Written byInvoice fraud is a type of fraud in which criminals send fake or altered invoices, or bogus bank-detail changes, to trick a business into paying an account they control.
Also known as: fake invoice scam, false billing, business email compromise (BEC), payment redirection scam
Key points
- It includes false billing, supplier impersonation, account-change scams and business email compromise (BEC).
- Attacks follow a pattern: research the target, insert a fake invoice or bank-detail change, apply urgency, redirect the payment.
- A single incident can cost tens of thousands of dollars and hurt supplier relationships and cashflow; recovery is hard once funds move offshore.
- The cheapest defences are verified supplier records, dual approval above a set threshold, phone verification of bank changes and staff training.
- Small teams are targeted most because they have the fewest controls; a two-person rule and a trusted supplier list go a long way.
How invoice fraud works
Attacks usually run in four steps. Reconnaissance: scammers research your business, suppliers and staff through public sources and social media, and may probe finance inboxes to learn your invoice formats and approval habits. Insertion: they send a fake invoice or a supplier-change notice from a spoofed address that looks like a supplier, from a compromised supplier mailbox, or by intercepting a real invoice in transit.
Escalation: the invoice demands urgency, threatens to stop supply, or asks you to update bank details, sometimes backed by phone calls impersonating the supplier or your own procurement team. Payment redirection: the money goes to a mule account or a fast-clearing payment rail and is withdrawn or moved offshore before anyone notices. Most successful scams combine a technical gap, such as weak email authentication, with a human one, such as no independent verification.
Red flags to watch for
Treat these as reasons to pause a payment: a new bank account for a long-standing supplier without independent verification; urgent or threatening language such as "final notice" or "pay today"; one-letter substitutions in the sender's domain or a personal email address; invoice numbers, amounts or dates that do not match the purchase order or contract; invoices from suppliers not in your masterfile or sudden activity from a dormant one; different fonts, poor logos or odd grammar on a high-value invoice; a request to switch payment method or pay an offshore account; and repeated calls pressuring one staff member.
A single flag is a cue for independent confirmation, not proof of a scam. Call the supplier on the number in your masterfile, never the one on the request, before anything is paid.
Preventing and responding to invoice fraud
Prevention is layered. People and process: a supplier onboarding checklist with ABN verification and verified bank details, a masterfile that only a few people can edit and that is audited regularly, two sign-offs for payments above a set threshold, a signed supplier-change form backed by a phone call, and regular training. Technology: DMARC, SPF and DKIM on your domain, multi-factor authentication and least-privilege access to accounts payable systems, a secure supplier portal instead of email, and accounting-system rules that flag bank-detail changes, new suppliers and duplicate invoice numbers. If you use invoice finance or factoring, include the lender in your verification process.
If you suspect a fake invoice, stop the payment and call your bank immediately, preserve the email with its headers and attachments, verify with the supplier on a known number, notify finance leadership, IT and legal, then report to Scamwatch, your local police and the Australian Cyber Security Centre. Tell your insurer if you hold crime or cyber cover.
Not to be confused with
- Fraud
- fraud is the general offence of deliberate deception for gain; invoice fraud is the version aimed at a business's accounts payable
- Invoice discounting
- invoice discounting is legitimate finance raised against your own unpaid invoices; invoice fraud is a scam that uses fake or altered invoices
Frequently asked questions
What should I do first if we have paid a fake invoice?
Contact your bank immediately and ask for a recall or freeze, giving the transaction ID, amount and beneficiary details. Then preserve the evidence (the original email with headers, attachments and receipts), verify with the supplier on a known number, notify finance leadership and police, and record who was told and when.
Can the bank reverse a fraudulent transfer?
Sometimes. Banks can attempt a recall, freeze or trace, but success depends on timing and whether the funds are still sitting in an account under a bank's control. Recovery is far more likely when you report within hours; once the money is withdrawn or sent offshore it becomes very difficult.
How do I verify a supplier's new bank details safely?
Call the supplier on a phone number already in your masterfile, not the number on the change request. Ask for a bank statement extract showing the account name and BSB, and require a signed supplier-change form with the old and new details, the reason and an authorised signatory. Never process a change on an email alone.
Where do I report invoice fraud in Australia?
Report to your bank's fraud line first, then to Scamwatch, your local police (get an event number, which banks and insurers often ask for) and the Australian Cyber Security Centre's reporting portal. Include the transaction details, full email headers, the invoice and attachments, and your supplier masterfile record.
Does cyber insurance cover invoice fraud?
Policies vary. Some cyber or crime policies cover business email compromise losses, so check your policy wording and speak to your insurer. If an incident occurs, notify the insurer promptly and follow its claims process, providing detailed logs, proof of your controls and evidence of the loss.
Related terms
Broader term: Fraud
Fraud
Fraud is deliberate deception or misrepresentation intended to secure an unfair or unlawful gain or cause loss, such as false documents on a loan application.
Read definitionInvoice discounting
Invoice discounting is a working capital facility where a lender advances most of an unpaid invoice's value and holds a reserve until your customer pays.
Read definitionFactoring
Factoring is a finance arrangement where a business sells or assigns its unpaid invoices to a specialist lender, the factor, for an immediate cash advance and outsourced collections.
Read definitionSupplier
A supplier is the party that sells the asset being financed, whether a vehicle dealer, equipment distributor, manufacturer or private seller, and is usually paid by the lender at settlement.
Read definitionCash flow
Cash flow is the movement of money into and out of a business over a period; unlike profit, it tracks actual receipts and payments, so it measures liquidity.
Read definitionReceivables
Receivables are amounts owed to your business, mainly by customers for goods or services supplied on credit, recorded as assets on the balance sheet until they are collected.
Read definitionGo deeper
Sources
This article is general information only and is not financial advice.