The National Taxation Bureau in Taipei told businesses on September 14 that fraudsters are emailing fake notices claiming electronic invoice number applications failed review, a tactic designed to steal uniform invoice credentials and bank details. Finance ministry branches reiterated the rule on September 21: any genuine audit or correction arrives as a posted document, never as a clickable attachment from a .com domain.
How the lure works
Emails mimic Ministry of Finance letterhead and cite urgent deadlines, pressuring accountants to download zipped forms or visit look-alike portals. Some messages reference the e-invoice integration platform to sound current with Taiwan’s digital receipt rollout. Once opened, files plant keystroke loggers or redirect users to phishing pages that harvest company registration numbers.
The Criminal Investigation Bureau reported more than 500 phishing cases in August with tens of millions of new Taiwan dollars in losses, roughly double the prior-year month. Tax-themed lures are a subset, but they hit small and medium enterprises that lack full-time security staff.
What legitimate process looks like
Businesses apply for invoice number ranges through their local tax office. If staff need corrections, the bureau mails official paperwork with a contact phone printed on the letterhead. Government email, when used for routine notices, must end in .gov.tw without extra characters before “gov.”
Officials asked firms to verify suspicious messages through the 165 anti-fraud hotline or the toll-free tax service at 0800-000-321 before opening attachments.
Operational steps for finance teams
IT departments in Taipei are quarantining messages that mention “invoice track rejection” unless the sender domain matches an allowlist. Banks told commercial customers that sudden requests to change withholding accounts after a tax email should trigger a callback to known branch contacts.
With October bookkeeping peaks approaching, the bureau’s guidance is blunt: treat email rejection notices as fraudulent until proven otherwise, and keep paper trails for any real compliance work.