Invoice Fraud and Fake Payment Requests: How to Protect Your Business

Some of the most costly scams against small businesses involve no malware at all. They involve a believable email and a person trying to be helpful. A vendor writes to say their bank details have changed. The owner, traveling, asks for an urgent payment. A familiar supplier sends an invoice that looks exactly like last month's, except the account number is different.

This is often called business email compromise, and it works because it borrows trust that already exists. The defense is not a product. It is a few habits that make verification automatic.

How the scheme works

Criminals gain access to an email account, either yours, a vendor's or a customer's, often through a phishing page that collected a password. Then they read quietly. They learn who pays whom, how invoices look, when payments are due and how people write.

When the timing is right, they send a message that fits naturally into an existing conversation. Sometimes it comes from the real, compromised account. Sometimes it comes from a lookalike address with one letter changed. Either way, the request asks money to go somewhere new.

Five patterns to recognize

1. The bank change. A vendor "updates" their payment details right before a large invoice is due.
2. The urgent boss. A message appearing to come from an owner or director asks for a quick, confidential payment, often while they are "in a meeting" and cannot talk.
3. The payroll switch. An employee appears to ask HR to change their direct deposit account before the next payday.
4. The closing wire. In real estate and large purchases, last-minute "updated wiring instructions" arrive just before closing.
5. The invoice from nowhere. A bill arrives for a listing, directory, domain or service you never ordered, hoping it gets paid with everything else.

The controls that stop it

You do not need a finance department to put these in place. Write them down and make them the rule, especially when someone says it is urgent.

Call back on a known number

Any change to payment details, for vendors, customers or employees, gets confirmed by phone using a number you already had on file. Never use a phone number from the email that requested the change, since it may lead straight to the scammer.

Require two people for larger payments

Pick an amount that makes sense for your business. Payments above it need a second person to review and approve. For very small teams, the second person can be a business partner, a spouse who helps with the books, or a trusted bookkeeper.

Treat urgency and secrecy as red flags

Legitimate requests can wait for a five-minute phone call. A message that insists on secrecy, skipping the normal process, or paying before the end of the day deserves extra checking, not less.

Slow down vendor changes

Keep a simple process for adding or changing a vendor's payment details: who can do it, how it is verified and a short waiting period before the first payment to the new account.

Protect the email accounts

Most of these schemes start with a compromised mailbox. Turn on two-factor authentication for every business email account and remove forwarding rules nobody recognizes.

Match invoices to real orders

Before paying, confirm that the invoice matches something you actually ordered and received. Unknown "renewals" and listing fees should be checked against your own records. Our guide to scam emails aimed at website owners covers several of the most common fake bills.

Train the people who pay the bills

Spend fifteen minutes with anyone who handles money. Walk through the patterns above and agree on one sentence everyone can use: "I will call to confirm, that is our policy." Make it clear that nobody will be in trouble for delaying a payment to verify it, including a payment the owner appears to request. A team that knows how to spot a phishing email is harder to fool at every step.

If money has already been sent

Speed matters more than anything else.

1. Call your bank immediately and ask it to attempt a recall of the payment. Ask the bank to contact the receiving bank.
2. Report the incident to the FBI's Internet Crime Complaint Center at ic3.gov if you are in the United States, and to local police.
3. Secure the email account that was used or impersonated, and check it for forwarding rules and unfamiliar sign-ins.
4. Notify the real vendor or customer so they can secure their own systems.
5. Contact your insurance agent to ask whether your policy covers this kind of loss, and talk with an attorney about any obligations to others.

Frequently asked questions

Does business insurance cover invoice fraud?

It depends on the policy. Some cyber or crime policies cover social engineering losses, often as a separate item with its own limits. Ask your agent before you need it.

What payment amount should require a second approval?

Choose a threshold that fits your normal payments. Regardless of amount, any change to someone's bank details should always require a phone call to a known number.

We are a two-person business. Do these controls still apply?

Yes. The callback rule costs nothing and stops the most common version of this scam. Agreeing on it in advance makes it easy to follow when a message feels urgent.