All guides

6 min read

Invoice fraud: how small businesses fall for it, and how to stop it

Invoice fraud is simple: someone gets you to pay a real-looking bill into their bank account instead of your supplier's. No hacking skills needed, just one email that arrives at the right moment.

In its 2024 report, the FBI's Internet Crime Complaint Center counted 21,442 business email compromise complaints and about $2.77 billion in reported losses in the U.S. alone. A bank transfer, once sent, is very hard to get back.

Why small businesses are the easiest target

Large companies have a finance team, approval rules and software that flags a changed bank account. A small business usually has one person who reads the email, opens the invoice and pays it, often between two other jobs.

Bookkeepers who pay bills for several clients are an even better target: one inbox, dozens of vendors, and a steady flow of payments that nobody double-checks.

The four patterns behind most invoice fraud

  • The bank change: a real invoice, real amount, real invoice number, and one new line: "please note our new bank details".
  • The lookalike sender: the email comes from an address one letter off from your vendor's, like brightline-packagng.com instead of brightlinepackaging.com.
  • The hijacked thread: the scammer gets into your vendor's real mailbox and replies inside an existing conversation, so everything looks normal.
  • The fake rush: "pay today to avoid late fees", "our accounts team is under audit, don't call". Urgency and secrecy are there to stop you from checking.

Why spotting typos no longer works

Scam emails used to be easy to recognize: odd grammar, wrong logo, strange tone. AI now writes in your vendor's exact style and copies their signature. The giveaways that remain are boring details: the sender's address, where your reply goes, and whether the bank details match the last invoice you paid.

The one habit that stops almost all of it

Any change of bank details by email gets a phone call before you pay. Not a reply, a call.

  1. 1Call the vendor on a number you already had: an old invoice, your records, or their website that you look up yourself. Never a number from the email.
  2. 2Ask them to read you the last 4 digits of the new account. Don't read them yours.
  3. 3Keep paying the old account until they confirm, and write down who you spoke to and when.

What to do if you already paid

  • Call your bank immediately and ask for a recall of the transfer. Speed matters more than anything else.
  • File a complaint at ic3.gov, the FBI's Internet Crime Complaint Center.
  • Tell the real vendor, so they can warn other customers and secure their mailbox.