A fake invoice scam can look routine: a familiar supplier name, a valid-looking invoice number, and a request to update bank details before payment. This guide gives you a repeatable way to decide whether an invoice or payment request is genuine, verify vendor changes through trusted channels, and document approval checks before money leaves an account.
Overview
Invoice fraud is a payment scam in which someone tries to make an organization pay a false bill, send money to a fraudulent account, or approve a legitimate-looking invoice for goods or services that were never ordered. A common form is the vendor bank change scam: an attacker impersonates a supplier and asks accounts payable to replace the supplier’s usual bank details.
These attempts may arrive by email, through an accounting platform, in a shared document, or after an attacker gains access to a real mailbox. A familiar display name or an existing email thread is not proof that the payment request is authentic. Treat every new invoice, refund instruction, payment approval, and bank-account change as a business transaction that requires verification.
The safest approach is to separate the request from the verification. Do not use the phone number, reply address, link, or contact details supplied in the suspicious message. Instead, compare the request with your records and contact the vendor through a trusted channel already held in your procurement or accounting system.
What to track
1. Vendor identity and contact details
Compare the legal or trading name, physical address, tax or registration details where applicable, telephone number, domain, and usual contact person with your approved vendor record. Look for subtle domain changes, such as an extra word, a different top-level domain, a substituted character, or a free-mail address where the supplier normally uses a company domain.
Do not rely on branding alone. Logos, signatures, invoice layouts, and copied email history can be reproduced. The strongest check is an independent callback to a known number, with the caller asked to confirm the invoice and destination account.
2. Purchase order and service match
Check whether the invoice matches an approved purchase order, contract, delivery record, project milestone, or completed service. Confirm the supplier, description, quantity, currency, billing period, tax treatment, and total. An invoice that has no internal owner or corresponding order should be paused until someone responsible for the purchase confirms it.
Be cautious when an invoice is marked as a correction, replacement, final notice, refund, or urgent adjustment but does not clearly identify the original transaction. A changed invoice should be linked to a prior record and approved under your normal process.
3. Invoice number, dates, and payment instructions
Track the invoice number, issue date, due date, amount, bank name, account identifier, payment reference, and requested payment method. Compare them with the supplier’s previous invoices. A new numbering pattern, unusual formatting, unexplained currency change, duplicate number, or sudden change in payment destination deserves additional verification.
Urgency is not evidence of fraud by itself, but pressure to bypass a purchase order, skip a second approver, keep the change confidential, or pay outside normal business hours is a significant warning sign. Legitimate suppliers should be able to tolerate a short verification delay.
4. Email, attachment, and link indicators
Inspect the full sender address rather than only the display name. Be careful with unexpected attachments, password-protected files, macros, executable content, and links that open a login page. A PDF is not automatically safe, and a familiar-looking sign-in page may be designed to capture credentials.
Save the original message and record its headers when your mail system allows it. Do not open suspicious files on a production workstation. If you need technical analysis, follow your organization’s security process or ask an authorized security team to handle the file.
Legitimate billing versus business email compromise
| Legitimate billing process | Business email compromise pattern |
|---|---|
| Matches an approved vendor, purchase order, or contract | Arrives without a recognizable business record or owner |
| Uses established contact and payment details | Requests a new bank account or payment route by email |
| Allows normal approval and callback procedures | Pressures staff to act quickly or bypass controls |
| Contains consistent invoice numbers, dates, totals, and tax information | Includes mismatched details, duplicates, unusual formatting, or unexplained changes |
| Can be confirmed through an independently sourced contact | Insists that confirmation happen only by replying to the message |
Cadence and checkpoints
Use a checkpoint every time a payment request changes an established pattern. A practical workflow is:
- Pause: Do not click links, open unexpected attachments, or release funds while a material discrepancy remains unresolved.
- Compare: Check the invoice against the vendor master record, purchase order, contract, prior invoices, and receiving or delivery evidence.
- Validate: Contact the vendor using a trusted phone number or known portal. Ask whether the invoice is genuine and whether the payment details are correct. For a bank change, confirm the change with an established vendor contact and, where appropriate, a second contact.
- Escalate: Send unusual requests to the designated finance, procurement, or security approver. Do not let the person who received the request be the only person who validates it.
- Document: Record who confirmed the request, when they confirmed it, which channel was used, and what details were verified.
- Release: Pay only after required approvals are complete. For high-value or unusual transactions, consider a second-person review immediately before submission.
Review vendor bank details on a scheduled basis, such as monthly or quarterly, according to the size and complexity of your organization. The review should identify dormant vendors, recently changed accounts, duplicate records, missing approval evidence, and suppliers whose payment details were updated without independent confirmation.
A short internal verification message can make the process consistent:
Hello [vendor contact],
We received invoice [number] for [amount] dated [date]. Before processing it, please confirm the invoice and the payment details ending in [last few characters or other safe identifier]. We are contacting you through a known channel because our policy requires independent confirmation of payment instructions. Please do not send passwords or full account credentials.
Thank you,
[name and department]
Use a known contact method for this message, not the reply function on a suspicious email. Avoid sending sensitive account information unnecessarily; ask the vendor to confirm a safe identifier or complete the verification through an established portal or phone process.
How to interpret changes
Not every difference means an invoice is fraudulent. A supplier may legitimately change banks, update its legal name, move offices, revise tax information, or adopt a new billing system. The question is whether the change is supported by independent evidence and follows the organization’s normal process.
One warning sign may justify a question. Several connected warning signs should usually result in a payment hold. For example, a new bank account combined with an urgent deadline, a lookalike domain, and a request to keep the change confidential is more concerning than a formatting change on an invoice that matches an approved purchase order and is confirmed by a known supplier contact.
Use risk-based decisions rather than relying on a single “scam score.” A technically clean email can still carry a fraudulent payment request, particularly if an attacker has accessed a real account. Conversely, a legitimate invoice may contain a minor typo. Focus on authorization, transaction history, independent confirmation, and whether the request fits the relationship.
If funds have already been sent, contact the sending bank or payment provider immediately and ask what recovery or recall options are available. Preserve the messages, invoices, payment records, and call notes. Notify the relevant internal security and finance contacts, then follow your organization’s incident process. For related account compromise or identity concerns, use the recovery and reporting checklist.
For broader message verification, see the online scam checker workflow and the guide to checking suspicious texts, emails, and calls.
When to revisit
Revisit this guide whenever a supplier announces new payment details, a finance platform changes, a new approver joins the process, or your organization experiences a suspicious invoice. Schedule a monthly or quarterly review of vendor records and payment controls, depending on transaction volume and risk.
Editors and security teams should also refresh internal examples when common impersonated vendors, phishing techniques, banking terminology, tax requirements, or payment-platform reporting routes change. Keep the process current without copying unverified advice from a suspicious message.
Before releasing any unusual payment, ask five final questions:
- Does the invoice match a real order, contract, delivery, or completed service?
- Does the sender match the vendor record, not merely the display name?
- Have any changed payment details been confirmed through an independent trusted channel?
- Has the required second-person approval been completed?
- Could the transaction wait until the discrepancy is resolved?
If any answer is uncertain, pause the payment and escalate it. A consistent verification habit is more reliable than trying to recognize every new fake invoice scam by appearance.
