A fake invoice scam is a fraud in which someone invents a bill, disguises a subscription renewal, impersonates a supplier, or alters real payment instructions so money goes to the wrong account. It can target an individual, freelancer, or small business, and it may arrive through a compromised email conversation that otherwise looks genuine.

Key Takeaways

Verify three things separately: whether the debt is real, whether the sender is genuine, and whether the payment destination is unchanged.

Confirm new or changed bank details through a known phone number or established channel, never by replying to the invoice email.

Use a second approver for unusual, high-value, urgent, or redirected payments.

If you paid, contact the originating bank immediately for a recall, then preserve evidence and inspect the email account.

Invoice fraud combines ordinary business routines with impersonation. Use the online security guide for broader phishing and account controls, while keeping invoice approval tied to purchase and supplier records.

What are the four main types of fake invoice scam?

A completely invented bill

The invoice names a product, directory listing, domain, repair, delivery, advertising service, or professional fee that nobody ordered. The amount may be small enough to pass without questions. The sender hopes a busy recipient will treat the document as routine and pay it.

A disguised subscription renewal

An email claims that antivirus, cloud storage, technical support, media, or another subscription has renewed. It may include a phone number to cancel. The real goal can be payment, remote access, or credentials rather than the stated invoice.

An altered genuine supplier invoice

A criminal obtains a real invoice or learns the relationship between buyer and supplier, then changes the account number, payment link, beneficiary, or remittance instructions. The products, amount, contact names, and timing may all be accurate, which makes this version harder to detect.

Payment redirection through compromised email

An attacker enters a real mailbox or convincingly imitates it, watches a transaction, and inserts new payment instructions at the right moment. The FBI defines business email compromise as a scam targeting businesses and individuals making fund transfers, often after a legitimate business email account is compromised through social engineering or intrusion.［1］

Business email compromise is one entry route, not the whole subject. A fake invoice can also arrive without any hacked account, and a compromised mailbox can support many other crimes. The practical control remains the same: payment authority must not depend only on the message that requests the payment.

How do you perform the three-part invoice check?

1. Is the debt real?

Match the invoice against a purchase order, signed agreement, delivery record, timesheet, subscription account, or known personal purchase. Confirm the description, quantity, amount, tax treatment, due date, and approving person. If no one can identify the underlying obligation, stop before investigating payment details.

For a personal invoice, open the merchant account through its official app or address and look for the order or renewal. Do not call the cancellation number printed only on the suspicious bill.

2. Is the sender genuine?

Inspect the full sender and reply-to addresses, not only the display name. Compare the domain with previous trusted correspondence and the supplier's official site. A one-letter change can be easy to miss, while a compromised real mailbox may show no spelling change at all.

Confirm the named employee through a contact route already held in your records. Do not ask “is this invoice real?” by replying to the same thread, because an attacker controlling that mailbox can answer yes.

3. Is the payment destination unchanged?

Compare the beneficiary, bank, account number, routing details, payment URL, cryptocurrency address, and remittance instructions with an independently stored supplier record. Any new or changed destination is a separate high-risk event even when the debt and sender are genuine.

The FBI recommends using a secondary channel to verify account-information changes with the intended recipient. The UK NCSC likewise treats impersonation of a regular contact as a business-payment-fraud route.［2］ The ACCC advises checking payment details directly with the business before paying an emailed invoice.［3］

What fake invoice red flags matter most?

Signal	Possible explanation	Required check
No matching order, contract, or delivery	The debt may be invented	Ask the internal buyer or merchant through a known route
New bank account or payment link	Payment details may have been redirected	Call a known supplier number and compare stored records
Unusual urgency or secrecy	Pressure may be bypassing the normal approval process	Pause and obtain normal approval
Slightly changed email domain or reply-to	The supplier may be impersonated	Verify the complete address and call independently
Correct invoice details but changed beneficiary	A real invoice or mailbox may have been compromised	Treat the destination change as fraud risk
Attachment asks for macros, login, or software	The file may deliver malware or steal credentials	Do not enable content; verify the invoice another way
Cancellation requires a call and remote access	The invoice may be bait for a support scam	Use the real vendor account and refuse remote control

Good spelling is not a safety signal, and poor spelling is not required for fraud. A real conversation history is also insufficient when a mailbox may be compromised. Focus on records and independent channels.

How should individuals and freelancers verify invoices?

Keep a simple list of expected bills, subscriptions, clients, contractors, and payment destinations. When an invoice arrives, match it to that list before opening attachments or paying. If the invoice concerns a service you do not recognize, reach the named company through an official site or previous statement.

Freelancers face both directions of risk. A fake client may send an overpayment or check and ask for money back, while an impostor may send your client altered instructions in your name. Tell clients in advance how payment-detail changes will be announced and verified. If your own bank details change, confirm the change through an established secondary channel.

Do not let an approaching deadline move the verification into the suspicious email thread. A genuine supplier can tolerate a short delay while identity and account details are confirmed.

What payment controls help a small business stop a payment redirection scam?

Separate invoice receipt, approval, and payment where practical. For high-risk payments, require a second person to compare the invoice with the purchase record and the stored supplier destination. The threshold can reflect the organization's size, but account changes, first-time suppliers, refunds, and urgent executive requests should receive additional review regardless of amount.

Maintain supplier bank details in a controlled record rather than copying them afresh from every invoice. When details change, call a known contact and document who verified the change, through which number, and when. If the person who normally approves a payment is unavailable, do not let email urgency silently remove the control.

Protect email accounts with unique passwords and MFA, review forwarding rules and connected apps, and limit mailbox access. These controls reduce one route into payment fraud, but they do not replace purchase matching and destination verification. The UK NCSC describes tailored emails that impersonate regular contacts and recommends contacting the bank and internal IT support promptly after a fraudulent payment.

What should you do after paying a fake invoice?

Contact the bank immediately

Call the originating bank through its official number and request a recall or reversal. Provide the transfer time, amount, beneficiary, account details, and fraud explanation. The FBI states that rapid recall and related indemnity documentation may reduce or eliminate losses in a business email compromise incident. Do not wait for the supplier to complete its own investigation before calling your bank.

Warn the real supplier and internal payment owners

Reach the supplier through a known number and tell it which invoice and destination were used. This helps determine whether its mailbox, your mailbox, or neither was compromised, and may prevent other customers from paying the same destination. Notify the bookkeeper, finance owner, client, or insurer as relevant.

Secure the email and account environment

From a trusted device, change exposed passwords, revoke unknown sessions, review recovery methods, forwarding rules, mailbox delegates, filters, and connected apps, and enable MFA. Preserve logs before deleting suspicious messages if your provider or investigator may need them. If an attachment was opened or software installed, also inspect the device.

Preserve and report evidence

Save the original message with headers, invoice file, payment confirmation, purchase record, prior genuine invoices, changed account details, domains, telephone numbers, and all subsequent contact. Report through the appropriate cybercrime, police, consumer, or business-fraud channel in your country. Keep the bank and report case numbers together.

Do not pay a new person who promises to retrieve the transfer. Victims of invoice fraud can be approached again by a recovery scam.

Summary

Fake invoice scams include invented debts, disguised renewals, altered real invoices, and payment redirection.
Verify the obligation, sender, and payment destination as three separate questions.
Confirm bank-detail changes through an independently known route and use a second approver for high-risk payments.
After payment, contact the originating bank first, then warn the supplier, secure email, preserve evidence, and report.
A polished invoice or genuine email history cannot replace independent payment verification.

FAQ

Can a fake invoice come from a real supplier's email address?

Yes. A supplier or buyer mailbox may be compromised, allowing an attacker to send from or reply within a real account. Verify payment changes through a separate known channel even when the address is familiar.

What if the invoice amount and order details are correct?

Correct details show that the sender knows about the transaction, not that the destination is safe. Compare the beneficiary and account details with your controlled supplier record and confirm any change independently.

Should I call the phone number printed on the invoice?

Not unless it matches a number you already know from an independent record. Use the supplier's official site, contract, previous verified statement, or internal contact list.

Is a small unexpected invoice safe to pay?

No amount makes an invented debt legitimate. Small invoices may be designed to avoid scrutiny. Match every bill to a real obligation and approved supplier.

What is payment redirection fraud?

It is a scam that changes where a genuine or plausible payment is sent. The attacker may impersonate a supplier or compromise an email account, then replace legitimate bank details with an account they control.

Does two-person approval prevent every invoice scam?

No, but it creates a chance for an independent check. Both approvers must compare the debt and payment destination rather than merely approving the same email.

Can a bank always recall a fraudulent transfer?

No. Success depends on timing, payment system, recipient account, legal rules, and available funds. Contacting the originating bank immediately gives it the best opportunity to act.

Can a VPN stop fake invoice scams?

No. A VPN cannot validate a debt, authenticate an email sender, detect every compromised mailbox, or confirm a bank account change. Purchase controls and independent payment verification are the relevant defenses.

Disclaimer: This article provides general cybersecurity, consumer, and business-process information. It is not legal, financial, accounting, banking, or professional incident-response advice.

Sources

FBI Internet Crime Complaint Center — Business Email Compromise — https://www.ic3.gov/CrimeInfo/BEC
UK National Cyber Security Centre — Business Payment Fraud — https://www.ncsc.gov.uk/section/respond-recover/business-payment-fraud
Australian Competition and Consumer Commission — Beware of Fake Invoices from Scammers Impersonating Businesses — https://www.accc.gov.au/media-release/beware-of-fake-invoices-from-scammers-impersonating-businesses

Sources checked 28 August 2026.

Related articles:

What Is a Fake Invoice Scam?