Invoice Fraud & Scams: How to Protect Your Business
Invoice fraud costs businesses billions every year, and small businesses are prime targets because their controls are lighter. The scams are depressingly effective — but nearly all of them fail against a few simple verification habits. Here is what to watch for.
The Most Common Invoice Scams
Fake vendor invoices arrive looking legitimate — for services like directory listings, domain renewals, or office supplies you never ordered — hoping someone pays without checking. Mandate fraud (bank-detail swaps) is more targeted: criminals impersonate a real supplier and ask you to update their bank details, diverting your next payment to them.
CEO or approver fraud uses spoofed emails from 'the boss' urgently requesting a payment or invoice approval. And overpayment scams send you a fraudulent overpayment, then ask you to refund the difference before the original payment bounces. Each exploits urgency and weak verification.
Verify Before You Pay
The single most effective control: independently verify any new or changed payment details. If a supplier emails new bank details, call them on a known number — never the number in the suspicious email — to confirm. Require two-person approval for payments above a threshold, and for any change to supplier bank details.
Match every invoice to a purchase order or contract before paying, and confirm goods or services were actually received. A surprising number of fake invoices get paid simply because nobody checked whether the work happened.
Protect Your Outgoing Invoices Too
Criminals also intercept your invoices: they email your clients from a lookalike domain with 'updated' bank details so your client's payment goes to them. Warn clients in your terms that you will never change bank details by email, and confirm any change by phone on both sides.
Use a consistent sending email address and consider digitally signing invoice PDFs. If a client ever questions your bank details, treat it as urgent — it may mean someone is impersonating you to them right now.
What to Do If You Are Hit
Act within hours: contact your bank to attempt a recall of the payment, report to the police, and notify the impersonated supplier or client. For bank-detail swap fraud, fast action occasionally recovers funds before they are moved on — after 24-48 hours, recovery odds drop sharply.
Afterwards, do a post-mortem: which control failed, and what changes prevent recurrence? Common fixes include a written payment-verification policy, staff training on phishing, and email authentication (SPF, DKIM, DMARC) on your domain to make impersonation harder.
Frequently asked questions
How can I tell if an invoice email is fake?
Check the sender's actual email address (not just the display name), look for urgent language pressuring quick payment, and verify unexpected bank-detail changes by phone. When in doubt, contact the supplier through a known channel before paying.
Should small businesses worry about invoice fraud?
Yes — small businesses are targeted precisely because they often lack verification procedures. A single diverted payment can be devastating. The good news: basic controls like call-back verification stop most attacks.
What is a bank-detail swap scam?
A fraudster impersonating your supplier (often via a hacked or spoofed email) tells you their bank details have changed. Your next payment goes to the criminal's account. Always verify changed payment details by phone using a number you already have.
More guides
Create your document in seconds
Free forever. No signup, no watermarks — your data never leaves your browser.