PayeeGuard

Invoice fraud · checked 21 October 2026

Fake invoice red flags

Most invoice fraud doesn't look fake. It's a real supplier's invoice, often sent from their real (hacked) mailbox or a lookalike address, with one thing changed: where the money goes. These are the signs to stop and check before you pay.

The payment details

  1. New bank details, especially announced in the same email as the invoice. This is the single biggest red flag.
  2. An account in a different name from the supplier, or at a bank in a different country from where they're based.
  3. A bank name check that doesn't match: "close match" or "no match" on Confirmation of Payee or Verification of Payee.
  4. A request to pay a different way than usual: a new payment app, a card, gift cards or crypto.

The email

  1. A lookalike sender address: one letter off, a different ending (.co instead of .com), or a free email account.
  2. Reply-to that differs from the sender address.
  3. A reply in an old thread that suddenly changes the payment instructions. Hacked mailboxes do this.
  4. Urgency or secrecy: "pay today to avoid suspension", "don't call, I'm in meetings", "keep this confidential".

The invoice itself

  1. A different layout, logo or invoice numbering from previous invoices.
  2. An amount, PO number or service you can't match to an order or contract.
  3. A duplicate of an invoice you already paid, "re-sent with updated details".
  4. A first invoice from a new supplier nobody internally asked for.

What to do when you see one

  1. Don't reply to the email and don't use any phone number in it.
  2. Call the supplier on a number you already had, from an old invoice, contract or their official website, and ask them to confirm the bank details.
  3. Have a second person approve any bank change, and hold the payment until it's verified. How to verify a bank change.
  4. If it's fake, warn the supplier: their mailbox may be compromised.

Already paid? Move fast: the first 24 hours. Want a written process for your team? Free bank-detail change form and policy.

Check a suspicious email free Set up call-backs and approvals