How To Spot A Fake Invoice Before It Gets Paid
Invoice fraud costs more than ransomware for most small businesses. It is also the easiest to stop.
In short: a fake invoice is usually a real invoice with the bank details changed. Verify any change of account by voice on a number you already had, and never trust the number printed on the invoice itself.
A fake invoice does not look like a scam. It looks like an invoice, often a real one from a real supplier, with one line changed. That is why it works.
This is the fraud that takes the most money out of small businesses in Georgia, and one habit stops nearly all of it.
The Five Things That Give It Away
Bank details that have changed. Any email telling you a supplier has new account details is a fake invoice until proven otherwise. This single sign accounts for most of the losses.
Urgency. Real accounts payable teams do not need it paid this afternoon. Pressure exists to stop you checking.
A slightly wrong address. Look at the sending domain character by character, not at the display name. A swapped letter is easy to miss and easy to register.
An amount that is plausible but not familiar, or a reference that does not match your purchase order.
A reply-to address that differs from the from address. Most email clients hide this. It is worth learning where yours shows it.
If Money Has Already Gone
Speed changes the outcome more than anything else, so act before you investigate. Call your bank immediately and use the words fraudulent payment and recall. Banks can sometimes stop or recall a transfer, but that window is measured in hours rather than days.
Then call us at 678-374-4352. A fake invoice usually means somebody had access to an email account, either yours or your supplier’s, and that access needs closing before it is used again. Payment recovery and account security are two separate jobs and both need to start.
Keep everything. Do not delete the email, do not reply to it, and do not forward it to the supplier as a warning until we have looked at the headers. They are evidence for the bank and the insurer. Then tell your team plainly what happened, because businesses that hide it get hit a second time by the same attacker.
An Invoice For Something Nobody Ordered
A $389 bill arrives for a business directory listing renewal, complete with a logo, a due date and a late fee warning. Nobody remembers ordering it, but the amount is small enough that it nearly gets paid just to make it go away.
Not every fake invoice copies a real supplier. Some bill for services that never existed, so ask who approved the purchase before asking whether the price looks right.
Payment Habits That Let A Fake Invoice Through
Replying to the email to ask whether the new details are real. If the mailbox is compromised, the attacker reads your question and answers it, so nothing said in that thread proves anything.
Signing in to view an invoice. A real supplier sends the document or uses a portal you already know, and never needs your work password to show you a PDF. A fake invoice link that asks you to sign in is a phishing page, so close it.
Trusting a phone call that arrives after the email. Fraudsters often ring to confirm the change themselves, sometimes with a convincing voice, so an incoming call proves nothing. Only a call you place yourself counts.
Saving new bank details into the accounting system straight from an email. Once stored, every future payment follows them with nobody looking again, so supplier records should change only after a confirmed check.
Invoice Problems To Bring Straight To Us
Ring 678-374-4352, option 1, if a supplier says they never sent an invoice that came from their real address. That points to a mailbox in someone else’s hands, and the security line is answered 24/7.
Call as well if you opened an attachment or entered a password through a fake invoice link, even if nothing seemed to happen. Say whether the email reached other people too.
For a second opinion on an unpaid fake invoice where nothing was clicked, the help desk can look Monday to Friday, 8 AM to 5 PM Eastern.
Why This Attack Works On Careful People
A fake invoice is not a badly spelled scam email. The good ones are copies of a real invoice from a real supplier you actually use, for work that was actually done, arriving at roughly the right time of the month.
That is because the attacker has usually been reading somebody’s email for weeks. Sometimes yours, more often your supplier’s. They know the format, the amounts, the names, and the rhythm. Then they send the same invoice with one field changed.
This is why being careful is not enough on its own, and why nobody should feel foolish for nearly falling for it. Careful people fall for it constantly, because there is nothing obviously wrong with what they are looking at.
The only reliable defense is a process that does not depend on the invoice looking suspicious.
The One Rule That Stops Almost All Of It
Any change to bank details gets verified by voice, on a number you already had, before a payment goes out. No exceptions, no matter how routine it seems and no matter who appears to have sent it.
The number you already had is the important part. A fake invoice will helpfully include a phone number, and the person answering it will confirm the details cheerfully. Use the number from your own records, from a previous invoice, or from the supplier’s website you navigated to yourself.
Say out loud what you are checking. I have an invoice here changing your account to one ending in these four digits, can you confirm. A real supplier will confirm it in ten seconds and will not mind being asked.
This single rule stops the overwhelming majority of fake invoice losses, and it costs one phone call a year in most businesses.
Building The Check Into How You Actually Pay
A rule that lives in one person’s head fails the week that person is on vacation. Write it into the payment process instead.
The version that works in most small offices is simple. Any new supplier, or any change of bank details, requires a voice confirmation logged with the date and the name of the person who confirmed. Any invoice over an agreed amount requires a second pair of eyes.
Two people is not about distrust. It is that the second person is not in the flow of the conversation and is far more likely to notice that the domain has an extra letter in it.
If your accounting software supports approval workflows, use them. If it does not, a short note in the payment record is enough. The point is that the check happened and can be seen to have happened.
And tell whoever handles payments that they will never be criticized for delaying a payment to verify it. That permission is what makes the process survive contact with a pushy email.
Related Guides And What To Have Ready
Two closely related reads: spotting phishing emails, since a fake invoice usually arrives after a phishing success, and reporting a security incident. More in Security and phishing.
If you are calling us about a fake invoice, have ready: the supplier name, the amount, whether the payment has gone, the email address it came from, and whether any bank details changed.
Call 678-374-4352. If money has moved, call your bank first and us second.
The FBI publishes annual figures on this attack, which they classify as business email compromise: IC3 internet crime reporting.
A Fake Invoice Checklist For Whoever Pays
Print this and put it wherever payments are approved. It is written for the person under time pressure.
- Do you recognize the supplier and the work described?
- Have the bank details changed since the last payment? That is the fake invoice signal.
- Verify any change by voice, on a number you already had.
- Never use the phone number printed on the invoice itself.
- Check the sender address character by character, not at a glance.
- Is there pressure to pay today? Urgency is the second fake invoice signal.
- Does anything ask you to keep the payment quiet?
- Does the amount match what you expected for this work?
- For a new supplier or a changed account, get a second pair of eyes.
- Log who confirmed the details, by voice, and on what date.
A real supplier will confirm details in ten seconds and will not mind being asked. That is the whole test.
Who Gets Targeted With A Fake Invoice
The attack is tailored, and the tailoring differs by industry.
Law firms. Firms get fake invoice attempts around closing dates, when a large transfer is expected and everyone is busy. Any change to payment details near a closing should be treated as hostile until verified by voice.
Distribution and logistics. Distributors receive genuine invoices constantly, which is exactly what makes one more invoice invisible. Volume is the vulnerability, so the control has to be in the process rather than in anyone’s attention.
Manufacturing. Manufacturers tend to have fewer, larger supplier payments, which makes a single successful fake invoice far more costly. Here the second pair of eyes above an agreed threshold is the control that matters most.
If money has already gone, call your bank first and then us at 678-374-4352. Minutes matter.
Questions About Spotting A Fake Invoice
Call them on a number you already had and confirm verbally. It takes two minutes.
Both. It usually starts with a compromised mailbox somewhere in the chain.
It helps, but the verbal callback rule stops more of it than any filter.
The bank, then us at 678-374-4352.