Invoice Fraud Prevention: Protecting Your Business and Your Clients

Invoice fraud — from fake invoices to payment-redirection scams — targets businesses of every size. Awareness is the first line of defence.

The common scams

Fake invoices for goods you never ordered, and payment-redirection scams where a fraudster sends new bank details that divert your payment to their account.

Fake invoices arrive for goods or services you never ordered, hoping someone pays without checking. They often look official and arrive in a busy period.

Payment-redirection scams send a message claiming your supplier’s bank details have changed. The payment then goes to the fraudster’s account instead of the real supplier.

CEO fraud impersonates a senior person asking for an urgent payment to a new account. The urgency is the trick, because it pushes people past their normal checks.

• Fake invoices for unordered goods.
• Payment-redirection (change of bank details).
• CEO fraud and impersonation.

How to protect yourself

Verify any request to change payment details by calling a known number, and check invoices against purchase orders before paying. Treat unexpected changes with suspicion.

Verify any change of bank details out-of-band: call the supplier on a number you already have, never the number in the suspicious message.

Match every invoice against the corresponding purchase order or contract before paying. An invoice with no matching order is the classic sign of fraud.

Treat urgency as a warning sign. A legitimate payment request can almost always wait for a five-minute verification.

• Verify bank-detail changes by phone.
• Match invoices to purchase orders.
• Question unexpected payment requests.

Train the habit

Make verification a required step, not an optional one. A rule that any change of payment details must be confirmed by phone removes the moment of judgement.

Separate duties where possible, so the person who approves a payment is not the only person checking it. Two pairs of eyes catch what one pair misses.

Run a short reminder whenever a fraud attempt occurs, because a real example trains better than any policy document.

• Make verification a required step.
• Separate approval and checking duties.
• Use real examples to train.

Protect your own invoices

Fraud also targets the invoices you send, where a fraudster intercepts or alters your payment details. Protect your outgoing invoices as carefully as your incoming ones.

Be alert to clients reporting that your bank details changed when they did not. That is a sign your invoices are being intercepted or spoofed.

Use a consistent, hard-to-spoof payment channel such as the QR-bill, and warn clients to verify any change of your details by phone. The same rule cuts both ways.

Monitor for signs your email or systems are compromised, since invoice fraud often begins with access to a mailbox. Strong authentication and alerts reduce that risk.