A fake invoice email scam imitates a supplier, courier or public body to request payment for goods never received, send a genuine invoice with altered bank details, or deliver malware disguised as an invoice. Catch it by matching each invoice to a purchase order and delivery record, and checking its tax number and bank details against the supplier master record.
Any payment to a new or changed account should also need a second person's approval. Much of this checking can be automated by an email platform that reads the invoice inside the message.
Why fake invoice emails keep working
Paying invoices is the accounts team's job, and at month end dozens or even hundreds land in the same week. A fake invoice email slips into that routine: ordinary business language, a convincing logo, a realistic amount. There is usually no trigger word or link for a spam filter to catch.
For companies operating in Türkiye, electronic invoicing has changed the shape of the risk rather than removing it. Between two businesses registered with the Revenue Administration (GİB), an e-Fatura (the mandatory electronic invoice) travels through an accredited integrator or the GİB portal; the PDF that arrives by email is usually just a courtesy copy. Attackers imitate that copy, and if the team trusts the PDF without checking that the invoice actually exists in the e-invoicing system, the fake gets processed.
Five scenarios come up again and again:
- An invoice for something never ordered: "annual maintenance", "advertising services" or "domain renewal", items nobody tracks closely.
- An altered copy of a real invoice: the amount and invoice number are right, only the bank account is different. It usually comes from a domain resembling the supplier's. The freight-invoice variant is covered in logistics email fraud.
- An "invoice" carrying malware: an office document asking for macros, a password-protected archive, or a "view your invoice" link to a login page.
- Public body or courier impersonation: small but urgent-looking demands such as "unpaid e-invoice balance", "customs duty" or "delivery fee".
- An invoice that appears pre-approved: a note saying "Approved by the MD, please pay today" imitates the approval chain.
What a paid fake invoice costs
Fake invoices are a well-known form of business email compromise (BEC), and losses from BEC are large.
The FBI IC3 2025 Internet Crime Report records 24,768 BEC complaints in the US in 2025, with total reported losses of $3.05 billion, making BEC the crime type with the second-highest losses after investment fraud.
- According to the APWG Phishing Activity Trends Report for Q2 2026, the average amount requested in wire-transfer BEC attacks rose to $61,732, up 45% on the previous quarter.
- Speed matters. The same FBI IC3 2025 report notes that its Recovery Asset Team initiated 3,900 incidents in 2025 involving $1.16 billion in attempted theft and froze $679 million of it, a 58% success rate, and stresses that time is of the essence once a fraudulent transfer is discovered.
- The Verizon 2026 Data Breach Investigations Report found that pretexting, where the attacker builds a plausible story to win trust, was the initial access vector in 6% of all breaches. A fake invoice is a typical example of that story.
On top of the direct loss come the internal investigation, the dispute with the genuine supplier and the effort spent trying to recover the money.
How to spot a fake invoice email scam: a checklist
Keep this table on the desk of your accounts and purchasing teams. One warning sign is not proof, but every row that gets a "yes" means the invoice must be confirmed before it is paid.
| Check | What to look for |
|---|---|
| Sender address | Does it differ from the supplier's known domain by a letter, hyphen or extension? |
| Reply-To | Does "Reply" produce a different address? |
| Order match | Is there an approved purchase order and a delivery note or service sign-off for this invoice? |
| Tax number | Does the tax number on the invoice match the supplier master record? |
| Bank details | Does the invoice or email give an account that is not on the supplier record? |
| E-invoice record | Does the invoice also appear in your integrator's or the GİB portal's inbox? |
| Amount and date | Is the amount outside the usual range, or the due date unusually short? |
| Attachment type | Is it a macro-enabled document, an archive or a link instead of a PDF? |
| Tone and pressure | Are there phrases like "must be paid today", "keep this confidential" or "already approved"? |
A second copy of the same invoice is also a warning: a duplicate invoice number, or the same amount requested again with different bank details, should be stopped before payment. For the broader set of warning signs, see how to spot phishing emails; firms that process invoices on behalf of clients can tie this checklist into accounting firm document management.
A six-step payment security process for accounts teams
- Use three-way matching. No payment unless the purchase order, delivery (delivery note or service approval) and invoice match. This can be enforced as a rule in your ERP system.
- Make the supplier master record the single source of truth. Bank and tax details come only from the supplier record; if the account on the email or PDF differs, the payment stops.
- Treat bank-detail changes as a separate process. Changing the account on a supplier record should require a call-back on the number already on file and a second person's approval. The callback protocol and how the attack is built are covered in bank detail change email fraud.
- Require two approvers for the first payment to a new or changed account. No money leaves for an account seen for the first time on one person's decision. You can apply the same rule to payment confirmation emails with an email approval workflow.
- Check the e-invoice record. Rely on the record in your integrator's system, not the PDF that came by email. Why e-invoices are verifiable, and how they connect to your accounting software, is explained in e-invoice integration in Türkiye.
- Act fast when something goes wrong. If a fraudulent payment is discovered, call your bank immediately, keep all correspondence and tell IT, because a mailbox may have been compromised.
Some of these steps depend on human discipline; many can be automated. A workflow that reads invoice fields and compares them with ERP records can be built with document OCR and RPA process automation. We explain which fields OCR reads from an invoice, and how, in OCR invoice processing.
For companies that trade internationally the fake invoice risk is higher, because overseas suppliers are harder to verify. How to check an invoice against the packing list and transport document in the same shipment file is covered in import export document management.
How we approach this at Digital Bridge
We treat fake invoice risk as part of the payment process, not only as an email problem:
- Process map: we trace who checks what from the moment an invoice arrives by email to the moment the payment leaves, and flag steps that depend on one person.
- Control points: we define three-way matching, approval of supplier-record changes and dual approval for first payments in a way that fits your existing systems.
- Email layer: as part of our cyber security consultancy, we review your domain's SPF/DKIM/DMARC set-up and bring in an email platform that checks incoming invoices automatically.
- Integration: where it helps, we build the automation that compares invoice data with your ERP.
What SmartMail and SmartFiles do with an invoice email
The Smart360 family we develop in-house takes on three separate jobs in the accounts inbox.
First, it questions the sender. SmartMail assesses every inbound message against 12 signals: its own SPF/DKIM/DMARC and PTR verification, lookalike domains and international characters, display-name and brand impersonation, Reply-To and link mismatches, risky attachments, content assessment and comparison with known fraud techniques. The result is a written report with the reasons, and messages below the trust threshold your organisation sets are quarantined. Who manages quarantine and what may be released is covered in our email quarantine policy guide.
Second, it reads the invoice without opening the file. SmartMail's attachment analysis extracts the parties, issue and due dates, subtotal, VAT, total, document number and tax number from an invoice PDF without the file being downloaded, and automatic classification tags the message as "invoice/payment". A concrete scenario: an invoice arrives from an address resembling a supplier's, and the tax number differs from the one on your supplier record. The accounts specialist sees these fields on the message screen, without downloading and opening the PDF, and spots the mismatch; the same message may already have been flagged for its lookalike domain.
Third, it controls the reply and the archive. A payment confirmation sent on behalf of the organisation can be routed through SmartMail's send approval to one or more approvers, with approval, revision with reasons, or rejection recorded with date and time. In a shared accounts mailbox, access is split into nine separate permissions and every message carries an activity log; the day-to-day routine for that mailbox is covered in managing invoices in a shared inbox. A verified invoice can be saved to the accounts area in SmartFiles with one click; SmartFiles analyses each document on upload, producing a four-part report that includes "Notable Details", and keeps every file uploaded under the same name as a new version.
Next step
The fastest way to reduce fake invoice risk is to walk through the path an invoice takes from inbox to payment. If you are thinking of replacing your email platform, score it against the eight criteria for choosing business email; the other fraud types are gathered in our Business Email & Documents guide.
You can explore SmartMail's invoice attachment analysis and security checks on the Smart360 page, or contact us to review your own invoice workflow with our team.