Phishing is the illegal attempt to steal money and/or sensitive information using phone calls, email messages or websites.

Criminals often attempt phishing by posing as legitimate companies, such as replicas of websites, emails, or social engineering, to convince you to either provide personal information or install malicious software on your computer.

Protect your data

Most organizations follow best practices in any type of communication to customers. Things to know about legitimate Bill.com communications:

• We will never ask you to provide credit card or ACH information in an email or over the phone.
• Email from Bill.com never contain ZIP or EXE attachments.
• All links in Bill.com emails will point to Bill.com URLs (beginning with app.bill.com, app-signup.us.bill.com, sg.bill.com, cashflow.bill.com). Hover over a link to see the link's full URL in the bottom left corner of the browser.
• Bill.com never sends email to your Bill.com Inbox. 

Best Practices

The following are tips for recognize phishing attempts and avoiding scams:

• Spelling and Grammar
• If you receive an email from a familiar or well-known source which has poor grammar and spelling, this may indicate a scam.
• Real companies generally keep copy editors and technical writers on staff to ensure only well-polished emails get sent to their users.

• Attachments
• Never download attachments from an unfamiliar source, or from an email you suspect may not be legitimate.
• Ensure your anti-virus software is up to date. Be especially suspicious of ZIP and EXE files, however even documents can contain viruses. 

• Threats
• Emails which threaten to shut down or block your account unless you reply, click a link, or provide information may be phishing scams.

Report phishing emails

Please forward all phishing emails to phishreport@hq.bill.com.