Fake Invoice Scam Signs: How Business Email Compromise Drains Company Accounts

Learning the fake invoice scam signs may be the single most valuable skill anyone who handles company money can develop. This attack — a form of business email compromise (BEC) — does not use malware or hacking in the traditional sense. Instead, criminals send an email that looks exactly like a legitimate vendor invoice or an urgent payment-change request, and a well-meaning employee wires real company money to the criminals’ account. It is simple, quiet, and devastating.

The scale of the damage is enormous. The FBI’s Internet Crime Complaint Center (IC3) reported 21,442 business email compromise complaints in 2024, with reported losses of $2.77 billion — making BEC the second costliest category of internet crime that year, behind only investment fraud. Total reported cybercrime losses reached a record $16.6 billion. And the losses are not fading: nearly $8.5 billion in BEC losses were reported to IC3 between 2022 and 2024. An Association for Financial Professionals survey found that 63% of organizations experienced BEC in a single year.

What makes this fraud especially dangerous is who it targets and how it feels. The people who fall for it are usually diligent, fast, competent employees — accounts-payable clerks, office managers, controllers — doing their jobs well under time pressure. This article explains exactly how the attack unfolds, the red flags to watch for, and the verification habits that stop it cold.

How Fake Invoice Fraud Works, Step by Step

Every fake-invoice attack follows a recognizable script. Understanding it turns a confusing email into an obvious trap:

Step 1: Reconnaissance. The criminals research your company online. They learn who your vendors are, who approves payments, and when big invoices are due. Company websites, press releases, LinkedIn profiles, and social media all hand them the org chart they need. They may also buy stolen credentials from earlier data breaches.

Step 2: Access or impersonation. There are two main variants. In the spoofed version, the criminals create a lookalike email address — for example, accounting@vend0r-company.com instead of accounting@vendor-company.com — close enough to fool a busy reader. In the compromised version, which the FBI calls email account compromise (EAC), the criminals actually break into the real vendor’s email account through phishing or credential theft. That version is far harder to detect, because the messages come from a genuine address.

Step 3: The invoice or the “update.” Two payloads are common. The first is a fake invoice: an invoice for goods or services that looks nearly identical to the vendor’s real ones — correct logo, plausible invoice number, familiar contact names — but with the criminal’s bank details. The second is an “updated payment instructions” email: “We have changed banks. Please wire this invoice — and all future invoices — to our new account.” In some cases criminals infiltrate a real email thread about an actual outstanding invoice, making the request look perfectly routine.

Step 4: Urgency and secrecy. The email almost always adds pressure: the CEO is traveling, the payment is already overdue, the shipment will be held, or the matter is confidential. The goal is to make the employee skip verification. The FBI specifically warns to be wary when the requester presses you to act quickly.

Step 5: The wire. The employee wires the money — often tens or hundreds of thousands of dollars — to the account the criminals control. The account is usually a “money mule” account opened with stolen identity documents.

Step 6: The money disappears. Within hours, the criminals move the funds through multiple accounts, often converting them into cryptocurrency or sending them overseas. This is why speed matters so much in response: the first 24 hours are the window in which a wire recall has any chance of working.

Related variants use the same playbook. A CEO fraud email impersonates an executive asking an assistant to wire money or buy gift cards urgently. A payroll diversion email impersonates an employee asking HR to change their direct-deposit details. In real estate, a fake “title company” email instructs a homebuyer to wire a down payment to criminals — the FBI lists this exact scenario on its BEC page.

fake invoice scam signs: the red flags every employee should know

Print this list, laminate it, and tape it next to every computer that can authorize a payment:

Sudden “updated” wire instructions. A vendor’s banking details almost never change out of the blue. The FBI’s own guidance treats any payment-instruction change as a high-risk event. Treat every change as guilty until proven innocent.
Lookalike domains. Criminals register domains that differ by a single character: rn instead of m (as in “rnicrosoft” vs “microsoft”), an extra hyphen, a missing letter, or a different extension — vendor.co instead of vendor.com. The display name in your inbox shows “Trusted Vendor” while the actual address is a forgery. Always check the real sender address, not just the display name.
Reply-to mismatch. The “From” address looks right but the “Reply-To” goes elsewhere. This is a dead giveaway — the criminals need your reply to reach them, not the real vendor.
Urgency, secrecy, or authority pressure. “Wire this today, the CEO is on a plane.” “Keep this confidential.” Legitimate vendors do not demand secrecy about a routine invoice. The FBI explicitly warns to be especially wary when the requester is pressing you to act quickly.
A new phone number inside the email. Criminals often include a phone number “if you have questions” — and a co-conspirator answers it. Never call the number in the email. Always use a number already in your records.
Changed email footer, tone, or signature. If the vendor’s emails normally end with a long compliance footer and this one doesn’t, or the writing style suddenly shifts, something is off.
Invoice details that are slightly wrong. The amount is a little different from what you expected, the invoice number doesn’t match your sequence, or line items are vague. Compare every invoice against your purchase records — never pay from the email alone.
Requests to avoid normal channels. “Don’t call the office, just reply to this email.” “Wire it directly, skip the usual approval.” Any instruction to bypass your company’s process is a blaring alarm.
Gift cards or cryptocurrency as payment. No legitimate vendor asks to be paid in gift card codes or crypto sent to a wallet address. The FBI lists this as a textbook BEC example.
The CEO or executive “can’t be reached.” If an urgent executive request arrives while the executive is supposedly unreachable, that is the scam working as designed. Wait and verify.
Slightly altered logos or letterheads. Rebuilt-from-scratch invoices often have blurry logos, wrong fonts, or odd spacing compared to genuine ones. Keep one genuine invoice on file for comparison.
Requests sent at odd hours or with odd grammar. A burst of urgent payment emails at 11 p.m. from an overseas time zone, or a sudden change in language quality, deserves a second look.

No single red flag is proof — real vendors do occasionally change banks. But two or three together should stop every payment until the request is verified.

How to Verify a Payment Request: 8 Steps

Call back on a known number. This is the single most effective defense. Confirm any change to bank details, routing numbers, or payment instructions by phone — using a number from your own records, a past invoice, or the vendor’s official website. Never use the number in the suspicious email. A phone call to a number the attacker doesn’t control breaks the scam completely: even if the email came from a genuinely compromised mailbox, the real vendor will say “we didn’t change anything.”
Require two-person approval for wires. Set a dollar threshold (many small businesses use $5,000) above which a second person must approve the payment. The second approver should independently confirm the recipient details.
Inspect the actual email address and headers. Don’t trust the display name. Expand the sender field, check for lookalike characters, verify the reply-to address, and — if your email system allows — view the full headers to confirm the message truly originated from the vendor’s mail server.
Start a fresh thread. Instead of replying to the suspicious email (which goes to the criminals), compose a new message to the vendor’s known address asking them to confirm the change in writing.
Enforce a waiting period. Consider a mandatory 24-hour hold on any new or changed payment instructions. Legitimate vendors can survive a one-day delay; criminals depend on speed.
Check your own records first. Compare the invoice against purchase orders and past invoices before paying. If the amount, terms, or formatting don’t match your history, investigate.
Lock down email security. Require multi-factor authentication on every business email account — especially finance, HR, and executive accounts — and implement email authentication (SPF, DKIM, and DMARC) so spoofed messages from your own domain get rejected.
Make verification a written policy. Put the rules in writing: no payment-instruction change is processed on email alone, no one gets in trouble for pausing a payment to verify, and gift cards are never purchased on anyone’s emailed say-so. Train every employee who touches money, and run realistic phishing simulations so the habit survives under pressure.

What to Do If Your Company Already Sent the Money

Act in minutes, not days. The faster you move, the better your odds:

Call your bank immediately. Ask for a wire recall or reversal, and ask your bank to contact the receiving financial institution to request a freeze on the funds. Time is everything — recalls have the best chance within the first 24 hours.
Report to the FBI’s IC3 at ic3.gov. The FBI’s Internet Crime Complaint Center collects BEC reports, and rapid reporting can help trigger the FBI’s recovery process in some cases.
Contact your local FBI field office as well, particularly for large losses — agents can sometimes act faster than an online complaint alone.
Preserve everything. Save the original emails with full headers, the invoice, wire confirmations, and any related correspondence. Do not delete the messages, even if they embarrass someone — they are evidence.
Alert the real vendor. If the vendor’s email was compromised, they need to know immediately so they can secure their accounts and warn their other customers.
Notify your cyber-liability insurer if you carry coverage, and consider having a professional review your email security so the attackers can’t strike twice through the same open door.

How to Report Fake Invoice and BEC Scams

FBI Internet Crime Complaint Center: File at ic3.gov — this is the primary federal reporting channel for BEC. Also report to your local FBI field office for significant losses.
FTC: Report at ReportFraud.ftc.gov. The FTC uses reports to track fraud patterns and support enforcement.
Your financial institution: Your bank’s fraud department needs the details immediately, both to attempt recovery and to flag the receiving account.
The impersonated vendor: Tell them directly so they can secure their systems and warn other customers.
Real-estate transactions: If a fake title-company email targeted a home purchase, also notify your state attorney general’s consumer protection office.
Law enforcement: File a report with your local police department — a police report number is often required by banks and insurers.

The Bottom Line

Fake-invoice fraud succeeds not because employees are careless, but because the emails are designed to look exactly like routine business. The defense is procedural, not technical: verify every payment-instruction change by phone using a number you already have, require a second pair of eyes on wires, and never let urgency override the process. A thirty-second phone call is the cheapest insurance your company will ever buy.

Sources

FBI, “Business Email Compromise” — https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-frauds-and-scams/business-email-compromise
FBI Internet Crime Complaint Center, “2024 IC3 Annual Report” (BEC: 21,442 complaints, $2.77 billion in losses) — https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf
Nacha, “FBI’s IC3 Finds Almost $8.5 Billion Lost to Business Email Compromise in Last Three Years” — https://www.nACHa.org/news/fbis-ic3-finds-almost-85-billion-lost-business-email-compromise-last-three-years
Infosecurity Magazine, “FBI Reveals ‘Staggering’ $16.6bn Lost to Cybercrime in 2024” — https://www.infosecurity-magazine.com/news/fbi-staggering-lost-cybercrime-2024/
First Hawaiian Bank, “Business Email Compromise (BEC) is on the Rise” — https://www.fhb.com/en/resource-center/small-business/business-email-compromise-is-on-the-rise

Last reviewed: October 2026

This article is for education only and is not financial or legal advice.