Invoice Scam Warning Signs: Spot a Fake Invoice

Quick answer: An invoice scam tricks a business into paying a fake invoice or sending a real payment to a criminal's account. Watch for invoices for things you didn't order, emails announcing new bank details, slightly misspelled sender addresses and pressure to pay fast. Before paying any changed or unfamiliar details, call the supplier on a number you already have. If you've paid, contact your bank immediately.

Invoice fraud works because paying invoices is routine. A fake invoice that looks like the real thing, arrives at a busy moment and asks for a plausible amount can slip through even careful businesses. This guide explains the common types of invoice scam, the warning signs, how to verify bank detail changes and exactly what to do if you have already paid. It also covers how to make your own invoices harder to fake, starting with consistent invoices from our free invoice generator.

Common types of invoice scam

1. Business email compromise and bank detail changes

Business email compromise (BEC) is the most damaging version. Criminals either break into a real supplier's or client's email account or register a lookalike domain, then send a message that looks entirely normal: "We've changed banks, please update our details before paying the attached invoice." Because the invoice amount, project and even the email thread can be real, nothing looks out of place except the bank account. The FBI's Internet Crime Complaint Center (IC3) has consistently listed BEC among the costliest frauds reported to it each year, with billions of dollars in reported losses. Its guidance on business email compromise explains the pattern.

2. Fake invoices for services you never ordered

The FTC warns small businesses about invoices for things like tech support, domain registration, directory listings or search engine optimization that were never ordered. Some impersonate well-known companies; some carry "past due" notices to rush you. Others are phishing in disguise, designed to get someone to click a link or open an attachment. See the FTC's alert on fake invoices for small businesses.

3. Fake PayPal invoice scams

Here, scammers use PayPal's genuine invoicing or money request feature, so the email really does come from PayPal. The invoice is for a purchase you didn't make (often a laptop, crypto or antivirus subscription), and the seller's note says something like "If you didn't authorize this, call our support line." The number belongs to the scammer, who will try to get you to install remote access software, share card details or "refund" them. The invoice is not a charge: nothing is taken until you pay it. Log in to PayPal by typing the address yourself, and report the invoice. Our guide on how to send a PayPal invoice shows what a genuine one looks like.

4. Phishing "remittance advice" and invoice attachments

Emails titled "Invoice attached" or "Remittance advice" with a link or attachment that asks you to log in or enable content are a common route to stolen passwords, which then enable BEC. A real remittance advice never needs your login.

5. Overpayment scams on the seller side

If you sell, watch for a "customer" who overpays by check or card and asks you to refund the difference by wire or gift card. The original payment later bounces or is charged back, and your refund is gone.

Invoice scam warning signs

Red flag	What to check
New or changed bank details	Always verify by phone using a number from your own records, not the email
Sender address slightly different	Compare letter by letter: rn vs m, .co vs .com, extra hyphens
Urgency or secrecy	"Pay today or service stops", "keep this confidential"
Goods or services you didn't order	Match to a purchase order or contract
Bank account in a different name or country	The account name should match the supplier's legal name
Unusual payment method	Gift cards, crypto or a personal account for a business payment
Invoice number out of sequence or format	Compare with previous invoices from that supplier
Phone number in a PayPal or app invoice note	Don't call; contact the platform directly
Request comes from an executive by email only	Confirm in person or by a known phone number

How to verify a bank detail change

This single control stops most BEC losses. Make it a written rule that nobody can skip:

1. Never act on bank changes received by email alone, even from a known address. The account may be compromised.
2. Call the supplier on a number you already have, from your records, a past invoice or their official website, not from the email or attached letter.
3. Speak to someone you know, and ask them to confirm the new account number and name, rather than reading it out to them.
4. Get a second person to approve the change in your payment system.
5. Log the check: date, who you spoke to, number called.
6. Be extra wary after a change. Watch the first payment to the new account and confirm with the supplier that it arrived.

Worked example: a check that saves $18,400

A design studio is due to pay a printer's invoice for $18,400. The day before, an email arrives from the printer's real address, in the same thread as the original quote, with a "corrected" invoice for the same $18,400 and new bank details. Everything matches except the account. The studio's rule says call before paying any new details, so the bookkeeper rings the printer's number from last year's invoice. The printer has not changed banks: its email was hacked. The studio pays the original account, and the printer changes its passwords and warns other customers. Total cost of the check: one five-minute call.

What to do if you paid a fake invoice

Act within hours, not days. The faster you report, the better the chance of stopping the money.

1. Call your bank's fraud line immediately. Ask it to recall or reverse the payment and to contact the receiving bank. The FBI recommends asking for a recall as soon as fraud is discovered.
2. File a complaint with IC3 at ic3.gov if you are in the US, with all the payment details (amount, date, receiving bank and account). The FBI's Recovery Asset Team works with banks to try to freeze funds in some domestic transfer cases.
3. Report to the FTC at ReportFraud.ftc.gov, and forward phishing emails to reportphishing@apwg.org, as the FTC suggests.
4. If you paid through PayPal or another app, report it to the platform right away and ask for a reversal.
5. If you paid by card, call your card issuer and dispute the charge.
6. Secure your email. Change passwords, turn on multi-factor authentication, check for forwarding rules you didn't create and tell your IT provider.
7. Tell the real supplier, since its systems or customers may also be targeted, and keep paying it only to verified details.
8. Keep every record: emails with full headers, invoices, bank confirmations and call notes.

Outside the US, contact your bank first and then your national fraud reporting service or police.

Controls that prevent invoice fraud

• Purchase orders and matching. Only pay invoices that match an approved PO and a delivery. See our purchase order template guide.
• Approved supplier list with verified bank details, changed only through the call-back process.
• Two people for new suppliers, bank changes and large payments.
• Multi-factor authentication on email and banking.
• Payment limits and positive pay or payee name checks if your bank offers them.
• Staff awareness: a short briefing on the patterns in this article.

These controls are part of good accounts payable practice, not just security.

How to protect your clients from fake invoices in your name

If you send invoices, criminals may impersonate you to your customers. Make it harder:

• Keep your bank details consistent and in the same place on every invoice. Our guide to bank details on an invoice covers what to show.
• Add a line such as: "We will never change our bank details by email. Please call us on [number] to confirm any change."
• Use a consistent invoice number format from a tool like our invoice number generator, so out-of-sequence fakes stand out.
• Use one recognizable design. A consistent template, such as the corporate template, makes an odd-looking invoice easier for clients to question.
• Tell clients in advance if you genuinely change banks, by phone as well as in writing.
• Protect your email account with strong, unique passwords and multi-factor authentication.

Note that a PDF can be edited by anyone who has it, so these steps reduce risk rather than eliminate it. Verification by phone remains the strongest control.

Next step

Write a one-paragraph payment policy today: no bank detail changes without a call-back to a known number, and two approvals for new suppliers and large payments. Share it with everyone who can pay invoices, and add the "we will never change bank details by email" line to your own invoice template.