Verified by GonePhishing.com
A vendor invoice scam is a form of Business Email Compromise (BEC) where a criminal impersonates a legitimate vendor or supplier and tricks a company into sending payment to the wrong bank account. In many cases, the invoice looks real, the vendor name is familiar, and the timing matches an actual payment cycle. That is exactly why invoice fraud is so dangerous.
Instead of creating a completely fake invoice from scratch, attackers often target real business relationships. They may spoof a vendor email address, compromise a real mailbox, or send a realistic message explaining that payment instructions have changed. If accounts payable staff trust the message and update the banking details without verification, the next payment may go directly to the scammer.
What is a vendor invoice scam?
A vendor invoice scam is a fraud scheme where an attacker manipulates invoice payment details so legitimate business funds are redirected to a fraudulent account. The scam may involve a fake invoice, altered remittance instructions, a request to update ACH or wire details, or an urgent email claiming the vendor changed banks.
Because the target business often already knows the vendor name and expects to make a payment, the fraud can appear routine. The scammer takes advantage of trust, timing, and normal accounting processes.
How vendor invoice fraud works
Most invoice scams follow a similar pattern. The attacker identifies a real vendor relationship, studies communication between the vendor and the business, and then inserts a fraudulent request into the payment process.
- The attacker identifies a vendor your business already pays
- They spoof the vendor email address, use a lookalike domain, or compromise a real mailbox
- They send a message with “updated” banking details or a revised invoice
- The request sounds routine, urgent, or tied to a real payment cycle
- The company updates vendor records or pays the invoice without independent verification
- The funds are sent to the attacker’s bank account instead of the real vendor
Common vendor invoice scam scenarios
- Bank account update scam: A vendor email says payment instructions have changed and asks accounts payable to update banking records.
- Altered invoice scam: A real-looking invoice is resent with different remittance details.
- Compromised vendor mailbox: A real vendor email account is hijacked and used to send fraudulent payment requests.
- Urgent payment reroute: The attacker claims the invoice must be paid immediately to a temporary account to avoid delay or service interruption.
- Executive-approved payment scam: The attacker combines vendor impersonation with fake internal approval to pressure staff into paying quickly.
Vendor invoice scam red flags
Invoice scams often look believable, but there are warning signs. Staff should slow down any request that involves payment changes, especially when the request arrives unexpectedly or creates urgency.
- Requests for new banking details, ACH changes, or updated wire instructions
- Invoices that look familiar but include different remittance information
- Email domains that look close to the real vendor but are not exact
- Pressure to pay immediately or avoid contacting the vendor by phone
- Unexpected changes in payment method, invoice format, or communication style
- Messages that bypass normal procurement or approval procedures
- Claims that the matter is urgent, confidential, or time-sensitive
Why vendor payment fraud is so effective
Vendor invoice scams succeed because they are built around real business relationships. The company may already owe money to the supplier, recognize the project name, and expect an invoice around that time. The scammer uses those facts to make the request feel ordinary.
In some cases, the attacker may have monitored email conversations for days or weeks before sending the fraudulent request. When the timing is precise and the wording matches the vendor’s normal style, employees may not realize anything is wrong until the real vendor follows up on a missing payment.
How to prevent vendor invoice scams
Preventing invoice fraud requires a mix of staff training, internal controls, and vendor verification procedures. The safest organizations assume payment instructions should never be changed based on email alone.
- Require independent verification for any vendor banking or remittance change
- Call the vendor using a trusted number already on file, not the number in the email
- Use approval workflows for ACH updates, wire changes, and high-value payments
- Train accounting and accounts payable staff to spot invoice fraud red flags
- Review vendor master file changes carefully and log who approved them
- Enable multi-factor authentication on email and vendor payment systems
- Use secure vendor portals or documented payment change procedures where possible
What to do if your business paid a fraudulent invoice
If your company already paid a fraudulent invoice, act immediately. Contact your bank, request a wire recall or fraud intervention, and preserve all emails, invoices, and payment records. Notify leadership, accounting, IT, and legal or compliance teams as appropriate.
You should also contact the real vendor to confirm what happened, review whether any internal mailbox or vendor account may have been compromised, and determine whether other invoices or payment records were affected.
For immediate payment fraud response steps, read: What to Do If Your Business Sent a Wire to a Scammer.
Vendor invoice scams vs other BEC attacks
Vendor invoice scams are one type of Business Email Compromise. Unlike CEO fraud, which relies on executive authority, invoice fraud usually relies on vendor trust and routine payment activity. Both are highly effective because they exploit normal business processes rather than obvious malware or spam tactics.
Frequently asked questions
What is the difference between a fake invoice scam and a vendor invoice scam?
A fake invoice scam may involve a completely fabricated bill, while a vendor invoice scam often uses the name of a real supplier or modifies a legitimate payment request to redirect funds.
Can invoice fraud happen even if the invoice looks real?
Yes. Many invoice scams use real vendor names, real project details, and realistic formatting. Sometimes the only fraudulent element is the banking information.
Who is usually targeted by vendor invoice scams?
Accounts payable staff, controllers, bookkeepers, finance teams, office managers, procurement staff, and anyone involved in vendor payments are common targets.
Should businesses verify every vendor banking change?
Yes. Any change to vendor payment instructions should be verified independently using a trusted contact method that is already on file.
Related business fraud articles
- What Is Business Email Compromise (BEC)?
- CEO Fraud Explained: Executive Impersonation Scams
- Payroll Diversion Scam: How Employee Paychecks Get Redirected
- Sent a Wire to a Scammer? Immediate Business Recovery Steps
- Back to Business Fraud Articles
Want to train employees to verify payment changes before a fake invoice causes a real financial loss? Start GonePhishing Business Fraud Training