u/laleric

I need some help figuring out if this is a highly targeted scam or a legitimate invoice.
I recently received an email containing a PDF invoice for an "Unreturned Advance Exchange Fee". The sender email is ⁠ADVEX@MICROSOFT.COM⁠. 
Here is what is really tripping me up and making me second-guess:

The details of the item on the invoice (a Surface Laptop) and the serial number of the returned item is correct. 

My personal and organization details listed in the "Bill To" and "Ship To" sections are 100% correct. 

The invoice claims to be from "MICROSOFT PTY LIMITED" based in North Sydney, Australia, and the total amount is listed in AUD. 

**The Red Flag:** The "Remit to Bank" section instructs me to send payment to "BANK OF AMERICA". 

I am based in the Asia Pacific region, so seeing Bank of America as the payment destination feels incredibly suspicious, even though Microsoft is a US-based company.
Has anyone else dealt with this before? Is it normal for Microsoft's APAC/Australian branches to use Bank of America for direct wire transfers, or is this just a very sophisticated, highly personalized spoofing attempt using an email address like **⁠ADVEX@MICROSOFT.COM**⁠? 

Customer Success Manager from MS hasn’t replied in a week where I asked if this is legit and I should reply to it.

Also btw device was returned within directed time frame.

Any advice would be greatly appreciated!

Edit 1:
- Completely failed SPF/DKIM/DMARC checks (spoofed from a rogue Azure IP)

- The PDF was manually altered using an open-source tool (pdf-lib ([https://github.com/Hopding/pdf-lib]) over two weeks after the invoice date.

The main concern: Because they have our actual order details and serial numbers, it strongly suggests a compromised inbox - either a vendor we work with or someone internally. One of the Excel file from that email has someone from Accenture as Author.

I need some help figuring out if this is a highly targeted scam or a legitimate invoice.
I recently received an email containing a PDF invoice for an "Unreturned Advance Exchange Fee". The sender email is ⁠ADVEX@MICROSOFT.COM⁠. 
Here is what is really tripping me up and making me second-guess:

The details of the item on the invoice (a Surface Laptop) and the serial number of the returned item is correct. 

My personal and organization details listed in the "Bill To" and "Ship To" sections are 100% correct. 

The invoice claims to be from "MICROSOFT PTY LIMITED" based in North Sydney, Australia, and the total amount is listed in AUD. 

The Red Flag: The "Remit to Bank" section instructs me to send payment to "BANK OF AMERICA". 

I am based in the Asia Pacific region, so seeing Bank of America as the payment destination feels incredibly suspicious, even though Microsoft is a US-based company.
Has anyone else dealt with this before? Is it normal for Microsoft's APAC/Australian branches to use Bank of America for direct wire transfers, or is this just a very sophisticated, highly personalized spoofing attempt using an email address like ⁠ADVEX@MICROSOFT.COM⁠? 

Customer Success Manager from MS hasn’t replied in a week where I asked if this is legit and I should reply to it.

Also btw device was returned within directed time frame.

Any advice would be greatly appreciated!

Edit 1:

- Completely failed SPF/DKIM/DMARC checks (spoofed from a rogue Azure IP)

- The PDF was manually altered using an open-source tool (pdf-lib ([https://github.com/Hopding/pdf-lib]) over two weeks after the invoice date.

The main concern now: Because they have our actual order details and serial numbers, it strongly suggests a compromised inbox - either a vendor we work with or someone internally. One of the Excel file from that email has someone from Accenture as Author.