You receive an invoice from a supplier you work with regularly. The logo looks right. The amount matches what you expected. The email or WhatsApp message sounds professional.
Then you notice one detail has changed: the banking details.
A fake invoice scam happens when a criminal tricks a business into paying money into the wrong account. The invoice may look real. The sender may pretend to be a supplier, client, employee or trusted contact. The scammer's goal is simple, get your payment before you have time to check.
How the scam works
Scammers study how real businesses communicate. They may copy an invoice layout, reuse a supplier's name or mimic the tone of past messages. Sometimes they hack or spoof an email account so the message appears to come from someone you already know.
The most common trick is to change the banking details on what looks like a genuine invoice. The scammer may say the supplier has a new bank account, that an old account is closed or that payment must go to a different branch today. They often add urgency, "pay before close of business" or "the delivery will be cancelled", so you act before calling anyone.
If the business pays without checking, the money may go to the scammer instead of the real supplier. The real supplier still expects payment. Your business may then face a double loss: money sent to a criminal and a supplier who has not been paid.
Definition
Fake invoice scam
A fraud where a criminal sends or alters an invoice so that payment is directed to the scammer's bank account instead of the real supplier or recipient.
A changed account on a familiar invoice
You run a small building business. Each month you pay a materials supplier you have used for years.
On Tuesday, an invoice arrives by email. It looks normal, but the banking details are different. The message says the supplier's bank account was "updated" and payment must go to the new account today to avoid delays on your next order.
You pay immediately because the work is urgent. Later, the real supplier calls to ask why the invoice is unpaid. The email did not come from them. The money went to a scammer.
Warning signs to watch for
Fake invoice scams rarely look obviously fake at first glance. The warning signs are often small changes combined with pressure to pay quickly.
Be careful when banking details have changed, especially if the change arrived by email or WhatsApp rather than through a contact method you already use. Watch for urgent payment demands, spelling or formatting that differs slightly from past messages, a sender using a new phone number or email address, or instructions not to call the supplier directly.
Also check whether the bank account name matches the supplier's registered business name. A legitimate supplier may change banking details, but they will not usually ask you to skip verification.
Build one payment rule
The safest businesses keep payment rules simple enough that anyone handling money can follow them under pressure.
Create one clear rule for your business:
No changed banking details are paid until verified through a trusted contact method.
A trusted contact method is a phone number, email address or in-person contact you already use with that supplier, not the number or address on the suspicious invoice. This rule protects you even when the message looks convincing.
For larger payments, consider requiring two people to approve the transfer where possible. One person checks the invoice. Another confirms the banking details through a known contact. Separation creates a pause that scammers try to remove.
| Without a payment rule | With a payment rule |
|---|---|
| Staff pay changed details when a message looks urgent | Changed details must be verified first |
| Scammers succeed by creating time pressure | The business slows down and checks |
| Losses may be discovered only when the real supplier calls | Payment goes to the correct account |
Verify before you pay
When banking details change, treat the invoice as unconfirmed until you have spoken to the real supplier or client using contact information you already trust.
Do not use the phone number, email address or WhatsApp contact on the suspicious message. Scammers include fake contact details so that your "verification" call reaches them instead of the real business.
If you suspect a scam
Act quickly if you think a payment may have gone to the wrong account.
Stop any further payment if it has not yet cleared. Contact your bank immediately and explain what happened. Ask whether the payment can be stopped or traced. Recovery is not guaranteed, but early contact gives the bank the earliest opportunity to respond.
Warn the real supplier or client so they know what happened. Save all messages, invoices, proof of payment and banking details. Report the incident through the correct channels your bank or insurer recommends. Review who has access to payment systems and whether passwords or approval processes need to change.
A common mistake
The most common mistake is paying changed banking details without calling a trusted contact on a known number. Scammers sound professional and create urgency on purpose. A payment rule only works when the business uses it every time, not only when a message looks suspicious.
Your next step
Write down your one payment rule and share it with anyone who approves or makes payments for the business. Add it to your invoice folder or payment checklist so it is visible before each transfer.
Keep learning
The next topic explains why you should never disclose an OTP or approve a banking request you did not start.
Scammers who fail with a fake invoice may try again through an urgent call or message asking for your security code.