Fake Invoice Fraud: How Scammers Target Small Businesses

Fake invoice fraud is quiet, low-tech, and surprisingly effective. Instead of a dramatic hack, it relies on a busy accounts-payable inbox and a bill that looks routine enough to pay without a second look. Scammers send invoices for domain renewals, office supplies, software subscriptions, or directory listings the business never actually ordered, betting that someone will just pay it to clear their inbox.

A more sophisticated version targets real vendor relationships. A scammer, often after compromising an email account somewhere in the chain, sends a message that looks exactly like it's from a real, existing supplier saying "we've updated our bank details, please send future payments to this new account." The invoice itself is often genuine. Only the payment details have been swapped.

A few habits prevent most of this. Verify any new vendor, or any changed payment details from an existing one, by phone using a number you already have on file, never one provided in the email itself. Build a simple internal approval checklist for invoices above a certain amount. Require a second person to sign off on payments over a set threshold, so no single compromised inbox or rushed afternoon can move money on its own.

None of these checks take long, but skipping them is exactly what fake invoice scams are betting on. A two-minute phone call is a small price for avoiding a payment you can't get back.