How to Spot a Fake Invoice Before You Pay: 12 Red Flags
You open your inbox on a Monday morning and there's an invoice for $4,800 from a supplier you know — "updated bank details, please use the new account for this payment, it's urgent." Everything looks right: the company name, the invoice number sequence, even the signature of the account manager you deal with. So you pay it. Three days later the real supplier calls asking why you haven't paid — and the $4,800 is gone.
That is payment redirection, the most common form of invoice fraud, and it happens to small businesses every week. This guide shows you how to spot a fake invoice before you pay it: the red flags to check, the bank-detail-change scam in detail, a simple verification workflow that would have stopped it, what to do if you've already paid, and how to protect your own invoices from being spoofed.
The main types of invoice fraud
Fake invoices come in a few distinct flavours. Knowing which one you're dealing with helps you check the right things.
1. Payment redirection (bank-detail-change scam). The most common and most expensive type. You receive an invoice — or an "updated bank details" notice — that looks like it comes from a real supplier, but the bank account has been changed to one the fraudster controls. The fraudster either hacks the supplier's real email account or creates a lookalike email address (like supplier.com spelled with an extra letter) to send the message.
2. Business email compromise / CEO fraud. An email that appears to come from a boss or senior executive, requesting an urgent, confidential payment or transfer. It may arrive when the executive is known to be travelling. The request pressures the recipient to skip normal approval procedures.
3. Bogus invoices for goods you never ordered. A simpler scam: an invoice arrives for services you never requested — tech support, directory listings, domain renewals, SEO services. It looks official enough that a busy person processing payables just pays it. The US Federal Trade Commission (FTC) specifically warns small businesses about these, noting that scammers sometimes slap a "past due" notice on them to create urgency.
4. Supplier impersonation for ongoing contracts. A fraudster who has researched your business (from your own website or social media) impersonates a supplier or contractor and asks you to update your payment records. This can also include intercepting an invoice mid-thread and re-sending it with altered bank details.
How to spot a fake invoice: the 12 red flags
Check every incoming invoice against these before you pay it.
Red flags in the email itself
1. Lookalike sender addresses. Expand the full sender address — don't trust the display name. Fraudsters register domains that differ by one letter (acm3.com vs acme.com), swap .com for .co.uk, or use odd subdomains. A mismatch between the display name and the actual address is one of the most reliable tells.
2. The "correct" address still isn't safe. If the supplier's actual email account has been hacked, the email comes from the genuine address. That's why no single check is enough — an email that passes the address test can still carry fake payment details.
3. Urgency and pressure to skip normal procedure. "Please pay today," "urgent — new account," "don't worry about the usual approval, the boss is away." Legitimate suppliers don't need you to bypass your own payment process. Treat urgency as a reason to slow down, not speed up.
4. Requests for secrecy. "Please keep this between us." Real payment instructions never need to be hidden from your own finance team.
5. Changed contact details. If the email signature lists a different phone number or address than the ones you have on file for that supplier, that's a strong signal the account has been compromised — even if the email address itself is genuine.
Red flags on the invoice document
6. Bank details differ from what you have on file. This is the single most important check. Compare the account name, sort code / routing number, and account number against previous invoices from the same supplier — not against what's printed on the invoice itself. Australia's Scamwatch lists changed bank details as the top warning sign, and cases have shown the bank detail change was the only sign anything was wrong.
7. Amounts just under your approval threshold. Some fraudsters price fake invoices deliberately below common authorisation limits (like £500, $1,000) so they slip through without senior review. Be suspicious of invoices that conveniently sit just under the point where a second person would need to sign off.
8. No purchase order number, or one that doesn't match. If your business uses purchase orders, every invoice should reference one that exists in your system. A missing, vague ("various services"), or unmatchable PO number is a red flag. See our guide to how to invoice against a purchase order.
9. Quality and consistency errors. Misspelt company names, grainy logos that look cut-and-pasted, odd formatting, generic greetings, grammar mistakes from a supposedly professional supplier, wrong tax/VAT numbers. Legitimate invoices from an established supplier look the same every time — compare with a previous one side by side.
10. Invoices for goods or services nobody ordered. If no one in the business recognises the supplier or the work, it probably isn't real. Check with the team member named on the invoice (if any) before paying — and do that check on a channel the email didn't provide.
Red flags in the payment instructions
11. A new or different payment method. "We now only accept wire transfer" or a switch from your usual method (bank transfer to card, or to a payment app) — especially combined with urgency — should always trigger a verification call.
12. The account name doesn't match the supplier name. Your bank may flag that the account name differs from the intended recipient (in the UK, Confirmation of Payee warnings do exactly this). Take that warning seriously — a mismatch between who you think you're paying and whose name is on the account is one of the strongest signals in the whole list.
The bank-detail-change scam, step by step
Because this is the scam that costs businesses the most, it's worth understanding exactly how it unfolds:
- Research. The fraudster finds a real supplier relationship — from your website, press releases, social media, or by compromising the supplier's email.
- Preparation. They craft an email on a lookalike domain or take over the supplier's real inbox. They may insert a message into an existing invoice thread, so the context looks completely genuine.
- The ask. The email announces "new bank details" or re-sends an expected invoice with altered account numbers. It often arrives near a real payment date, uses the correct invoice references, and asks for the details to be updated "going forward."
- The payment. You update your records and pay a legitimate invoice — into the fraudster's account. The real supplier never sees the money.
- Discovery. You find out weeks later when the real supplier chases you for non-payment. By then, the funds have been moved on and are usually unrecoverable.
The lesson from step 2 is the crucial one: the email can be perfect and still be fraud. That's why the defence is procedural — always verify changed bank details through an independent channel, every single time.
A verification workflow that stops fake invoices
You don't need expensive software to defeat invoice fraud. You need a short, consistent routine — and the discipline to follow it on every invoice, not just the suspicious-looking ones. Here's a workflow that works for freelancers and small businesses:
Step 1: Match before you pay. Check every invoice against a purchase order or an agreed contract. Did we order this? Did the work happen? Is the amount what we agreed? If any answer is "not sure," the invoice waits.
Step 2: Compare bank details against your own records. Keep a trusted list of supplier bank details (from the contract or the first invoice). Every new invoice gets compared against your records, not against itself.
Step 3: Call back on changed details. If the bank details on the invoice differ from your records — or if an email asks you to update them — call the supplier on a phone number you already have on file (never the number in the email or on the invoice). One two-minute phone call is the cheapest insurance in business. Action Fraud, the UK's national fraud reporting centre, makes this its headline advice: never respond to the contact details supplied by someone requesting changes to financial details.
Step 4: Split the roles. Even in a tiny business, separate the person who approves the invoice from the person who sends the payment. One person can do both — but two people must agree. No invoice gets paid without a second pair of eyes on it, at least for anything above a modest threshold you set.
Step 5: Watch your own inbox for compromise. Fraudsters need a way in. Use strong, unique passwords and two-factor authentication on your business email and accounting software, and check your email's forwarding rules periodically — an automatic forward to an external address is a classic sign an account has been taken over.
Step 6: Train anyone who touches payments. Write the routine down — one page. Make sure holiday cover and new starters read it. A surprising amount of fraud lands when the regular person is away, because the cover doesn't know the normal procedure.
What to do if you already paid a fake invoice
Speed is everything. The sooner your bank acts, the better the chance of recalling the payment — and recovery becomes much less likely with every passing hour. Don't feel embarrassed; reporting quickly is what matters.
In all countries — act immediately:
- Call your bank's fraud department now. Ask them to attempt a recall and to contact the receiving institution.
- Gather everything: the invoice, the emails, payment confirmations, bank statements.
- Notify the genuine supplier — they may not know their account was compromised, and other clients may be at risk.
United Kingdom. Report to Action Fraud, the national fraud and cybercrime reporting centre: 0300 123 2040 or actionfraud.police.uk. Note that incidents of invoice fraud are underreported, so your report genuinely helps map the true scale.
United States. Report the fraud to the FTC at ReportFraud.ftc.gov, and file a complaint with the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. Forward phishing emails to [email protected].
Australia. Report to Scamwatch (scamwatch.gov.au) and ReportCyber (cyber.gov.au). Scamwatch's small-business guidance confirms false billing is the most reported scam type among small businesses, and that most such reports relate to payment redirection.
Canada. Report to the Canadian Anti-Fraud Centre at 1-888-495-8501 (or online at antifraudcentre.ca), and file a report with your local police — identify the incident as "BEC" or wire fraud. The CAFC advises businesses that funds have been transferred to immediately ask their financial institution about recalling the transfer.
Protect yourself as the invoice SENDER too
Fraud isn't just something that happens to you — your own invoices can be the target. If a fraudster intercepts the invoice you send and swaps your bank details before it reaches your client, you look guilty and you don't get paid.
Protect your email domain. Set up SPF, DKIM, and DMARC records on your domain so fraudsters can't spoof your email address. These records tell receiving servers that only your mail is genuine — they're the technical fix for "an email that looks like it came from you."
Tell clients how you'll communicate payment details. Add a line to your invoice (see our invoice email templates): "My bank details never change — if you receive a message saying they've changed, it's a scam. Call me." Clients who know your policy can't be tricked by a fake update.
Send invoices as secure links, not just PDFs. An emailed PDF can be intercepted and re-sent. Our free invoice generator produces clean, professional invoices — but whichever tool you use, consider sending invoices through an accounting platform or secure link where the document can't be quietly swapped.
Add bank details in a consistent, verifiable way. Put your bank details on every invoice identically, and keep them stable. If a client has paid you three times to the same account and suddenly receives a different one, their verification routine (see above) should catch it — help them by making your details boring and predictable.
Watch for "your client got scammed" scenarios. If a client tells you they paid your invoice but you never received it, assume your invoice was intercepted. Warn your other clients immediately, report the incident, and review your email security. The FTC advises businesses whose email has been impersonated to notify customers promptly — ideally by a channel other than email.
Frequently asked questions
How can I tell if an invoice email is genuine?
No single check is enough. Look at the full sender address (not just the display name), compare bank details against your own records from previous invoices, match the invoice to a purchase order or agreement, and — most importantly — call the supplier on a number you already have on file before paying anything that looks even slightly unusual.
What is a payment redirection scam?
It's a scam where a criminal impersonates a supplier (usually by email) and tricks a business into paying a genuine invoice into the fraudster's bank account instead of the supplier's. It's also called business email compromise or invoice redirect fraud, and it's the costliest form of invoice fraud for most businesses.
Should I ever change a supplier's bank details by email?
Never change supplier bank details on the basis of an email alone. If you receive a bank-detail-change request, treat it as suspicious by default: call the supplier on a previously known number and confirm with a second contact at the company if possible. This single rule would stop most payment redirection scams.
What should I do if I receive an invoice for something I didn't order?
Don't pay it, and don't call the phone number printed on the invoice — look the company up independently. If the sender is a business you've never heard of, search their name along with "scam" or "complaint" to see what others report. Then report it to the relevant authority in your country (Action Fraud in the UK, the FTC at ReportFraud.ftc.gov in the US, Scamwatch in Australia, the Canadian Anti-Fraud Centre in Canada).
Can a fake invoice come from a real supplier's email address?
Yes. Fraudsters hack genuine supplier email accounts and send altered invoices from them. That's why the verification routine matters more than the sender address: always confirm changed payment details through a separate, trusted channel like a phone number you already have on file.
How do I know if my invoice was intercepted?
The warning sign is a client who paid but the money never arrived in your account — usually because they paid to altered bank details on an intercepted invoice. Other signs: clients mention payment confirmations you didn't send, or "your" emails asking for bank detail updates you never wrote. If this happens, warn all clients immediately and review your email security.
Does my bank protect me against paying a fake invoice?
Only partially. If the account name doesn't match the intended recipient, some banks (in the UK, for example) show a Confirmation of Payee warning — take it seriously. But banks generally can't reverse a payment you authorised yourself, which is why prevention (matching, call-backs, dual approval) matters far more than recovery.
How can I prevent my business email from being used in invoice scams?
Use a strong unique password and two-factor authentication on your business email, set up SPF, DKIM, and DMARC records on your domain so your address can't be spoofed, and review your email forwarding rules for anything you didn't set up. If staff handle payments, train them on the red flags in this guide.