Attack vector e-invoice: How to protect your mailbox
E-invoicing will be mandatory from January 1, 2025 and many companies already use a dedicated email address to receive e-invoices. Find out why this makes sense and how NoSpamProxy optimally protects your mailbox in this blog article.
What is an e-invoice?
Just because an invoice is sent as a PDF invoice does not automatically make it an e-invoice.
With an e-invoice, the contents of the invoice are presented in a structured and machine-readable XML format. This ensures that the information issued by the invoice issuer in this format can be transmitted and received electronically and processed automatically without media discontinuity.
The e-invoice obligation, which has been in force since January 1, 2025, means the obligation to process and receive e-invoices in the XRechnung format, which is used in public procurement among other things, and ZUGFeRD from version 2.0.1 (with the exception of the MINIMUM and BASIC-WL profiles).
A dedicated address for e-invoices: does it make sense?
We always recommend setting up a dedicated address for receiving e-invoices. This will ensure that e-invoices only reach the relevant people in your company. It also offers additional setting options in NoSpamProxy that you can use to increase protection against dangerous content.
NoSpamProxy rejects emails to incorrect addresses
NoSpamProxy recognises these formats natively so that they can be selected as a condition in the content filter. For example, it is possible to only allow invoices in the XRechnung or ZUGFeRD formats to be sent to a specific address set up for e-invoices.
To do this, the first step is to configure the default user settings so that emails with e-invoices are generally rejected. In the second step, emails with e-invoices are then authorised in the settings for an individual user.
Incoming emails that contain attachments in one of the two formats for e-invoices, but are sent to an address not intended for this purpose, are then rejected by NoSpamProxy. This significantly reduces the attack vector for e-invoices: potentially malicious e-invoices end up in a central mailbox and can be processed from there. The risk of ill-considered clicks on dangerous links or content is significantly reduced.
Level of Trust also protects against dangerous e-invoices
With the help of Level of Trust, NoSpamProxy learns who you or your company’s employees are communicating with. Trust points are assigned to the sender and recipient based on numerous characteristics.
Level of Trust can be configured so that emails to the address for e-invoices are only accepted if
- the e-mail contains an e-invoice
- the e-mail comes from a known and trustworthy sender.
Otherwise, the email is rejected and the sender is informed of this by their own system.
Not yet using NoSpamProxy?
With NoSpamProxy you can reliably protect your company from cyber attacks. Request your free trial version now!
