Fake invoice scams work because they appear to be just another day. You get an email from someone you actually do business with, the figure looks fairly plausible and a rushed accounts department shell out before lunch. And by the time the genuine supplier is on the phone to ask for their cash it's long gone. This happens to honest, well managed companies every week. Here are 5 warning signs that most companies fail to spot.
How Fake Invoice Scams Work in Practice
The con artists will either make up a supplier or compromise the accounts department of a genuine one. Occasionally they will hack into the email of the real supplier and send a seemingly legitimate invoice with the new bank details. More often, they will replicate a company name, logo and layout to send an invoice for work that was never undertaken. AI has replaced all those emails with appalling spelling that look unprofessiona, so "looks professional" is no proof of anything.
Five Red Flags Most Businesses Miss
- Changed bank details: a supplier unexpectedly sends an new account number, often with a convincing rationale such as changing banks.
- Pressure to pay: urgent wording, late fee threats and "final notice" headlines encourage you to stop thinking.
- A slightly off sender address: one letter transposed or an additional word in the domain name but the display name is still fine.
- An invoice for an order you didn't make: there is no purchase order, and no one even knows what you're talking about.
- A strange way to pay: through gift cards, cryptocurrencies or a private account for a transaction that should be in the company's name.
A Quick Check Before Making Every Payment
You don't need costly software to thwart the majority of efforts without costly tools or technical know-how. You need a practice that you and your entire team follow whenever:
- Call the supplier at a number you already know – not the one listed on the invoice.
- Every invoice should be identifiable to a job or purchase order.
- Get someone else to validate any new bank details.
- Maintain a list of approved suppliers. Review the list on a quarterly basis.
- Ease off on urgent. Slow yourself.
You can also find the straightforward scamalert on fake business invoices from Scamwatch that you should show your accounts team.
What if Someone Has Already Paid
Act in minutes, not days Call your bank and tell them to recall the payment, then report the scam to Scamwatch or Report Cyber so it can be traced and other companies warned. Reset passwords on any email accounts involved, and check for any forwarding rules you haven't set up. Acting swiftly can recover the money, and always helps to warn the next business. Also, let your staff know what happened, as a cool debrief will prepare you for next time.
Things to make your Business harder to fool
Email protection. Teach your staff and tighten your email security to cover the vulnerabilities these scams depend on. The experts at One Hub have helped a range of Australian companies to secure their email, systems and invoice payments. Call us for an easy risk review before the next suspicious invoice arrives.
FAQs
What are fake invoice scams?
They're bogus bills for goods or services you didn't order, or real-looking invoices with altered bank details, meant to fool you into handing over cash to the wrong person.
How can I identify a fake supplier invoice?
Before any money moves, be on the lookout for altered bank details, urging you to pay instantly, an almost correct sender address and no matching purchase order or job on your system.
Should I pay if the invoice looks real?
No, not unless you verify it by calling the supplier on a number you already have, because a professional appearance is no proof of anything and scammers copy genuine invoices well these days.
What should I do if I paid a fake invoice?
If you believe you have been scammed, call your bank immediately to request a recall and then report the scam to Scamwatch or Report Cyber so others can be warned and we can track it down.
Can small businesses stop invoice fraud?
Yes, small teams can stop most of it, as a second approver for bank changes and a simple call-back practice are sufficient to thwart most attacks – for no special tools or technical ability.