How to Spot a Fake Invoice or Payment Request Before You Approve It
Key Takeaways
You're staring at an invoice that looks completely normal. The logo matches, the vendor name checks out, and the amount seems roughly right. You've paid this supplier before. So you approve it.
A few days later, the real supplier calls asking why their payment is late.
This is how invoice fraud works. It doesn't need malware or a hacked system. It just needs a moment of routine, a familiar-looking document, and someone who's too busy to look twice. According to the Association for Financial Professionals (AFP), 74% of organizations were hit by business email compromise in 2025, which is the most common delivery method for fake invoice attacks.
The good news: fake invoices almost always leave clues. You just need to know where to look.
What makes fake invoices so convincing?
Fraudsters don't rush. They study how legitimate invoices look, copy logos and formatting, and time their attacks to land during busy periods like end-of-month or during a personnel transition.
The most effective schemes fall into a few categories:
- Vendor impersonation: A scammer creates an email address that looks nearly identical to a real supplier's. One letter off. A number swapped for a letter. Easy to miss.
- Compromised supplier accounts: In more sophisticated attacks, a fraudster actually gains access to a real vendor's email account and slips a fake invoice with new bank details into an existing thread. The email comes from a real address. The conversation looks legitimate.
- Invoice redirect: A real invoice is intercepted and altered. Same vendor, same PO number, different bank account.
- Fake vendor billing: A completely fabricated company submits an invoice for services that were never provided, hoping it slips through a busy approval queue.
What these methods share is that they exploit trust, not technology. The ACFE's Report to the Nations found that billing schemes cause a median loss of $145,000 per case. That's not a rounding error. That's real money gone, usually with no way to get it back once the transfer clears.
The red flags to check before you approve anything
Most fake invoices give themselves away if you slow down long enough to look. Here are the signs that should make you pause.
The sender address is slightly off
Read the full email address, not just the display name. Scammers use lookalike domains like invoices@vendor-support.net when the real address is billing@vendor.com. A number substituted for a letter (payrol1.com instead of payroll.com) is a classic trick that's easy to miss at a glance.
If the domain changed at all from your previous correspondence, that's enough reason to stop and verify before doing anything else.
Bank details have been updated
A request to update payment details mid-relationship is one of the highest-risk signals in any invoice. Legitimate vendors don't often change their bank accounts, and when they do, they typically notify you through multiple channels and follow up with a call.
If an invoice arrives with new banking information and you weren't expecting it, don't process it. Call the vendor directly using the number you have on file, not the one on the invoice itself.
The language feels urgent or secretive
"Please process today," "Don't mention this to your manager," "This is time-sensitive." These phrases aren't accidental. Urgency is a deliberate pressure tactic built to make you skip the steps that would catch the fraud.
A real vendor doesn't need you to bypass your approval process. Anyone who does is a red flag.
The invoice is vague on what was actually delivered
Scan the line items. Do they describe real, specific services or products? Or is it something generic like "consulting services" or "monthly retainer" with no supporting detail? Vague descriptions are common in fake invoices because there's no real service to describe.
Compare it to previous invoices from the same vendor. If the format, language, or level of detail is suddenly different, that shift is worth questioning.
The amounts don't match any purchase order
Most businesses use purchase orders as a way to pre-approve spending. An invoice that doesn't correspond to a PO, or where the amounts don't match, should go through a manual review before it gets paid.
This is called three-way matching (PO, receipt, invoice), and it's one of the simplest safeguards against fraudulent billing.
The invoice arrived out of nowhere
Did you receive a service, order goods, or enter into a contract with this vendor? If you can't connect the invoice to a real business interaction, treat it as suspicious until proven otherwise.
Fake vendor billing schemes count on invoices getting lost in the noise. The question "did we actually buy this?" sounds obvious. It still gets skipped more than you'd think.
What to do when something feels off
Slowing down is the most important thing you can do. Here's a straightforward process to follow when an invoice raises any of these flags.
- Don't pay while uncertain. Delaying payment by 24 hours to verify costs nothing. Paying the wrong account can cost everything.
- Call the vendor directly. Use the contact number you already have in your records, not the one listed on the suspicious invoice. Confirm the details verbally.
- Check your email thread carefully. Look for any sudden changes in the reply-to address or tone. A compromised email account sometimes shifts writing style or drops details that the real person would have included.
- Report it internally. If you work within a team or organization, flag suspicious invoices to a manager or your finance lead. One person's instinct might be the thing that prevents a costly mistake.
- Report it externally if fraud occurred. In the US, the FBI's Internet Crime Complaint Center (IC3) accepts reports of business email compromise and invoice fraud. Filing a report creates a record and can help others.
Why this is harder to spot than it used to be
Scammers have access to the same tools everyone else does. AI-generated text is now fluent and error-free. Logos can be scraped from a company website in seconds. Invoice templates are widely available. The quality bar for a convincing fake has dropped considerably.
The FBI's IC3 tracked $3.04 billion in reported losses from business email compromise in its most recent annual report. That figure only captures what gets reported. The true number is higher.
This isn't about being careless. It's about scams that are genuinely built to look legitimate. The best protection is process, not just vigilance. Consistent verification habits beat one-time scrutiny every time.
A note on personal invoice scams
Invoice fraud isn't only a business problem. Individuals receive fake payment requests too, often disguised as invoices from subscription services, utilities, or tech companies claiming a payment failed or an account needs renewal.
The same principles apply. Check the sender address carefully. Don't click links inside the invoice. Go directly to the company's official website and log in to check your account status. If you didn't trigger the payment or don't recognize the service, don't pay it.
If you're browsing the web and get redirected to a page demanding payment or threatening account suspension, that's a scam. Close the tab.
Conclusion
Fake invoices work because they're built to blend in. They look like the thing you approve every week. The moment you pause, check the email address, verify the bank details, and confirm the vendor actually did the work, you've already broken the attack.
It's not about being suspicious of everyone. It's about having a short checklist that becomes habit. Most fraudulent invoices collapse under even basic scrutiny. The ones that don't are caught when you pick up the phone and call.
FAQs
How can I tell if an invoice is fake?
Check the sender's full email address for subtle misspellings, look for changed bank details, watch for vague line items, and verify that the invoice matches an actual purchase order or agreement. If anything seems off, call the vendor directly using a contact number from your own records, not the one on the invoice.
What is the most common type of invoice fraud?
Business email compromise (BEC) is the most common route for invoice fraud. Fraudsters either spoof a vendor's email address or compromise a real account, then send invoices with altered payment details. The AFP's 2026 survey found that 74% of organizations encountered BEC in 2025.
What should I do if I've already paid a fake invoice?
Contact your bank immediately and ask them to recall the transfer. File a report with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. Speed matters since international transfers are much harder to reverse once they clear.
Do fake invoice scams only target businesses?
No. Individuals also receive fake payment requests disguised as subscription renewals, utility bills, or tech support invoices. The red flags are the same: unexpected requests, mismatched sender addresses, and urgent payment language.
Why do scammers change the bank account on an invoice?
Changing the bank account is the core mechanic of most invoice fraud. If you pay the new account, the money goes to the attacker, not the vendor. Legitimate suppliers rarely change banking details without proactively notifying you, and they never ask you to verify through the invoice itself.
Can Guardio help protect against invoice-related scams?
Guardio detects and blocks malicious links and phishing pages, including fake payment portals or spoofed vendor sites you might land on after clicking a link in a fraudulent invoice. Guardio adds a real-time layer of protection on both your computer and your phone.
