How Small Businesses Can Identify And Prevent Invoice Fraud

Key takeaways

• Verify every invoice against a past one, checking the email address, bank details, and payment terms before you pay.
• Watch for red flags like urgent payment demands, changed bank details, and sender addresses that are a character off from your supplier’s.
• Build simple controls into your payment workflow, such as three-way matching and regular audits, to catch fraud early.
• Act fast if you suspect fraud by contacting your bank and reporting the scam to the FBI and FTC.

What is invoice fraud?

Invoice fraud is a scam where a criminal sends a fake or altered invoice to trick a business into paying money to the wrong account. It usually works by impersonating a supplier you already trust.

The scam is common and costly. Business email compromise, the category most invoice fraud falls under, was the most common source of payments fraud in 2024. That year, 79% of organizations faced attempted or actual payments fraud, according to the Association for Financial Professionals. The FBI’s Internet Crime Complaint Center tied business email compromise to roughly $2.8 billion in reported losses.

Even the largest companies get caught. Google and Facebook were conned out of $123 million through fake invoices from someone posing as a hardware supplier.

The fraudster hopes the payment request gets lost in your pile of bills, so a busy owner or finance team pays it without a second look.

What to look out for before paying an invoice

Below is a list of 10 red flags that can indicate you’ve been targeted for invoice fraud:

1. Spelling or grammar errors: The email with the invoice attached has grammar or spelling errors.
2. Mismatched email address: The email address is not identical to the one your supplier typically uses. With invoice fraud, the email address is usually a single character off from the legitimate supplier email or uses a modified email domain. An example might be ar@smithssupplies.com now coming in as ar@smithsupplies.com. If something feels off, search your inbox or the internet for your supplier’s email address.
3. A sudden switch in payment method: Your supplier abruptly requests to only be paid by ACH bank transfer, and not by check, or suddenly changes their banking details.
4. A charge for something you didn’t buy: The invoice is for something you didn’t purchase.
5. A document that looks off: The document itself looks off. Maybe the logo isn’t as crisp as usual or the layout doesn’t look the same. Fraudsters can’t get their hands on official company letterheads or high resolution logos, so they often scan and then print logos onto their own invoices. This tends to result in a slightly fuzzy or odd looking document.
6. A suspiciously round amount: The invoice is for an even amount of money. Remind your staff that something too neat should sound alarm bells.
7. An unusually high volume of invoices: The volume of invoices is abnormally high. Although it could be indicative of an actual increase in business, it may actually be a tip off of something fishy going on.
8. Odd timing: The invoice arrives at a different time of the month than you typically receive it. Most services bill at the same time every month, so an inconsistency should be cause for concern.
9. A missing purchase order: The invoice doesn’t have the purchase order attached. Legitimate invoices almost always contain the corresponding purchase order.
10. Pressure to pay immediately: The email pressures you to pay immediately.

Common types of invoice fraud

Invoice fraud shows up in a few common forms. Knowing each one helps your team spot it faster.

• Fake vendor invoices: a criminal bills you for goods or services you never ordered, often using a real supplier’s logo.
• Changed bank details: a scammer poses as a supplier and asks you to update their payment details to a new account.
• Duplicate invoices: the same invoice is sent more than once, hoping you pay it twice.
• Phantom vendors: a fake supplier is added to your records and billed against over time.
• Business email compromise: a hacked or spoofed email account sends a fraudulent invoice that looks like it came from a real contact.
• Insider fraud: someone inside the business approves fake invoices or sets up phantom vendors.

Practical steps you can take to prevent invoice fraud

Prevention only works if it’s practical. Choose steps your team can build into your existing payment workflow. Here are the most effective ways to prevent invoice fraud:

What to do if you suspect invoice fraud

Act fast if you think you paid a fraudulent invoice. Quick action gives you the best chance to recover the money.

1. Contact your bank right away and ask them to try to stop or recall the payment.
2. Report it to the FBI’s Internet Crime Complaint Center so the attempt is on record.
3. Report it to the Federal Trade Commission to help flag the scam.
4. Warn your team and the real supplier so no one pays a second fake request.

Moving forward

Invoice fraud continues to be a thorn in the side of small businesses all over the world. Melio uses our vast small business network to validate and connect small businesses and suppliers.

We work with our partner banks to create open and secure communication to react to phishing incidents faster, and to recover badly routed funds whenever possible. It’s time to make invoice fraud a thing of the past.

Ready to pay bills more securely and keep closer tabs on every invoice? Sign up for Melio.

Invoice fraud FAQs