Fake invoice fraud often succeeds because the request looks routine. An accounts payable clerk receives what appears to be an ordinary bill from a familiar supplier and processes it alongside every other bill that week. Nothing about the transaction looks like an attack while it is happening, yet the consequences can extend far beyond one mistaken payment. Recognizing the risk starts with understanding why ordinary business trust can be so convincing.
This article walks through how these schemes reach the payment stage, the signals that give them away before a wire clears, and the controls that make the payments team harder to fool. The stakes are practical: once funds move, recovery becomes a matter of hours, not days.
Key Takeaways
Fake invoice fraud covers any scheme that induces payment on a fabricated invoice or redirects payment on a genuine one, whether an outside attacker or an employee is behind it.
External impersonation and insider billing schemes leave different evidence, but payment verification, matching, dual authorization, and segregation controls can address both.
Reliable detection layers document, email, process, and behavioral signals, because generative AI has made polished writing and even a familiar face on a video call unreliable as proof of identity.
Recovery after a fraudulent payment depends on immediate contact with the financial institution and law enforcement.
What Is Fake Invoice Fraud?
Fake invoice fraud is any scheme that gets a business to pay a fabricated invoice or send payment for a genuine invoice to an account the payee does not control. The definition is broad because the same loss can arrive from inside or outside the business.
From outside, the fraud usually travels through business email compromise (BEC). One invoice-focused variant is the bogus invoice scheme, also called the supplier swindle: a business with a longstanding supplier relationship is asked to send payment to an alternate account. When the attacker operates from inside a supplier's actual mailbox, the variant is usually called vendor email compromise (VEC). At the low-tech end, scammers bill businesses for products and services nobody ordered.
From inside, billing schemes can involve an employee causing the employer to pay for fictitious goods or services. Employees may also inflate invoices or disguise personal purchases as business expenses. Accounts payable can face both forms at once.
How Does Fake Invoice Fraud Work?
Fake invoice fraud works by exploiting trust and control gaps during reconnaissance, impersonation, invoice approval, payment, and the dispersal of funds. Each point is also a place where the scheme can be interrupted.
Reconnaissance, Account Compromise, and Vendor Impersonation
Attackers start by learning who pays the bills. Company websites and professional profiles can reveal who handles transfers and which suppliers a company uses. Data from earlier breaches may identify who approves payments. This research may continue long before an email goes out.
A credible sender can come from any of three routes:
Mailbox Takeover: The attacker gains control of a legitimate mailbox through a phishing page that mimics a cloud email login.
Lookalike Domain Registration: The attacker registers a domain that differs subtly from the vendor's real address.
Display-Name Deception: The attacker sends from an unrelated address but uses the name of an executive or supplier contact — the simplest method, since it requires no domain of its own.
Email authentication can block exact-domain spoofing through Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC). Display-name deception forges no domain, however, so all three checks can pass. A compromised mailbox also enables surveillance: attackers can hide vendor messages in an overlooked folder, wait for a pending invoice, and reply inside a thread carrying the correct names, subject line, and conversation history.
Invoice Manipulation, Payment Approval, and Fund Dispersal
The attacker may send an invoice that copies the vendor's usual bill but carries new payment instructions, or intercept a genuine invoice and edit the bank details. The content, sender, and formatting can all be correct; only the account number is wrong. A weak workflow turns this request into payment when the same person can update vendor records and approve the transaction, or when reviewers do not match the invoice against purchasing and receiving records.
Attackers borrow authority from an impersonated executive or supplier and create urgency with a past-due notice or quarter-end cutoff. They may also claim that the sender is reachable only by email. Picture an accounts payable coordinator two hours from a quarter-end close, working through a backlog of thirty invoices: a message from "the CFO" marked urgent, asking for one more wire before the books lock, does not read as suspicious in that moment — it reads like Tuesday. Job relevance is quieter: a bank-change notice from a known supplier is exactly the request an accounts payable employee is trained to handle.
Once the wire clears, the money often lands in a mule account held by someone recruited to receive and move funds. The mule may withdraw the money or split it across accounts and jurisdictions. Some schemes direct payment to an account held by a cryptocurrency exchange on behalf of its customers. This can obscure where the money went. The speed of this final stage of payment fraud turns recovery into a race.
Common Types of Invoice Scams
Fake invoice fraud splits into external schemes, where an outsider impersonates a vendor or hijacks a payment, and internal schemes, where an employee bills the company for things it never received. The two produce the same fraudulent payment while leaving different evidence and requiring some distinct controls.
External Vendor Impersonation and Payment Diversion
External schemes exploit a company's trust in its suppliers. The common variants include:
Bogus Invoices: Attackers send bills that copy a known vendor's format but direct payment to their accounts.
Compromised Vendor Accounts: Attackers send from suppliers' own mailboxes. Messages from those mailboxes can pass technical checks and appear inside genuine conversations.
Lookalike Domains: Attackers use subtly altered domains to run parallel conversations without touching suppliers' systems.
Unauthorized Bank-Detail Changes: Attackers request updated remittance details just ahead of scheduled payments, often after watching the relevant threads.
Duplicates and Overbilling: Fraudsters resubmit paid invoices with tweaked numbers or bill for more units than vendors shipped.
The Rimasauskas case shows how far this can reach. Evaldas Rimasauskas registered a company under the name of a real hardware manufacturer used by two large US technology companies. His group gathered employee names, then used that shell company to send phishing emails and forged invoices, contracts, and letters carrying false corporate seals to request bank-account changes. Money moved through several countries — Latvia, Cyprus, Slovakia, Lithuania, Hungary, and Hong Kong before investigators froze funds. The established supplier relationship was the thing being exploited.
Internal Billing Schemes and Employee Collusion
Shell Companies: Exploiting gaps between people rather than gaps in email, employees set up vendor entities, often with names close to real suppliers' names, and approve their invoices.
Pay-and-Return Schemes: Employees overpay legitimate vendors or pay them twice, then split the returned excess with the vendors.
Personal Schemes: Employees code items for personal use as business expenses.
Sole control over a financial function can let these schemes run for years. A government employee created purchase orders and paid a colluding vendor for goods never provided. A city comptroller's falsified invoices and hidden account surfaced only when a colleague handled payroll during her vacation. An aerospace company employee also ran false invoices from relatives and associates. In each case, one person controlled vendor creation, purchasing, approval, or reconciliation without a second set of eyes. The fraud bypassed email filtering because it exploited the payment process.
Warning Signs of Invoice Fraud
Reliable detection combines document, email, process, and behavioral signals because any single signal can be absent from a well-built scheme. Signals worth including in an accounts payable review include:
Document Signals: Reviewers may notice a change in invoice format or letterhead, a missing purchase order reference, a suspiciously round amount, several invoices clustered just under an approval threshold, or a near-duplicate of a paid invoice.
Email Signals: Warning signs include a sender domain that differs subtly from the vendor's, a personal webmail address where a corporate one is expected, an authentication warning from the mail system, or a generic greeting with no signer details.
Process Signals: New bank details arriving just before a scheduled payment or a sudden rise in invoice volume from one vendor can justify additional review. So can an amount far above that vendor's average.
Behavioral Signals: Pressure to pay immediately, a request for secrecy, a sender available only by email, or a suggestion to skip the usual approval step can indicate manipulation.
Spelling and grammar once ranked high on this list. In a December 2024 advisory, the FBI's Internet Crime Complaint Center (IC3) warned that generative AI tools "can correct for human errors that might otherwise serve as warning signs of fraud." The same technology can clone voices and generate video. A finance employee joined a video conference in which every other participant was a deepfake recreation, then made a series of wire transfers. Would a callback to a number already on file have stopped that payment? It's the one check a deepfake can't pass. Verification through a channel the attacker cannot control, such as a callback to a number already on file, now outweighs tone, grammar, or a face on screen.
How to Prevent Invoice Fraud
Preventing fake invoice fraud takes coordinated accounts payable, vendor-verification, identity, and email controls. Accounts payable controls catch fraudulent payments, while vendor and email controls stop fraudulent identities from getting that far.
Accounts-Payable Controls That Interrupt Fraudulent Payments
Controls that address insider schemes also catch many external ones because both end in payments that do not match legitimate records. The controls with the widest coverage include:
Three-Way Matching: An invoice is paid only when it matches a purchase order and receiving report. This helps expose phantom goods and overbilling.
Segregation of Duties: The person who creates a vendor record does not approve its purchases, and the payment approver does not reconcile the bank statement.
Least Privilege: The ability to change vendor bank details belongs to a limited group, and the system logs each change.
Dual Authorization: Payments above a set amount and every bank-detail change require two approvals.
Vendor Master Reviews: Periodic reviews can identify vendor addresses matching employee addresses and P.O. boxes used by service providers. They can also flag vendors created and paid within days.
Fuzzy Duplicate Detection: Comparing the vendor and amount can identify duplicates that exact invoice-number matching misses, especially when the dates are close.
Pattern Monitoring: Monitoring can flag clusters below approval limits and rising invoice counts. It can also identify leading-digit patterns that differ from genuine data.
Smaller organizations can use compensating controls when they cannot separate every role. An owner can approve payments through a separate login, while bank-side dual control adds another reviewer. Mandatory vacations and job rotation can expose hidden fraud. Outside review of the vendor file provides another check.
Vendor and Email Controls That Verify Identity
The North Carolina State Auditor's 2026 investigation of the Town of Newland found that a finance officer authorized an $82,123 wire transfer without independently verifying the payment method with the actual vendor. The town recovered $66,913 of it — about 82% — with $15,210 unrecovered.
For onboarding, organizations should obtain contact details from an independently verified business registry or known website rather than the invoice. They should record bank information on a documented form with the approver's name. For bank-detail changes, someone other than the recipient should call a number already on file and record the confirmation.
On the identity side, phishing-resistant multifactor authentication (MFA) protects valuable mailboxes. Authenticators that rely on manually typed codes do not qualify as phishing-resistant because the code is not bound to the session. Alerts on new forwarding or inbox rules can reveal surveillance, while registering similar domains denies attackers easy lookalikes.
SPF states which servers may send for a domain, and DKIM signs messages so changes are detectable. DMARC connects both checks to the visible sender address. A reject policy can stop exact-domain spoofing but not display-name deception or messages from a compromised account, so independent verification remains necessary.
What to Do After Paying a Fraudulent Invoice
Recovery after paying a fake invoice depends heavily on how quickly the first calls happen. The FBI IC3's 2023 advisory puts it plainly: "If you discover a fraudulent transfer, time is of the essence. First, contact your financial institution and request a recall of the funds along with any necessary indemnification documents." The steps, in order, are:
Bank Recall: The business should ask its bank to recall or reverse the wire and issue any indemnification documents the receiving institution requires.
IC3 Complaint: A complaint filed at ic3.gov with full transaction details allows the FBI to work with the banks to freeze funds. Certain international wires reported within 72 hours may qualify for the Financial Fraud Kill Chain.
Evidence Preservation: The organization should preserve every message, header, attachment, draft, and payment record connected to the transaction without alteration.
Account Containment: The security team should reset passwords for compromised mailboxes, revoke sessions and tokens, and review forwarding and inbox rules.
Notifications: The organization should promptly notify the impersonated vendor and its insurer.
Lessons Learned: The team should document which control was missing or bypassed and repair it before the next payment run.
According to the IC3's 2025 annual report, its Recovery Asset Team froze about 58% of the dollar amount reported stolen in the incidents it handled that year.
Stronger Processes Create More Reliable Decisions
No single red flag, employee, or security tool stops every fake invoice because successful schemes resemble the work the payments team already does. A workflow that refuses to act on unverified trust during vendor creation, bank-detail changes, approval, and release stops them. A useful exercise is to trace one invoice through that workflow and mark every point where someone accepts a claim without checking it. Those marks show where the next payment request is likely to aim.
The controls above cover the workflow end to end, but the external schemes in this article almost always arrive the same way: through email. Abnormal's behavioral AI is designed to model how vendors, executives, and employees normally communicate, then flag a message that breaks that pattern — sent from a mailbox that was just compromised, a domain that's close but not quite right, or a contact whose request suddenly falls outside their usual cadence — before an accounts payable employee has to weigh urgency against verification alone. It's built for that email-based layer specifically; the accounts-payable controls above still carry the internal schemes and the post-payment recovery process.
Book a demo to see how Abnormal approaches inbound email security against your own traffic.
Frequently Asked Questions
Is Fake Invoice Fraud the Same as Business Email Compromise?
Fake invoice fraud is broader than BEC. BEC can deliver a fake invoice by directing a business to send payment to a fraudulent account. Other fake invoice schemes can occur without email: an employee can set up a shell vendor and approve its bills, while a scammer can mail a bill for something the company never ordered. Email authentication and mailbox protection address BEC, while matching, segregation of duties, and independent verification cover a broader range of schemes.
How Can a Business Verify a Vendor's New Bank Details?
The business can call the vendor using a number it had before the request arrived because contact information in the message or invoice may belong to the attacker. Someone else should make the call and record the date, vendor contact, and approval. If the vendor cannot be reached, the payment waits.
Can a Legitimate Email Account Send a Fake Invoice?
Yes. With valid credentials for a vendor's or employee's mailbox, an attacker can send messages from the real server, pass authentication checks, and enter ongoing conversations. The attacker may hide replies with an inbox rule and wait for a pending invoice before sending revised payment details. Independent verification, forwarding-rule alerts, and phishing-resistant authentication help address this risk.
Can a Bank Recover Money Paid to a Fake Invoice?
Sometimes, and speed is usually the deciding factor. Money mules may withdraw or forward funds quickly, so an immediate recall has a better chance than a delayed one. Reporting the incident to the FBI IC3 with complete transaction details can help coordinate freezes across financial institutions. Even when recovery fails, reporting can help investigators connect cases and close mule accounts.