Free guide

Fake invoice email scams: how to spot one

“Our bank details have changed” is the most expensive email many businesses ever get. Warning signs of fake invoice and payment-redirection scams, and a 5-minute check before you pay.

In a fake invoice (payment redirection) scam, a criminal pretends to be a supplier, or your own business, and asks for payment to a new bank account. Australians lost A$152.6M to payment-redirection scams in 2024, the only top-5 scam type whose losses rose (National Anti-Scam Centre). In the UK, £41.3M was lost to invoice and mandate scams in 2025 (UK Finance), and business email compromise cost US$3.05B in reports to the FBI in 2025 (FBI IC3).

Warning signs

  • “We’ve changed banks” or “please use this new account”.
  • Urgency: overdue notices, threats to stop supply, a director “in a meeting” who needs it done now.
  • A sender domain that is almost right (see lookalike examples).
  • A Reply-To address different from the From address.
  • An invoice PDF that looks slightly off: different fonts, logo, ABN/VAT number or account name.
  • A request to keep it confidential or not call.

The 5-minute check before you pay

  1. Don’t use contact details in the email.
  2. Call the supplier on a number from a previous invoice or their website.
  3. Ask them to confirm the BSB/sort code and account number.
  4. Have a second person approve any bank-detail change.
  5. Record who confirmed it and when.

Our payment verification policy turns this into a written process for your team.

If you’ve already paid

  1. Call your bank now and ask for a recall.
  2. Report: Australia ReportCyber; US IC3; UK Action Fraud.
  3. Check whether your mailbox was compromised (unknown inbox rules, forwarding).

Stop scammers using your name

If customers get fake invoices that look like yours, lock your domain with DMARC and check it with our free scan.

Questions

Can my bank get the money back?

Sometimes, if you report within hours. The sooner your bank can contact the receiving bank, the better the chance of freezing funds.

The email came from my supplier’s real address. Is it safe?

Not necessarily. Supplier mailboxes get hacked, and scammers reply inside genuine threads. Always verify new bank details by phone.

Check your domain in 30 seconds

Our free scan reads your SPF, DMARC, DKIM and MX records and checks about 50 lookalike variants of your domain. No signup needed for the summary.

Scan my domain freeEmail & domain protection

More guides

General information only, not legal or financial advice. ImposterWatch is operated by Cloud Investments FZE (UAE) and is not a background check or private investigator service.