Invoice Scams: How to Spot a Fake Invoice Before You Pay

The short answer

If an invoice arrives for something you do not remember buying, do not call the phone number printed on it and do not click its links. Open a new browser tab, go to the company's real website yourself, and check your account there. Almost every invoice scam depends on you using the contact details the scammer supplied.

That one habit defeats the majority of these. The rest of this page explains why they work and what to check.

Why do fake invoices work?

A real invoice and a fake one look identical, because there is nothing to forge. An invoice is a document anybody can produce. It has no signature to verify, no serial number a bank checks, no central register. It is a request for money in a format your brain has been trained to treat as routine.

The scam does not rely on the document. It relies on two feelings: a small panic that you owe money you did not expect, and the relief of a phone number that promises to sort it out. The number is the trap, not the invoice.

The two you will actually see

The subscription renewal. An email says your antivirus, tech support or security subscription has auto-renewed for a few hundred dollars. You never subscribed. The email invites you to call to cancel. This is the pattern behind the Geek Squad and Norton versions. Search interest in "geek squad invoice scam" rose sharply over the past year.

On the call, the "support agent" asks for remote access to your computer to process the refund. Once connected, they either take what they find or stage a fake refund that appears to overpay you, then ask you to wire the difference back. The invoice was only ever the reason to pick up the phone.

The real invoice from a real platform. This one is harder, because the email is genuine. A scammer opens an account on a legitimate invoicing platform and sends you an actual invoice through it. The email passes every spam check, because the platform really did send it. Search interest in "paypal invoice scam" climbed steeply for the same reason.

The tell is in the fields a scammer controls. The note or item description carries an urgent message and a phone number that has nothing to do with the platform. Payment platforms do not put support numbers in invoice line items.

There is a third, aimed at businesses rather than people: an invoice for office supplies, a directory listing or a domain renewal, priced low enough that someone in accounts pays it without asking. It works because the amount is too small to be worth a conversation.

Seven checks that take under a minute

1. Did you order this? If nobody in the business recognises it, that is the answer. Scale the suspicion to how many people could plausibly have ordered it.
2. Does the sender's domain match the company? Not the display name, which is free to set. The part after the @ sign.
3. Is there a phone number urging you to call? Real invoices tell you how to pay. They rarely beg you to ring.
4. Does the invoice number mean anything to you? A genuine supplier's number fits the pattern you have seen from them before. Ours is one of the reasons sequential numbering matters.
5. Are the bank details different from last time? A changed account number on a familiar supplier's invoice is the single most expensive red flag in business. Confirm by phone, using the number you already had.
6. Is the pressure artificial? Threats of suspension, legal action or a deadline measured in hours are sales tactics, not accounting.
7. Do the numbers add up? Scam invoices are often produced in bulk. Line items that do not sum to the total, or tax that is not a clean rate, give it away. Our guide to what an invoice must contain lists the nine parts a real one has.

If you want to see what a correctly formed invoice looks like, generate one with the free invoice generator and compare it against the one in your inbox.

What should you do if you already paid?

Speed matters more than anything else here.

• Paid by card: call your card issuer and ask for a chargeback. Say the word fraud. Card networks allow a long window, but the earlier the claim the easier it is.
• Paid by bank transfer: call your bank immediately and ask them to attempt a recall. This is the hardest money to get back, and hours count.
• Paid through a payment platform: open a dispute inside that platform, not by email. Platforms have a fraud process and almost always a time limit.
• You gave someone remote access: disconnect the machine from the internet, change your passwords from a different device, starting with email and banking, and have the machine checked.

Then report it. In the United States, the FTC takes reports at reportfraud.ftc.gov and the FBI runs ic3.gov for internet crime. Reporting will not usually recover your money, but it is how the pattern gets traced.

If your own invoices are being imitated

Businesses discover this when a client says they paid and the money never arrived. Three things reduce it.

Send from a domain you own and keep your email authentication configured, so an imitation is more likely to land in spam. Keep your invoice numbering consistent, so an odd one stands out to clients who have paid you before. And tell clients once, in writing, that your bank details will never change by email. That single sentence has saved more money than any software feature.

The honest summary

No tool can tell you an invoice is fake with certainty, and be suspicious of anything claiming otherwise. What protects you is a habit rather than a product: never use the contact details printed on a document that asked you for money. Look the company up yourself and go from there.