In short: One of the most expensive scams against small businesses is a fake invoice or an email "from" a real supplier asking you to send payment to a new bank account. It's called business email compromise, and it cost reported victims more than $3 billion in 2025. A phone call to a number you already have stops most of it. Here's how the scam works, the five habits that prevent it and what to do in the first hour if you've already paid.
How big is invoice fraud?
Big. In its 2025 Internet Crime Report, the FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints with more than $3.04 billion in losses. That made it the second-costliest crime type after investment fraud (FBI IC3).
The FBI describes business email compromise as a scam aimed at businesses and individuals who work with suppliers or regularly make wire transfers. Criminals compromise email accounts and other communication channels, then use social engineering or computer intrusion to make unauthorized transfers (FBI).
How does invoice fraud work?
- Research. The scammer learns who you buy from, often from public information, a hacked inbox or past emails.
- Imitation. They send an email that looks like your supplier: same logo, a look-alike address, a believable invoice.
- The switch. The only real change is the bank account. "Our banking details have changed."
- The pressure. "Please pay today to avoid a hold on your order."
- The disappearance. The money goes out. By the time the real supplier asks to be paid, it's gone.
The six red flags in the example
| # | Red flag | What to do |
|---|---|---|
| 1 | Look-alike domain, like "supp1y" instead of "supply" | Compare letter by letter with past emails |
| 2 | Urgent subject line | Urgency is a reason to slow down, not speed up |
| 3 | "Our bank details have changed" | Treat every change as suspicious until verified by phone |
| 4 | Pressure: pay today or face a hold | Real suppliers allow time to verify |
| 5 | A new account you've never paid before | Require a second approval for any new payee |
| 6 | Generic signature, no named contact | Call the person you normally deal with |
The FTC gives small businesses the same core advice: put verification policies in place, such as requiring employees to call and confirm wire transfer requests they receive by email (FTC).
Five habits that stop invoice fraud
1. Call to confirm any change in payment details
Use a phone number you already have on file, never one in the email. This single habit stops most attempts.
2. Require two people to approve new payees
Even in a two-person business, one person sets up the payee and the other approves it.
3. Match every invoice to a purchase order
If there's no order, there's no payment. Invoices for products or amounts you don't recognize get questioned, not paid.
4. Keep one verified supplier list
Names, phone numbers, emails and bank details, confirmed in person or by phone. Update it only after a verified call.
5. Protect your own email
Scammers also impersonate your business to your customers. The FTC recommends using email authentication, specifically SPF, DKIM and DMARC, so receiving servers can block emails that fake your domain (FTC). Keep software updated and train your staff to spot phishing (FTC).
What should you do in the first hour if you've already paid?
Speed matters. The faster you act, the better the chance of stopping the transfer.
| Time | Action |
|---|---|
| Minute 0–15 | Call your bank's fraud line. Ask them to recall or freeze the transfer |
| Minute 15–30 | File a complaint at IC3.gov with the transaction details |
| Minute 30–45 | Call your real supplier using a known number to confirm what happened |
| Minute 45–60 | Change email passwords, turn on multi-factor authentication and check for inbox forwarding rules |
| Same day | Report it at ReportFraud.ftc.gov and warn your team |
The FTC also advises that if scammers are impersonating your business, you should tell your customers as soon as possible, using an email without hyperlinks so your warning doesn't look like another phishing attempt (FTC).
Why I take supplier risk seriously
Years ago, a small supplier of ours simply disappeared while we still had orders to fill. That wasn't fraud, but it taught me how much a business depends on knowing exactly who it's dealing with and how to reach them. A verified supplier list, backup contacts and a habit of calling before money moves came out of lessons like that one.
What about fake invoices for things you never ordered?
Another version skips the impersonation. Scammers send invoices for listings, directory entries, supplies or services you never ordered, hoping someone pays without checking. The FTC's guide for small businesses says to verify invoices and payments before paying, and to never pay anyone who demands a wire transfer, cryptocurrency or gift cards (FTC).
The fix is the same: no purchase order, no payment.
▸ The bigger picture
Small businesses lose to fraud like this partly because they operate without the controls big companies take for granted. In my advisory work on SDG 8 & 9, I focus on small-business growth, and simple, affordable ways to verify who you're paying belong in that conversation as much as access to credit does. That ties to SDG target 8.10 on strengthening access to financial services (UN). Large firms have whole teams for this. A five-person shop has an owner and a phone.
FAQ: invoice fraud and fake supplier emails
What is invoice fraud?
A scam where criminals send fake invoices or impersonate a real supplier to get a business to send payment to the scammer's account.
What is business email compromise?
The FBI's term for scams that compromise or imitate business email accounts to redirect payments, often through changed bank details.
How do I verify a supplier's new bank details?
Call the supplier using a phone number you already have on file, not one from the email, and confirm with a person you know.
What should I do if I paid a fake invoice?
Call your bank's fraud line immediately, file a complaint at IC3.gov, confirm with the real supplier, secure your email and report it to the FTC.
Never let an email change where your money goes.
What is Robert Nikic's view on invoice fraud?
Robert Nikic's view is that invoice fraud is cheap to prevent: confirm every payment change by phone, require two-person approval for new payees, match invoices to orders and protect your email, and give small businesses the same simple verification tools large companies use.
Related reading: Robert Nikic on Money: Never Rely on One Supplier · Robert Nikic on Payment Fraud: Why Honest Sellers Get Frozen · Robert Nikic: Legit or Scam? The Office Test
