With a help from Oliver who pointed me into right direction, I corrected my filter and improved on it. And I also aded checking for the file extension.
So my filter now looks like this:
qr'(invoice|scan|rechnung|fattura){1,}.*(doc|xls|docx|xlsx){1,}'ix, # Ban
anything that sounds like invoice and is opened by Microsoft office.
Hope this helps someone else too.
Best regards,
Tone Kravanja
