That Invoice Looks Real. Is It?

Quick Answer: Before you pay a bill, especially one with new bank details, confirm two things by calling a phone number you already have on file: that you actually owe the money, and that the account really belongs to your vendor.

You have bills to pay, customers to help, and about twelve other things competing for your attention. An invoice comes in from a vendor you recognize. You forward it for payment and move on.

But what if the invoice is real—and the bank account on it belongs to someone else?

October is Cybersecurity Awareness Month, so we’re spending it on the scams most likely to land in a small business inbox. First up: the money leaving your account.

Scammers know what a normal workday looks like

A suspicious invoice doesn’t always announce itself with terrible spelling or an outrageous request. Scammers have become a lot more competent in recent years. It may look like a routine bill for supplies, software, or that repair you really did order last month.

The FTC warned small businesses about fake invoices in May 2026. Some try to collect money for purchases that never happened. Others are bait to get someone to click a link and give up information. [1]

Then there’s the sneakier version: a legitimate bill with one small change to the payment details. Before paying, confirm both what you owe and where the money is going.

“We’ve changed banks”

“We’ve changed banks. Please use the new account below.”

That could be a perfectly legitimate message. It could also be a scam. The FBI recommends verifying changes in account numbers or payment procedures with the person making the request.

Call your vendor using a number already in your records. Skip the number listed in the email you’re trying to verify. And replying “Is this really you?” to the same message won’t help if a criminal controls that inbox. They’ll happily say yes.

A familiar email address can still be hijacked, so make the call anyway.

Write down the bill-paying rules

Your team shouldn’t have to guess which requests deserve a second look. Put a few rules in writing:

1. Match each invoice to an order, a receipt, or confirmation that the work was done.
2. Verify any change to bank details or payment instructions through a separate, trusted contact method, and note who checked it and when.
3. Have a second person approve payment changes when you can.

If you’re a one-person business, skip the second approver and keep the callback, along with a quick note of who you talked to and when. Build that step into your routine before you’re staring down a Friday afternoon deadline.

When the fake invoices come from inside

Sometimes the person sending fake invoices is already on your payroll.

From 2018 to early 2025, the controller of a Las Vegas construction company (and her boyfriend) took more than $26 million from her employer. She handled accounts payable, accounts receivable, and the company’s bank and credit card statements. That gave her room to send the company fictitious invoices and pay them with its own money, duplicate bonus checks into accounts she and her boyfriend controlled, and cover her tracks with forged bank statements and false accounting records. The money went to luxury homes, high-end cars, and private school tuition.

She pleaded guilty in federal court in April 2026 and was sentenced in July to five years and 10 months in prison. [4] Read the IRS’s summary of the case for the full details. [3]

For seven years, one person controlled the bills, the payments, and the bank statements that would have shown what was going on. You don’t need a big internal audit department to guard against that. Look at your bank statements yourself every month, before anyone else has a chance to explain them, and ask about any vendor name you don’t recognize.

Where urgency gets expensive

Scammers love a deadline. A threat to stop deliveries or an insistence that payment go out today can make a normal verification step feel like a hassle.

Give employees permission to say, “Our process is to confirm payment changes before we send money.” Then apply the same rule when the request seems to come from you.

If money did go to a scammer, call your bank right away and report it to the FBI’s Internet Crime Complaint Center at IC3.gov. Recovery isn’t guaranteed, so the sooner you act, the better your chances.

This week’s to-do list

• Tell everyone who pays bills that a bank change gets a phone call first.
• Save trusted vendor phone numbers somewhere other than invoice emails.
• Pull one recent payment change and see whether you could show who approved it.

At Compton & Company, we help small business owners build accounting routines they can actually stick to, and a reliable bill-paying process is one of them. A two-minute phone call is a lot cheaper than chasing a payment that went to the wrong account.

Next in our series: That call sounded just like you.

Frequently Asked Questions

What if the vendor gets annoyed that we called to check?

Most won’t. Vendors get targeted by these same scams, and plenty of them would much rather you call than pay the wrong account.

Are paper checks safer than electronic payments?

Not automatically. Checks can be stolen from the mail and altered, so the verification step stays the same no matter how you pay.

Should we report a fake invoice even if we didn’t pay it?

Yes. Report it to the FTC at ReportFraud.ftc.gov. If someone is pretending to be one of your real vendors, give that vendor a heads-up too, since their other customers may be getting the same invoice.

Won’t our accounting software catch this?

Some systems flag duplicate invoices or brand-new vendors. Very few can tell you whether a bank change is legitimate, so that check still takes a person.

Sources

[1] FTC — Run a small business? Pay your bills, not scammers
https://consumer.ftc.gov/consumer-alerts/2026/05/run-small-business-pay-your-bills-not-scammers

[2] FBI — Business Email Compromise
https://www.fbi.gov/how-we-can-help-you/common-frauds-and-scams/business-email-compromise

[3] IRS Criminal Investigation — Nevada woman pleads guilty to embezzling over $26 million from employer
https://www.irs.gov/compliance/criminal-investigation/nevada-woman-pleads-guilty-to-embezzling-over-26-million-from-employer

[4] IRS Criminal Investigation — Henderson woman sentenced to over five years in prison for embezzling over $26 million from employer
https://www.irs.gov/compliance/criminal-investigation/henderson-woman-sentenced-to-over-five-years-in-prison-for-embezzling-over-26-million-from-employer