Fake Invoice Emails: How to Spot Them

Warning signs to look for

• An invoice for a subscription, renewal, or service you never bought
• A phone number for 'billing questions' and no working account link
• New or changed bank details on an otherwise familiar invoice
• Pressure to pay today to avoid cancellation, penalties, or legal action
• An attachment that opens a login page instead of a document
• An amount just large enough to alarm you but small enough to pay quickly

The three main patterns

First, the bulk fake invoice: a renewal notice for antivirus, tech support, or a marketplace subscription, sent to millions of addresses in the hope that a fraction call the number. Second, the abused platform invoice, where a criminal uses a real payment provider's invoicing tools so the notification is technically genuine while the request is fraudulent. Third, and by far the most expensive, invoice redirection: an attacker who has been reading a mailbox sends a real-looking invoice from a real supplier with changed bank details. The FBI tracks this last category as business email compromise, and it accounts for very large reported losses each year.

Why household invoice scams work

Paying bills is routine and mildly stressful, so an invoice does not trigger the suspicion a request for a password does. Consumer versions rely on brands people vaguely recognise and on amounts big enough to prompt a phone call. Because the objective is usually to get you on the phone, these emails frequently contain no link at all — which also helps them slip past filters that look for malicious URLs.

How to verify any invoice

Start with your own records. Do you have an account with this company? Is the amount consistent with what you pay? Then look at your bank or card statement: if no charge has been taken, nothing is outstanding. Log into the supplier's account portal by typing the address yourself, where genuine invoices are listed. If you need to call, use a number from a previous statement, a contract, or the back of your card. Never use contact details supplied by the document you are trying to verify.

The bank-details rule

Treat any change of payment details as suspicious by default, even when it comes from a familiar address and an ongoing conversation. Confirm the new details by calling the supplier on a number you already held before the request arrived, and speak to a person you know. For businesses, require a second approver for any change of bank details and keep that rule absolute — it is the single control that prevents most losses of this kind.

If you already paid

Contact your bank immediately and ask for a recall; the chances fall sharply after the first day. Report to the FBI's Internet Crime Complaint Center at ic3.gov — for wire fraud in particular, its Recovery Asset Team can sometimes freeze funds when a report is filed quickly. Report to the FTC at reportfraud.ftc.gov as well. Notify the real supplier, since their mailbox may be compromised and other customers may be at risk. Keep every document and record every call.

Check the invoice before you pay it

If an invoice looks plausible but you cannot place it, forward the original email to check@spamcheck.com. SpamCheck will explain what the sender, the headers, and any attachment actually show, and whether the payment request holds up — before any money moves.

Frequently asked questions

What happens if I ignore a fake invoice?

Nothing. A fraudulent invoice is not a debt. There is no collection, no penalty, and no consequence to deleting it.

The invoice came from my supplier's real email address. Can it still be fraud?

Yes. If their mailbox has been compromised, the message is genuinely from them but written by an attacker. This is exactly why changed bank details must be confirmed by phone.

Should I call the number to cancel the subscription?

No. If there is no charge on your statement, there is nothing to cancel, and the call is the scam's objective.

Are businesses or households targeted more?

Both, but differently. Households see bulk fake renewals; businesses see targeted invoice redirection, which produces far larger individual losses.

Sources

• FBI Internet Crime Complaint Center (IC3)
• FTC — How to Recognize and Avoid Phishing Scams
• FTC — Report Fraud

Related guides

• Geek Squad Scam Emails: How to Spot Them

  A Geek Squad invoice for a subscription you never had is one of the most common scam emails in circulation. Here is what it is really after.

• PayPal Scam Emails: How to Spot Them

  Some PayPal scam emails are forgeries. Others are genuine PayPal emails carrying a fraudulent invoice. Here is how to tell them apart.

• Norton Scam Emails: How to Spot Them

  A Norton antivirus renewal charge you never approved is almost always a refund scam. Here is how to check it in a minute.

• Is This Bank Email Real or Fake?

  Bank alerts are the most imitated emails there are. Here is how to separate a real notice from a convincing fake in a couple of minutes.

• I Sent Money to a Scammer: What Should I Do?

  Recovery depends almost entirely on how you paid and how fast you move. Follow the steps for your payment method below.

• 5 Ways to Tell If an Email Is Really From Your Bank

  Fake bank emails are the most dangerous scams because they target the money directly. These five checks settle it.