How to spot a fake invoice email: a checklist for accounting teams
A fake invoice email is identified by checking the sender address, attachment, amount and bank details against independent records. These emails appear to come from a genuine supplier and report an unpaid invoice or changed payment details. The goal is to redirect the payment to the attacker's account or get the malicious attachment opened.
What forms do fake invoice emails take?
Fake invoice emails come in four common forms. What they all have in common is that they look ordinary enough to fit into the accounting team's daily routine.
- Account-change notice: an email arriving under a known supplier's name that says "our bank account has changed, please send future payments to the new IBAN." This is the most costly type.
- Unexpected invoice: an invoice sent for a service or product that was never ordered, demanding short-notice payment. It's usually a small amount and relies on the "it'll get paid anyway" mindset.
- Malicious attachment: an Office document that looks like an invoice but contains a macro, or an executable file with a disguised extension.
- Fake payment page link: a link that says "click to view your invoice" and leads to a page asking for login credentials or card details.
In what order should you check an invoice email before paying it?
- Read the sender's address in full. Check the domain after the @ sign, not the display name.
-and.watch for the difference, a missing single letter, and similar-looking characters from a different alphabet. - Match it against the order. Confirm the invoice matches a purchase order, contract or delivery record. An invoice that doesn't match isn't paid, regardless of the amount.
- Compare the amount and line items. Compare unit prices, the VAT rate and the total against previous invoices. An unusual increase or a new line item is a red flag.
- Compare the IBAN against the one on record. If it's different, stop the payment and call the supplier at the phone number on file.
- Open the attachment safely. Don't open files that ask you to run a macro or "enable content," or whose extension differs from what you expect.
- Never enter credentials through a link. Go to the supplier's invoice portal through the address you already know, not through the link in the email.
How is a change to payment instructions verified?
Changes to payment instructions sit at the center of fake-invoice fraud, and verifying them rests on a single rule: a change is confirmed through an independent channel, not the channel the request arrived on. An account change that comes by email is verified by calling a previously recorded phone number, or by meeting the supplier in person.
The person doing the verification records the name of the person they spoke to, along with the date and time. A bank-detail update is then made with a second person's approval. This way, a single employee's lapse in attention, or an attacker's persuasiveness, is never enough on its own to send a payment to the wrong account.
What lasting measures should the accounting team put in place?
One-time vigilance isn't enough; the process has to be lasting. Only update a supplier's bank details through a written change procedure, and have a second person approve the change. Set a dual-signature rule for payments above a certain amount, and review that threshold regularly.
It also makes a difference when invoice emails arrive at a shared address the whole team monitors, rather than one person's personal inbox. A suspicious email then passes in front of more than one set of eyes, who did what and when stays on record, and the invoice flow doesn't stop just because one employee is on leave.
Finally, keep verified invoices not in scattered folders but in an archive with limited access and a kept version history. If there's an audit or a dispute, there's no argument about which version of an invoice was paid.
Review your supplier list once a year: deactivate the bank details of firms you no longer work with, and update registered phone numbers and authorized contacts. Even the best rule is useless if the information you rely on for verification is out of date. When starting with a new supplier, get their bank details in a signed written document and confirm them by phone before the first payment.
How does a real-world fake invoice attack play out?
An accounting employee at a logistics company receives an email from the packaging supplier they've worked with for three years. The email comes under the name of the supplier's accounting contact, the signature looks familiar, and this month's invoice is attached. The only difference is in the last paragraph: "Due to an audit at our bank, please make this month's payment to the new account below."
The address looks correct at first glance; a closer look shows one letter missing in the middle of the domain. The invoice amount, line items and due date are identical to previous months, because the attacker copied a real invoice from a correspondence they had compromised earlier.
In this scenario, a single habit is what saves the payment: the employee calls any supplier whose bank details have changed at their registered number. The supplier says no such change was made, and the payment is stopped. The same employee flags the email with a note in the team's shared inbox; when the second attempt arrives the following week, it's spotted immediately.
What are the most common mistakes in invoice fraud?
- Verifying by calling the phone number in the email; that number belongs to the attacker.
- Missing a bank-detail change because the amount and line items look correct.
- Skipping approval steps under pressure from an urgent payment.
- Not logging verified invoices and bank-detail changes; there's no trustworthy reference to compare against at the next check.
What should be done if a fake invoice has already been paid?
- Call your bank and ask them to stop or recall the transfer.
- Notify the real supplier; their account may have been compromised.
- Keep the email and its attachments with full headers.
- Report the incident to law enforcement and log it internally within the organization.
How do SmartMail and SmartFiles support this process?
SmartMail makes invoice attachments readable without opening them. Every attachment turns into a document card: document type, parties, issue and due dates, subtotal, VAT and grand total each appear in their own field. Incoming mail is automatically sorted by content type; the accounting team sees all of the month's invoice traffic together with the "Invoice/Payment" filter.
On the security side, look-alike domains, display-name spoofing and text containing payment requests are flagged; executable or macro-carrying attachments are flagged separately as well. Once you upload a verified invoice to the accounting area in SmartFiles, it's kept with version history and accessible only to authorized people.
Details: Attachment analysis with SmartMail, email security and archiving email attachments.