Invoice Fraud: Protect Your Business from Fake Bills
Invoice fraud is a sophisticated business scam where criminals send fake invoices to companies, typically impersonating established suppliers, vendors, or service providers. The fraudster creates convincing documentation that mimics legitimate billing practices, complete with official letterheads, company logos, bank details, and realistic invoice numbers. According to the FBI's Internet Crime Complaint Center, invoice fraud losses exceeded $2.1 billion in 2023, with businesses reporting average losses between $10,000 and $50,000 per incident. The scam exploits the fast-paced nature of business operations, where accounting departments process hundreds of invoices monthly and may not immediately verify each vendor before payment. Scammers target mid-sized companies specifically because they have enough budget to authorize payments quickly but lack the rigorous verification systems of larger enterprises. The typical timeframe from invoice delivery to fraudulent payment is 1-14 days, before the legitimate vendor notices the discrepancy or the real invoice arrives.
Common Tactics
- •Create near-perfect replicas of real company invoices using information harvested from websites, LinkedIn, or previous legitimate correspondence, including actual company addresses, phone numbers, and employee names.
- •Use spoofed or lookalike email addresses that closely resemble legitimate vendors (e.g., 'acmesupply.com' instead of 'acmesupplyco.com') to send invoices directly to accounting departments.
- •Reference legitimate past orders, projects, or service agreements discovered through social engineering or data breaches to make invoices appear as follow-up billing.
- •Request payment via wire transfer, cryptocurrency, or new banking details by claiming the company has recently changed financial institutions or payment processors.
- •Invoice for common recurring services like software licenses, maintenance contracts, office supplies, or utilities where authorization chains may be unclear or delegated.
- •Exploit time-sensitive language such as 'overdue,' 'past due,' or 'payment required by [date]' to pressure quick processing without thorough verification steps.
How to Identify
- The invoice arrives via email from an address that's slightly different from the vendor's known contact email, or requests payment through unusual channels like wire transfer instead of the company's established payment method.
- The invoice contains minor inconsistencies in formatting, grammar, or company branding compared to previous legitimate invoices from that vendor, or the quality of the logo appears slightly off.
- Your company receives payment requests for services or products your department doesn't recall ordering, or the invoice references a project or contract number you cannot locate in internal systems.
- The vendor suddenly requests payment to a new bank account, different address, or alternative payment method despite years of using the same banking details and payment terms.
- The invoice uses generic billing language ('Invoice for Services Rendered') rather than specific descriptions of work performed, or lacks detail about deliverables, timelines, or project scope.
- The invoice arrives outside normal business hours or from a vendor who typically batches monthly invoices, but this one arrives as an urgent single request.
How to Protect Yourself
- Establish a vendor verification protocol requiring accounting staff to contact the vendor directly using phone numbers or email addresses from your internal records (not the invoice) before processing any payment over a set threshold.
- Implement a three-way matching system where purchase orders, delivery receipts, and invoices are compared before payment authorization, and require documented evidence of goods received or services rendered.
- Create a whitelist of approved vendors with confirmed banking details and payment instructions, and flag any invoices requesting payment to accounts outside this list for manual verification.
- Train accounting and procurement teams to recognize social engineering tactics and invoice fraud red flags, with quarterly refresher sessions that include real examples of attempted fraud.
- Use email security tools that verify sender identity through DMARC, SPF, and DKIM authentication to detect spoofed vendor addresses, and implement alerts when emails claim to be from known vendors but fail authentication.
- Require verbal or in-person confirmation for any invoice requesting unusual payment methods (wire transfers, cryptocurrency, gift cards) or payment to new banking details, even if the sender claims to be a trusted vendor.
Real-World Examples
A manufacturing company's accounting department receives an invoice from what appears to be their regular office supply vendor for $8,500 in equipment maintenance. The email address is nearly identical to the vendor's known contact, and the invoice references a recent service call. The requestor presses for immediate payment via wire transfer, citing a 'processing backlog.' The accounting manager, busy with month-end close, approves the payment without calling the vendor directly. Two days later, the legitimate vendor inquires why their invoice for actual maintenance hasn't been paid, revealing the fraud.
A marketing agency receives an invoice from their established software-as-a-service provider for annual license renewal ($12,000). The email appears legitimate and includes their account number and previous contract details (information the scammer obtained from a data breach). The invoice requests payment to a new bank account in Eastern Europe, claiming the company recently restructured. The payment is processed before the agency's CFO reviews their vendor list and realizes they renewed their license two months earlier.
A mid-sized consulting firm gets an invoice from a telecommunications vendor for $15,000 in network services and upgrades. The invoice is highly detailed with technical specifications and references recent conversations with the IT director (information gleaned from LinkedIn and previous company announcements). The fraudster sends it as an urgent 'final notice' requiring payment within 48 hours. An overworked accounts payable clerk matches it to a vague purchase order from six months prior and approves the wire transfer, only to discover later that the IT director never approved the work.
Frequently Asked Questions
How can I tell if an invoice from a vendor is actually fake before we pay it?
What should we do if we've already paid a fake invoice?
Why do scammers target mid-sized companies like ours instead of large corporations?
What processes should we implement to prevent invoice fraud in our accounting department?
How quickly do scammers typically move from sending a fake invoice to getting paid, and what does that mean for us?
Where to Report — United States
Official channels in your region for reporting this scam.
CFPB Consumer Complaint
Financial RegulatorFor bank, credit card, loan, and payment-related fraud.
AARP Fraud Watch Helpline
HotlineFree helpline for victims of any age (English/Spanish).
Think you encountered this scam?
How to cite this guide
Use this when referencing ScamLens content in articles, research, AI responses, or social media.
According to ScamLens (scamlens.org), invoice fraud: protect your business from fake bills is described at https://scamlens.org/en/encyclopedia/invoice-fraud.