails past email filters.
- You reply. Once you answer, the criminal knows your address is real and that you are interested. You now see them as a genuine contact.
- The follow-up with a link. The second email contains the “project drawings”, “RFQ pack” or a “secure file transfer”. The link looks routine.
- A fake sign-in page. The link opens a page that looks like a Microsoft 365 or Google sign-in, or a supplier portal, asking you to log in to view the documents. Some of these pages can also capture the code from your two-step sign-in (the extra check that sends a code to your phone).
- Your mailbox is taken over. With your login, the criminal can read your emails, look for invoices and payment details, and send convincing scams to your colleagues, customers and suppliers from your real address.
That last step is where the real damage happens. A stolen mailbox is often the start of invoice fraud, where a supplier’s or customer’s bank details are quietly changed and money goes to the wrong account. We covered this in more detail in our article on business email compromise.
Fortra also found the emails came from 664 different sender addresses, so simply blocking a few known bad senders won’t stop them.
Warning signs to look out for
None of these on its own proves an email is fake, but two or three together should make you stop and check:
- Very little detail. A genuine buyer usually tells you what they need. A fake one is vague and asks you to “confirm availability” or “send your best price”.
- A free email address or an odd domain. A large company buying from you would normally write from its own company address, not Gmail or a web address that is slightly misspelt.
- The documents need a login. Real customers usually attach a file or use a sharing link that opens straight away. Be wary if you are asked to sign in with your work email to see a drawing or spec.
- The company can’t be found. No website, no phone number, or a website that was set up last month.
- Not the kind of work you do. A request that doesn’t quite fit your products or services is worth a second look.
Simple checks that protect you
The good news is that you don’t need to turn away new business. You just need a few habits that make it hard for the scam to succeed.
Check the buyer before you open their documents
Before opening links in a follow-up email, take two minutes to check the company. Search for it online, look for a real website and a landline, and if the enquiry is worth quoting for, give them a ring on a number you found yourself, not one in the email.
Never sign in to view a document
Make this a firm rule for the whole team: if a link from a new contact asks you to enter your work email and password to see a file, close it. Real file sharing from Microsoft 365 or Google can ask you to sign in, so if you are unsure, ask the sender to attach the file directly instead, or ask your IT support to check the link first.
Turn on two-step sign-in everywhere, then strengthen it
Two-step sign-in still stops a huge number of attacks, and every account in your business should have it. Some of these scams can capture text message codes, though, so it is worth asking your IT support about stronger options such as the Microsoft Authenticator app with number matching, or passkeys. Our guide to when businesses should use two-step sign-in explains the choices in plain English.
Make reporting easy and blame-free
If someone has clicked, the most important thing is that they tell you straight away, not two days later. Changing a password within minutes can stop a criminal before they do any harm. Your IT team can add a report button to Outlook so staff can flag a suspicious email in one click, and you can forward suspicious emails to the National Cyber Security Centre at report@phishing.gov.uk. If your business has lost money, report it to Report Fraud online or on 0300 123 2040 (England and Wales).
Check payment changes by phone, every time
Because the end goal is usually money, the final safety net is simple: never change a supplier’s bank details because of an email, even one that seems to come from someone you know. Phone them on a number you already have.
What we do for our clients
For the businesses we look after, Microsoft 365 administration, advanced virus and threat protection and round-the-clock security monitoring are all part of our fixed monthly fee. That means sign-in settings are set up properly in the first place, and if something looks wrong, someone is watching. And because we respond to support requests within the hour, a member of staff who thinks they have clicked something can get help fast.
We also help teams spot scams like this one. Sales and office staff are the people most likely to see fake quote requests, so a short, practical briefing for them goes a long way. If you want a wider view of how to prepare, our phishing response plan guide is a good next step, and our cyber security page explains how we protect businesses across Sussex.
Need a hand?
If you are not sure how well your business would cope with a fake quote request, or what would happen if a mailbox was taken over, we are happy to help. Our free IT audit, part of our Get It Green process, checks your email security, sign-in settings and backups, then gives you a clear red, amber and green report.
Book a free IT audit or a 30-minute call and we will talk it through, with no obligation.
