Invoice fraud: how the scam works and how to stop it

Here is a typical example. Your bookkeeper gets an invoice from a supplier you have paid every month for years. The logo is right. The amount is normal. The message sits in the same thread as last month's invoice. The only change is a line near the bottom: the bank account is new, and the payment is due this week.

Nothing looks wrong at first. The danger is in that one change.

What is a fake invoice scam?

A fake invoice scam is a payment request that looks like it comes from a supplier, a vendor or a colleague, but a criminal sent it. The goal is to get you to send money to an account the criminal controls.

Security teams often call the wider pattern business email compromise, or BEC. In BEC, a criminal either takes over a real mailbox or fakes one that looks almost identical. Then they time the request to a real payment and step in with a changed bank account.

How does the scam work, step by step?

It usually runs in four steps. The criminal needs access to a mailbox only at the start.

1. The criminal gets into a mailbox or copies a supplier's. This can be a compromised account, a look-alike domain, or a sender address that only looks right.
2. They read the conversation. They learn who pays whom, how invoices look, and when a payment is due.
3. They send the request at the right time. The message says the bank account has changed, often with a push: "please pay this week."
4. The money goes to the criminal. The supplier notices later, when they ask why they have not been paid.

How much money is at stake?

Start with the official numbers. The FBI's Internet Crime Complaint Center (IC3) collects reports from the public and publishes an annual report. In its 2024 report, business email compromise caused about $2.77 billion in reported losses in the United States. Total losses reported to IC3 for all internet crime in 2024 reached $16.6 billion, up 33% from the year before.

These are reported losses, so they are not the full picture. For a small business the lesson is simple: the criminal does not need to break into your bank. They only need one person to trust one email.

Why does a changed bank account work so well?

Because it looks like an ordinary task. Suppliers do change banks, and people do update their details. The request arrives in a real thread, and the sender knows the invoice number. A quick reply feels helpful, not risky.

So check the change, not the look of the message. A polished invoice proves nothing.

How do I check a payment before I send it?

Call the supplier on a number you already had, before you pay. Do not use any number, link or address from the new message.

1. Hold the payment. Do not reply to the email, and do not click anything in it.
2. Call a number you already had. Use the phone number on past invoices, your contract or your vendor file. Never the number in the new message.
3. Confirm the details out loud. Ask the person to confirm the new account, the amount and the invoice number.
4. Record the change. Only after the call, update the account in your system, with the date and the name of the person who confirmed it.
5. Require a second approval. Any change to bank details needs a second person to sign off, even when the request comes from an owner or manager.

What if the request came from inside my company?

The same rule applies. A colleague's mailbox can be taken over, so a request from a known name still needs a check through another channel. Ask the person to confirm by phone, or walk over and ask. Being polite is not a reason to skip the check.

Teach your team that the check is normal. A person who verifies a change is doing their job, and the process should make that easy.

Can Ward help me check these emails?

Ward helps in two ways. Ward's domain check reads your email records from outside your company, SPF, DKIM and DMARC, so you can see whether anyone can send email as your domain. The DMARC guide explains what to do with the results.

Ward Analyzer does the other job. You paste a suspicious email, a link or a file, and it tells you whether it looks like fraud, with the reasons. It reads the message without opening links or running files. It is part of Ward's paid plans, and it never says a message is safe.

What should I do if I already paid?

Act within hours. Speed matters more than a perfect report.

• Call your bank right away. Ask them to stop or recall the payment, and to flag the receiving account. Some money can be recovered when the bank acts fast, but there is no guarantee.
• Report it to the FBI at ic3.gov if you are in the United States. Include the invoice, the account details, the amounts and the dates.
• Tell the real supplier on a phone number you already had, so they can warn their own team.
• Change the passwords for the mailbox that was used, and turn on multi-factor sign-in.
• Check the mailbox rules. Look for forwarding rules or hidden filters you did not create, and remove them. Criminals sometimes add them to hide replies.
• Keep the evidence. Save the emails with their full headers, and write down who did what, and when.

If you think someone still has access to your mailbox, ask the IT provider that manages your accounts to help you lock it down.

How do I make it harder for a criminal to fool my team?

Write the rule down and make it the normal way to pay. Three habits cover most of the risk.

• Keep a vendor list with phone numbers you have verified, and update it when a contract changes.
• Require a second approval for any new or changed bank account.
• Make it easy to report a request that breaks the rule. Thank people who report, even when it turns out to be a false alarm.

Protect the email that sends your invoices, too. If nobody can send mail as your domain, a fake invoice from your name is harder to send. The first step is to publish a DMARC record and read its reports, as the guide to DMARC for small businesses explains.

The rule that stops the most damage

When a message asks for money, a password or a change to how you pay, stop and check it another way. The check is a phone call to a number you already had. It takes minutes, and it is the step that criminals most want you to skip.

For the other signs that a message is not what it claims, read the 7 signs of a phishing email.