your company receives a ZIP file with an invoice

Yet another reason to delete without opening the attachment. so many companies deliberately send emails and text messages that look suspicious (for tracking, or shortening the link “for the convenience of users”, or just incompetence); you can’t both educate the user not to open them, and at the same time allow your company to send suspicious looking links.