Invoice Fraud and Fake Invoice Scams: How to Protect Your Business

Invoice fraud is when criminals trick a business into paying money to the wrong place, usually using invoices that look legitimate. It's big business: in its 2025 report, the FBI's Internet Crime Complaint Center recorded around $3 billion in reported losses to business email compromise alone, a category that includes many invoice scams. Small businesses are targeted as both payers and suppliers whose name gets misused.

The main types

1. Changed bank details (supplier impersonation)

The most costly. A criminal gains access to a supplier's email (or creates a lookalike address) and sends a real-looking message: "We've changed banks. Please use these details for the attached invoice." The invoice may even be genuine, just with different bank details. The payer sends the money, and it's gone.

2. Fake invoices for things never ordered

Invoices for "directory listings", domain renewals, trademark registrations, office supplies or "SEO services" that were never ordered, sent in the hope that someone pays without checking. Some are designed to look like official notices from government agencies.

3. CEO or executive impersonation

An email apparently from the owner or finance director asks someone to urgently pay an invoice, often "confidentially" and outside normal process.

4. Duplicate and inflated invoices

Sometimes from genuine suppliers or insiders: the same invoice submitted twice, or amounts quietly increased.

Warning signs

• Bank details changed, especially by email
• Urgency or secrecy: "Must be paid today", "Don't discuss this with anyone"
• Email address slightly off: accounts@harborpine.co instead of harborpine.com
• No purchase order or matching order
• Unusual payment method: gift cards, crypto, personal accounts
• Generic descriptions: "Services rendered" with no detail
• Invoice numbering or formatting different from the supplier's usual

If you pay invoices: protect yourself

1. Never change bank details based on an email alone. Call the supplier on a number you already have (not one in the email) and confirm.
2. Match every invoice to a PO or an agreement before paying. See invoice vs purchase order.
3. Separate duties: the person who approves an invoice shouldn't be the only person who can pay it, where possible.
4. Pay a small test amount first when paying new bank details, and confirm receipt by phone.
5. Train staff (and yourself) to pause on urgency.
6. Use multi-factor authentication on email and banking.

If you send invoices: protect your clients

Your clients can be defrauded in your name. Help them:

• Put a line on every invoice: "We will never change our bank details by email. If you receive such a request, call us on [number]."
• Keep payment details consistent, and give clients plenty of notice by phone if they ever do change.
• Secure your email with strong passwords and multi-factor authentication. Most bank-detail fraud starts with a compromised mailbox.
• Send invoices as PDFs from your usual address, with consistent numbering and layout, so anything odd stands out.
• Watch for bounce-backs and odd forwarding rules in your email settings, which can indicate compromise.

If it happens

• Contact your bank immediately. The faster you act, the better the chance of stopping or recovering the payment.
• Report it: in the US to the FBI's IC3 (ic3.gov) and the FTC; in the UK to your bank and the national fraud reporting service; elsewhere to the national fraud reporting service.
• Secure your accounts: change passwords, check email forwarding rules, enable MFA.
• Tell affected clients or suppliers so they can check for other fraudulent messages.

A final word on fake invoice generators

Invoice generators, including this one, make legitimate invoicing easy. Using any tool to create invoices for goods or services that were never supplied, or to impersonate another business, is fraud. Our terms of use prohibit it.