Guide · Finance · Business

How to spot a fake supplier invoice

Invoice fraud rarely looks like a movie heist. It looks like a polite email from a supplier you already know.

“We’ve changed banks. Please use these new details from next payment.” The PDF looks familiar. Someone is travelling. There is a little urgency. Finance updates the record and pays. Weeks later the real supplier asks where the money is.

By then the funds are often gone — or much harder to pull back.

How the scam usually works

Someone impersonates a supplier (or hijacks a real mailbox) and asks you to change bank details by email. Sometimes the invoice itself is altered. Sometimes only the payment instructions change.

The goal is always the same: get you to send a legitimate payment to the wrong account, under the cover of a normal relationship.

Red flags worth training for

Teach finance and anyone who approves payments to notice:

• Bank details changed by email alone, especially with urgency (“pay today to avoid interest”)
• Slightly odd email addresses or lookalike company names
• PDFs that differ from last month’s invoices — logo quality, fonts, layout, or letterhead
• Requests to skip the usual phone check “because we are travelling / migrating systems”
• Pressure to use a personal mobile number that is not on your supplier file
• A sudden change right before a large payment is due

One flag is a reason to pause. Two flags are a reason to stop.

The habit that stops most losses

Treat every bank-detail change as high risk — even from a “known” supplier.

1. Call a number you already have on file (not the number in the email).
2. Get verbal confirmation of the new details.
3. Require a second person to approve before anyone updates records or pays.
4. Write down who confirmed, when, and how.

It feels slow the first time. It is far slower to unwind a payment that went to a stranger.

If you already paid

Call your bank the same day. Ask about recall or dispute options and get a reference number. Keep the emails and the PDF. Tell the real supplier so they are not left waiting in silence.

Then write a short timeline: which mailbox was used, when the fake invoice or change request arrived, who authorised payment, and what was said on any calls. That pack helps with the bank, insurance, and police if you need them.

When to bring in outside help

If several mailboxes are involved, logins look odd, or the email trail is tangled, a structured review saves time and arguments.

Glial’s Digital Fraud Investigations service produces an evidence log and recommended next steps — without promising recovery or replacing your lawyer. Early clarity is the point.