How to spot a fake invoice: 7 warning signs every business owner should know

Most fake invoices aren’t obviously fake. They’re designed to look completely normal — correct logo, plausible amount, a supplier name your team recognises — which is exactly why they work. Report Fraud (the national fraud reporting service that replaced Action Fraud) and UK Finance both point to the same pattern: invoice scams succeed not because finance teams are careless, but because a convincing fake is genuinely hard to tell apart from a real invoice by eye, especially the 400th one of the month.

Here are seven warning signs worth building into how your team checks invoices, whether or not you ever use a piece of fraud-detection software.

1. The bank details have changed

A supplier you’ve paid for years suddenly emails to say they’ve “updated their banking details.” This is the single most common invoice scam in the UK — it’s formally known as mandate fraud, and it works by hijacking trust you’ve already built with a real supplier. Always confirm a bank detail change by phone, using a number you already have on file, never one provided in the email itself.

2. The invoice number has shown up before

If the same invoice number appears twice — even from what looks like a different supplier — that’s a classic sign of a cloned or resubmitted invoice. Cross-checking invoice numbers against your existing payment history catches this in seconds, but it’s the kind of check that’s easy to skip when you’re processing dozens of invoices a day.

3. The amount is unusually high for this supplier

A supplier who normally bills you a few hundred pounds suddenly sending an invoice for several thousand is worth a second look, even if everything else checks out. Fraudsters often inflate a genuine-looking invoice rather than inventing one from scratch, betting that a familiar supplier name will wave the unusual amount through.

4. You don’t recognise the supplier

A new supplier with no history, especially one that’s been set up but never actually delivered anything for you before, deserves proper checking before the first payment goes out. This is one of the most common patterns in construction and recruitment specifically, where new suppliers are onboarded constantly and there’s less time to vet each one.

5. There’s unusual urgency in the request

“This needs to be paid today or we’ll be in breach of contract” is one of the oldest pressure tactics in the book. Fraudsters rely on rushed decisions, because urgency is exactly what skips the verification step that would otherwise catch them.

6. The dates don’t quite add up

An invoice dated in the future, or one that’s unusually old and suddenly being chased for payment, is worth a second look. Genuine invoicing follows a predictable rhythm for any given supplier — a date that breaks that pattern is a small thing, but small things are usually where fraud first shows.

7. Something just feels slightly off

A different tone in the email, a slightly altered logo, a contact name that’s new, formatting that doesn’t quite match previous invoices from the same supplier. Trust that instinct — in our own review of flagged invoices, the cases finance teams describe as “something felt off” line up with genuine fraud attempts more often than any single hard rule does.

None of these signs alone proves fraud. But seeing two or three together on the same invoice is exactly the kind of pattern worth checking for automatically, on every invoice, every time — which is the problem we built Invixa to solve.