Invoice Scams and Fraud: How Small Businesses Can Protect Their Money
Small businesses often move quickly to keep up with customers, vendors and day-to-day operations. That pace can create opportunities for fraudsters, especially when accounting and payment responsibilities are handled by a small number of people.
Invoice scams and invoice fraud can cause significant financial losses, but many of these scams can be stopped with simple verification procedures and strong internal controls. By knowing how fake invoices work and recognizing common warning signs, you can help protect your business's money.
Understanding Invoice Scams: How Fraudsters Target Your Accounts Payable
Fraudsters often target accounts payable because it involves routine transactions and trusted business relationships. A convincing email or invoice can sometimes slip through when employees are busy or payment procedures are informal.
Common Types of Invoice and Payment Fraud
Here are some of the common types of scams and fraud to watch out for:
- Fictitious or fake invoice scams: A scammer sends an invoice for products or services the business never ordered or received. These may appear to be for common expenses such as office supplies, website services or directory listings.
- Vendor impersonation: A fraudster poses as a legitimate vendor and asks the business to send future payments to a different bank account. The request may look like a routine update from a familiar company.
- Business email compromise (BEC) scams: A scammer impersonates an owner, executive or other trusted person and requests an urgent payment. These BEC scams may use spoofed or compromised email accounts to appear legitimate.
Why Small Businesses Are Vulnerable
Small businesses tend to be vulnerable for a variety of reasons. They may have limited accounting staff, with one person handling several financial responsibilities. Informal procedures, single-person payment approval and trust in long-standing vendors can also make accounts payable fraud easier to carry out.
5 Red Flags That Signal a Suspicious Invoice
Recognizing warning signs before a payment is released is one of the simplest forms of invoice fraud prevention. Train employees to pause and verify unusual requests rather than allowing urgency to override normal payment procedures. Here are five red flags to watch out for.
1. Discrepancies in Sender Email Addresses and Domains
Check the sender's email address carefully. Fraudsters may use lookalike domains with minor spelling changes, such as @vender.com instead of @vendor.com. Also watch for a mismatch between the sender's display name and the actual email address or "reply-to" address.
2. Unexpected Requests to Change the Vendor’s Bank Account or Payment Method
Treat any request to change established payment instructions as high risk—even if the message appears to come from a known vendor. A request to switch bank accounts, routing numbers or payment methods should always be independently verified before making a change.
3. Urgency or Pressure to Bypass Normal Procedures
Be cautious when a message demands immediate payment or threatens penalties, service suspension or other consequences if you do not act quickly. Scammers use urgency to discourage employees from taking time to verify the request.
4. Mismatches Between Purchase Orders, Invoices, and Delivery Receipts
Compare invoices with purchase orders, contracts and delivery records when available. Missing purchase order numbers, vague descriptions, unexpected quantities or pricing that differs from the original agreement can signal a fraudulent invoice.
5. Unfamiliar Vendors or High-Pressure Executive Demands
An unexpected invoice from an unfamiliar vendor deserves additional scrutiny. Be especially careful when an email appearing to come from the owner or CEO requests an unusual, off-cycle payment or asks an employee to bypass standard approval procedures.
Actionable Strategies to Protect Your Business Finances
Strong invoice fraud prevention does not require complicated processes. A few consistent controls can make it much harder for a fraudulent payment request to succeed.
Establish a Strict "Out-of-Band" Verification Protocol
Never use contact information provided in a suspicious email or invoice to verify a payment change. Instead, contact the vendor using a trusted phone number or other contact information already stored in your vendor records.
For example, if a vendor emails requesting a new bank account, independently contact the vendor before updating its payment information. Do not rely on the phone number or email address included in the request.
Implement Dual Controls and Separation of Duties
Require two people to review and approve payments above a defined dollar threshold. Whenever possible, the employee who creates or changes a vendor profile should not be the sole person responsible for approving payments to that vendor.
Separating these responsibilities creates an additional opportunity to catch payment fraud before funds leave the business.
Establish a Formal Purchase Order (PO) Matching System
For businesses that use purchase orders, consider three-way matching before releasing payment. Compare the purchase order, receiving or proof-of-delivery record, and vendor invoice to make sure the transaction is legitimate.
Businesses that do not use purchase orders can still compare invoices with contracts, order records, delivery documentation or the employee who authorized the purchase.
Secure Business Email Accounts
Protect the email accounts used for financial transactions with multifactor authentication. Keep email and accounting software updated, limit administrative access and use email authentication tools such as SPF, DKIM and DMARC where appropriate.
Foster a Security-First Culture and Empower Your Team
Employees should feel comfortable pausing a payment when something does not look right. Routine fraud-awareness training can help employees recognize phishing, vendor impersonation, BEC scams and other forms of payment fraud.
What to Do If You Suspect an Invoice Scam Has Occurred
Act quickly if your business has sent money to a scammer or someone may have compromised a financial account. Prompt action may improve your ability to stop or recover funds and limit additional losses.
1. Contact the Payment Provider Immediately
Contact your financial institution or other payment provider as soon as possible. Ask whether the payment can be stopped, recalled or otherwise recovered. Recovery is not guaranteed, so do not delay while conducting an internal investigation.
2. Freeze or Review Affected Vendor and Payment Records
Temporarily freeze suspicious vendor changes or payment activity as appropriate. Review recent transactions and vendor records to determine whether additional payments or account changes may have been affected.
3. Secure Compromised Accounts
If an email or other account may have been compromised, secure it immediately. Change credentials, require multifactor authentication and follow your organization's procedures for removing unauthorized access.
4. Preserve Evidence
Keep the original emails, invoices, correspondence, payment records and other relevant information. If possible, preserve email headers and other technical details that may help with an investigation.
5. Report the Incident as Appropriate
Depending on the circumstances, report suspected fraud to the FBI's Internet Crime Complaint Center (IC3), the Federal Trade Commission (FTC), or other appropriate law enforcement agencies. Your financial institution may also be able to provide guidance on reporting and next steps.
Partnering with Your Financial Institution for Account Security
Your financial institution can be an important partner in protecting your business from payment fraud. Ask your business banking or treasury management representative which controls are available for your accounts and payment methods.
Tools such as Positive Pay, ACH controls, transaction alerts, payment limits and dual-authorization features can provide additional layers of protection. If you’d like to learn more, stop by and talk to a business banker. We’re here to help!