Invoice Phishing Scams: How to Spot Them and Stop Them
Invoice phishing is a scam where fraudsters send a fake or altered invoice designed to trick your finance team into paying money to an account they control. The moment a suspicious invoice lands in your inbox, the correct move is simple: don’t click any link, don’t call any number printed on the document, and verify the request through a phone number or contact you already had on file before the email arrived. If money has already gone out, contact your bank immediately and report the incident.
TL;DR:
- Verifying bank details through out-of-band confirmation significantly reduces the risk of payment redirection scams.
- Automating duplicate detection and routine audits can catch suspicious invoices before payments are processed.
- Susceptible invoices often contain urgent language, odd email domains, or request immediate action, which should trigger escalation.
- Vendor records should be regularly cleaned and checked for dormant or duplicate entries to prevent impersonation.
- Out-of-band verification and strict segregation of duties offer the strongest defenses against invoice fraud.
Table of Contents
- What Invoice Phishing Scams Actually Are (and Why They Work)
- Common Types and Examples of Invoice Fraud
- Red Flags That Signal a Fake Invoice
- Prevention Controls Every AP Team Needs
- What to Do if You Suspect Fraud or a Payment Has Already Gone Out
- A Compact Checklist for AP Teams to Adopt This Week
- How Invoicing Tools Fit Into Fraud Detection
- Why Speed Beats Verification, and What to Do About It
- A Practical Way to Keep Your Own Invoices Verifiable
- Sources
What Invoice Phishing Scams Actually Are (and Why They Work)
Attackers behind invoice phishing scams want one of three outcomes: redirect a legitimate payment to their own bank account, get you to pay for goods or services that never existed, or quietly inflate a real invoice and pocket the difference. What makes this fraud different from a typical phishing email asking you to reset a password is that it targets a process your accounts payable team runs dozens of times a day.
That routine is exactly the weakness. An invoice looks boring by design. It has a logo, a total, a due date. Staff processing forty invoices before lunch aren’t scrutinizing each one like a detective. A scammer who sends a document that mimics a known supplier’s format, with a slightly different bank account tucked into the payment details, can slip straight through if nobody checks it against the original vendor record.
A real-world pattern: a finance clerk gets an email that appears to come from a regular supplier, saying the company has “changed banks” and attaching an updated invoice with new account details. Nothing about the email looks unusual. The logo matches. The tone matches. Only the account number is different, and it’s the account number nobody double-checks against a phone call.
- Payment diversion (the most financially damaging variant)
- Phantom invoices for goods or services never delivered
- Overbilling on genuine, recurring supplier relationships
Common Types and Examples of Invoice Fraud
Invoice scamming techniques cluster into a handful of repeatable patterns, and recognizing the pattern is often faster than trying to inspect every field on every invoice.
- Business Email Compromise (BEC) and vendor impersonation. A scammer compromises or spoofs a supplier’s email account, then sends an invoice from what looks like a trusted address. NCSC guidance treats this as one of the costliest fraud categories precisely because it exploits an existing, trusted relationship rather than a cold approach.
- Fake vendor or ghost supplier invoices. The invoice comes from a company that doesn’t exist, or exists only on paper, betting that a busy AP team won’t check whether the vendor is real before paying a modest, unremarkable amount.
- Altered invoices or payment-detail-change scams. A genuine invoice gets intercepted and edited, or a “we’ve changed banks” notice arrives separately, redirecting a real payment to a fraudulent account. Intake-stage controls catch this category more reliably than any later review.
- Phantom invoices and refund/callback scams. These arrive for a subscription or service you never bought, urging you to call a number to “cancel” or dispute the charge, at which point the scammer tries to extract card details or remote access.
Red Flags That Signal a Fake Invoice
Most fraudulent invoices give something away if you slow down for thirty seconds before approving payment. Train your AP team to treat these as a checklist, not gut feel.
- Urgency or pressure language. “Payment overdue,” “final notice before legal action,” or a request to process something outside normal hours.
- Amounts sitting just below your approval threshold. Scammers often size the invoice to avoid triggering a second signature.
- A first-time or dormant vendor appearing without the usual onboarding paperwork.
- Odd email domains. A supplier’s real domain is “acmesupplies.co.uk” but the invoice comes from “acme-supplies-ltd.com.”
- Placeholder text like #TFN# or #PRICE#, poor grammar, or an attachment that doesn’t match the supplier’s usual format. Threat researchers at Malwarebytes recently caught a live campaign still using unfilled merge fields, which is a reliable sign the message came from a mass-scam template rather than a real supplier.
- A request to call a number printed on the invoice itself rather than one already on file.
Pro Tip: Any invoice that pushes you to act fast, call a new number, or skip your usual approval step should go straight to a hold-and-escalate queue, no exceptions, no matter how senior the supposed sender is.
Prevention Controls Every AP Team Needs
Preventing invoice fraud comes down to a handful of unglamorous, repeatable checks rather than one clever piece of software. Segregation of duties is the foundation: the person who sets up a new vendor in your system should never be the same person who approves that vendor’s payments, because that split is what stops one compromised inbox from becoming one paid fraudulent invoice.
From there, build in:
- Three-way matching between the invoice, the purchase order, and confirmation that goods or services were actually received, with mandatory matching above a set value threshold.
- Out-of-band verification for any bank-detail change. Call the supplier using a number from your own records, never one printed on the invoice or email in question. National guidance consistently ranks this as the single highest-value control against vendor impersonation and BEC.
- Vendor-master hygiene. Purge dormant suppliers and deduplicate vendor records regularly, since inactive or duplicate accounts are common cover for impersonation.
- Automated duplicate detection and anomaly monitoring to flag invoices that repeat a reference number, amount, or vendor detail in a way that doesn’t match normal patterns.
Catching a fraudulent invoice at intake is far cheaper than trying to claw back a payment after it’s left your account, and layered controls including duplicate detection and routine AP audits consistently outperform relying on any single check alone. Payment-redirection fraud specifically responds well to verification discipline built into the payment step itself, something industry guidance on push payment fraud covers in more operational detail.
What to Do if You Suspect Fraud or a Payment Has Already Gone Out
- Don’t use any phone number or link from the suspicious invoice. Scammers often staff those lines specifically to sound convincing.
- Preserve the original email, headers, and attachment rather than deleting or forwarding it in a way that strips metadata.
- Verify independently by calling your supplier on a number pulled from past correspondence or your own vendor records, not anything supplied by the suspicious message.
- Call your bank immediately if money has already moved. Ask about recall or stop-payment options; the earlier you flag it, the better the odds of recovery.
- Report the incident to Action Fraud and forward the phishing email to your supplier’s abuse address if one is published.
- Document everything for your own audit trail, including who received it, when, and what actions followed, since investigators and insurers will ask.
A Compact Checklist for AP Teams to Adopt This Week
- Assign named roles for vendor setup, payment approval, and fraud escalation, so no single person handles all three.
- Set written policies on PO thresholds, mandatory verification steps, and when to hold a payment pending checks.
- Schedule monitoring for vendor-master purges and anomaly reviews, monthly or quarterly depending on your invoice volume.
- Run a short annual drill where staff practice spotting a fake invoice, so the checklist stays muscle memory rather than a document nobody reopens.
How Invoicing Tools Fit Into Fraud Detection
Part of what makes invoice fraud prevention hard is that legitimate invoices and fake ones often look nearly identical once they’re sitting in a shared inbox. Tools that authenticate invoices at the source close that gap.
- Audit trails and delivery receipts make it obvious when a document has been intercepted or altered in transit, rather than leaving that judgment to a busy clerk.
- Status tracking lets AP staff confirm an invoice was actually sent by the vendor’s own account, speeding up independent verification.
- Consistent, branded formatting across every invoice removes the visual ambiguity scammers rely on to make a forged document pass a quick glance.
- A single source of truth for invoice data, backed by bank-grade security, gives auditors and investigators a clean record if something does go wrong.
Why Speed Beats Verification, and What to Do About It
The most consistent failure mode isn’t a lack of awareness. It’s that verification takes ninety seconds and paying an invoice takes ten. Under deadline pressure, staff default to speed. Out-of-band verification, calling a known contact before acting on any bank-detail change, remains the highest-value control precisely because it forces that pause. Build the pause into your process, not into someone’s willpower.
— Black Flame Digital
A Practical Way to Keep Your Own Invoices Verifiable
Invoice phishing scams thrive on ambiguity. If your own outgoing invoices look inconsistent, come from a generic template, or offer no way for a client to confirm they’re legitimate, you’re accidentally making fraud easier to disguise, both for scammers targeting your clients and for anyone impersonating you. Invoicelabs closes that gap by generating branded, authenticated invoices in under thirty seconds, with delivery tracking and status updates that let your clients confirm an invoice actually came from you and hasn’t been altered along the way.
Every invoice carries consistent branding, real-time tax calculations, and a visible audit trail from creation to payment, so there’s a clear record if a client ever needs to verify a request against what you actually sent. That same trail helps your own team spot a genuine payment-detail change versus a spoofed one. If you want to see how a properly authenticated invoice should look, try the free invoice generator and send your next one in a format that’s harder to fake and easier to verify.
Sources
- Financial regulations overview — University of Edinburgh
- Business Email Compromise — National Cybersecurity Centre
- We found this fake-invoice campaign while scammers were still building it — Malwarebytes (2026)
- Invoice fraud at intake — Stampli
- Invoice fraud prevention guide — InvoiceExtractor
Recommended
Send your next invoice in seconds
Create professional invoices, track payments and get paid faster — free to start.
