What should you do to prevent invoice fraud?

Invoice fraud is one of the most common ways criminals target businesses. It often looks legitimate, uses trusted supplier names and relies on people being busy or following routine processes. In many cases, the fraud is only discovered after the money has already left the account.

A simple, consistent verification process can make the difference between stopping fraud early and suffering a financial loss. This guide sets out the practical steps that should be followed before paying any invoice from a new supplier or when bank details change.

Why invoice fraud is so effective

Invoice fraud works because it blends in. Emails look genuine, invoices appear familiar and requests often feel routine.

Criminals may compromise a supplier’s email account, impersonate a known contact or slightly alter bank details on a legitimate invoice. Increasingly, they also use AI-generated emails and voice calls to convincingly impersonate real people in finance teams, suppliers, or management.

The change is often small enough to go unnoticed unless checks are carried out carefully.

Once a payment is made, recovering funds can be extremely difficult.

Fast checklist before paying an invoice

Before processing payment, ask yourself:

• Was this invoice expected?
• Does the sender look exactly right?
• Has anyone internally confirmed the work or delivery?
• Do the bank details match what we already have on record?
• Has this request been confirmed using a trusted contact method, not just email or a phone call that I received?

If the answer to any of these is no, stop and verify.

Step-by-step: how to check invoices safely

Step 1: Check how the invoice arrived

Invoices should arrive through expected channels, usually from a known supplier contact or a dedicated finance email address.

If the invoice appears unexpectedly, is forwarded internally by someone outside finance or procurement, or arrives in an unusual way, pause and investigate before taking any further action.

Step 2: Look closely at the sender’s email address

Do not rely on how an email appears at first glance.

Check the full email address and domain carefully. Fraudsters often use addresses that look almost identical to real ones, changing a single character or using a different domain ending.

If anything looks unusual, do not reply or click links until it has been verified.

Step 3: Confirm the invoice internally

Speak to the internal relationship owner, project manager or budget holder who works with the supplier.

Ask them to confirm:

• Whether the invoice amount looks right
• Whether the work or goods were delivered
• Whether the timing makes sense

They should not confirm bank details. Their role is to confirm that the invoice itself is legitimate.

If they have a contact number for the supplier, check that it matches what is recorded in your systems or publicly available online.

Step 4: Compare bank details with your records

Cross-check the bank details on the invoice against what is stored in your accounting system.

If the details match exactly, you can proceed.
If anything differs, even slightly, stop immediately.

A change in bank details is one of the most common signs of invoice fraud.

What to do if bank details are new or have changed

Any request involving new or updated payment details should be treated as high risk.

Step 5: Verify bank details by phone

Be aware that AI-generated voice can be used to imitate real people. Always call a phone number you already trust from your records or the supplier’s official website never one provided in an email or invoice.

Ask the supplier to confirm the bank details before any payment is made.

Step 6: If no trusted number is available

If you do not already have a verified contact number:

• Find the supplier’s official website yourself
• Use the main phone number listed publicly
• Ask to speak to someone in finance or accounts

Explain that you are calling to confirm bank details before processing payment. Make a note of who you spoke to and when.

Step 7: Record the verification

Once details are confirmed, update your accounting system with:

• Who verified the bank details
• Their role and contact information
• The date and time of the check
• Who in your organisation completed it

This creates a clear audit trail and protects everyone involved.

Step 8: If phone verification is not possible

If you cannot confirm details by phone, send an email to a known general address such as accounts@company.com or info@company.com.

Do not reply directly to the original invoice email unless it has already been verified.

If confirmation still cannot be obtained, do not proceed with payment.

Common warning signs to watch for

Invoice fraud often includes one or more of the following:

• Invoices sent as Word documents instead of PDFs
• Payment requests from unfamiliar contacts
• Requests marked urgent or time sensitive
• Invoices forwarded internally by non-finance staff
• No internal confirmation of work or delivery
• Limited contact options beyond email
• Requests that are followed up by unexpected phone calls pushing for urgent payment or confirmation

Any of these should trigger further checks.

Good habits that reduce risk

• Treat all payment changes as suspicious until verified
• Avoid confirming bank details by email alone
• Make verification mandatory for all supplier changes
• Use multi-factor authentication on finance systems
• Encourage staff to pause and question unusual requests
• Assume that both emails and phone calls can be impersonated, and rely on independent verification rather than trust.

Consistency matters more than speed when it comes to payments.

Frequently asked questions