How to spot a fake invoice before you pay it

Why this scam works

A fake invoice does not look fake. It uses a real vendor's logo, a real project name, and an amount close to what you expected to pay. The only thing wrong is where the money goes. Scammers rely on a convincing email (show definition) arriving at a busy moment, when the person approving payment does not stop to check.

This scam targets businesses that regularly pay vendors, contractors, or suppliers by wire or ACH. Construction, real estate, law firms, and accounting firms are common targets because large payments move through email on a normal basis.

Warning signs to check

• Bank account or routing number changed from the last invoice, with no phone call explaining why.
• Urgent language pushing you to pay today or before a deadline that was never mentioned before.
• Sender domain that looks close to the real one, such as a swapped letter or an extra hyphen.
• A reply-to address that does not match the sender address shown in your inbox.
• A request to keep the change confidential or to skip your normal approval process.

A real example

A general contractor receives an email that looks like it comes from a subcontractor's billing department. The invoice matches an open project. The only change is a new bank routing number, with a note explaining the subcontractor switched banks. The accounts payable clerk updates the record and pays. Two weeks later, the real subcontractor calls asking why the invoice is unpaid.

Verify before you pay

• Call the vendor using a phone number from a past invoice, contract, or your own records, not the number in the email.
• Ask to speak with the same contact you normally deal with.
• Confirm the new bank details verbally before changing anything in your system.
• Have a second person review and approve any bank-detail change.
• Check the sender's email domain letter by letter against a known-good email.

Build the habit, not just the check

The best protection is a rule everyone follows without thinking about it: no bank-detail change is accepted from an email alone. It goes through a phone call and a second approver, every time, no matter how small the amount or how trusted the vendor. This slows down real fraud without slowing down legitimate payments by more than a few minutes.

If you already sent the money

1. Call your bank immediately and ask them to recall the wire or stop the ACH transfer.
2. File a report with the FBI's Internet Crime Complaint Center at ic3.gov.
3. Notify your insurance carrier if you have coverage for wire fraud or crime losses.
4. Document the emails and timeline while details are fresh.

This is general information, not legal advice. Speak with your bank, your insurer, and legal counsel about your specific situation.