Protecting Your Business from Fake Invoice Fraud

It usually arrives on a busy afternoon. An email from a vendor you pay every month, with a familiar logo, a reasonable amount, and a polite note: “We’ve updated our banking information. Please send future payments to the account below.”

It looks routine. It may be a scam. Fake invoice fraud, sometimes called vendor impersonation or business email compromise, is one of the most common and costly threats facing small and mid-sized businesses. The good news: a few simple habits can stop nearly every attempt.

How the Scam Works
Criminals study your business relationships. They may hack a vendor’s email account, create a look-alike email address that differs by a single letter, or simply guess at the suppliers a company like yours uses. Then they send one of two things in a fake invoice for goods or services you never received, or a real-looking invoice with new payment instructions that route your money to their account.

Because the message looks legitimate and the amount seems normal, it slips through. By the time the real vendor calls asking why they haven’t been paid, the funds are often gone.

Red Flags to Watch for

• A vendor suddenly changes its bank account or payment method, especially by email.
• The sender’s address is slightly off, such as an extra letter, a swapped character, or a different domain.
• The message pushes urgency like “past due” or “avoid service interruption.”
• An invoice arrives for a product or service no one on your team remembers ordering.
• Contact details on the invoice differ from what you have on file.

Five Steps to Protect Your Business

• Verify every payment change by phone. Call the vendor using a number you already have on file, never the one in the email. A quick call is the single most effective defense.
• Match invoices to orders. Pay only invoices that line up with a purchase order, contract, or confirmed delivery.
• Use dual approval. Require two people to sign off on new vendors, changed payment details, and payments above a set dollar amount.
• Train your team. Make sure everyone who handles bills knows these red flags and feels empowered to pause and ask questions.
• Put your bank’s tools to work. Services like Positive Pay, ACH debit blocks and filters, and payment alerts can catch unauthorized or suspicious activity before it costs you.

If You Think You’ve Been Targeted

• Act fast. Time matters when money has already moved.
• Call the bank immediately.
• Contact the real vendor using verified contact information.
• Report the incident to the FBI’s Internet Crime Complaint Center at ic3.gov.
• Change passwords and review email security settings, including any forwarding rules you didn’t create.

At Buckeye Community Bank, protecting your business is part of being your hometown bank. Our business banking team can walk you through fraud prevention tools and help you build safer payment practices. Contact us at 440-233-8800 or visit a Buckeye branch to start the conversation.