Cybersecurity · 5 min read
How to Spot a Fake Invoice or Payment Change Request
Payment fraud by email is one of the costliest scams small businesses face. Here is how it works, the warning signs, and the one habit that stops it.
By Tediso ·
It usually arrives as an ordinary email. A supplier you have paid for years writes to say their bank details have changed. A contractor sends a final invoice with new wiring instructions. Your boss, who is traveling, asks you to send a quick payment before the end of the day.
This is business email compromise, and the FBI consistently ranks it among the most costly cybercrimes it tracks. It works because nothing looks technical about it. There is no virus and no strange attachment, just a believable request and a little time pressure.
How the scam works
Criminals either break into a real email account (yours, a vendor's, or a customer's) or create an address that looks almost identical. Then they wait for a moment when money is expected to move and insert themselves into the conversation.
Because they have often read the real email thread, the message can reference actual projects, invoice numbers, and people. That is what makes it convincing.
Warning signs
- Any change to bank account or wiring details, especially by email alone.
- Urgency or secrecy: "this needs to go out today," "please keep this between us."
- A sender address that is slightly off, such as an extra letter or a different domain ending.
- A reply-to address that differs from the sender when you hit Reply.
- Requests to pay by gift card, wire, or cryptocurrency instead of your usual method.
- A familiar contact writing in an unusual tone or at an unusual time.
The one habit that stops it
Verify every payment change by phone, using a number you already have on file, never the number in the email. A two-minute call defeats almost every version of this scam, because the criminal controls the email conversation but not the vendor's real phone line.
If you think you have been targeted
- Do not send the payment, or if it has already gone, call your bank immediately and ask them to attempt a recall. Speed matters.
- Report it to the FBI's Internet Crime Complaint Center at ic3.gov.
- Change the password on any email account that may have been compromised and turn on multifactor authentication.
- Warn the real vendor or customer so they can check their own systems.