# Fake Invoice Email Scams: How to Spot Them, a 9-Point Checklist and a Safer Payment Process

> Spot a fake invoice email scam with 9 checks for mismatched tax numbers and bank details, a 6-step payment approval process, and what to do if you've paid.

Source: https://digitalbridge.com.tr/en/blog/fake-invoice-email-scams.html
Publisher: Digital Bridge Teknoloji (https://digitalbridge.com.tr)
Topic: Business Email & Documents
Published: 2026-10-04 · Updated: 2026-10-23

A fake invoice email scam imitates a supplier, courier or public body to request payment for goods never received, send a genuine invoice with altered bank details, or deliver malware disguised as an invoice. Catch it by matching each invoice to a purchase order and delivery record, and checking its tax number and bank details against the supplier master record.

## Key takeaways

- Fake invoice emails take three forms: an invoice for goods never received, a real invoice with altered bank details, or disguised malware.
- Do not pay until the tax number and bank details match the supplier record and the invoice matches an approved order and delivery.
- The first payment to a new or changed account should need a second approver and a call-back on a number already on file.
- The FBI IC3 2025 report records $3.05 billion in reported US BEC losses; fake invoices are one of its common forms.
- Call your bank immediately if a fraudulent payment is found; IC3 froze 58% of the money targeted in 2025 fraud cases.

## What types of fake invoice email are there?

Five fake invoice scenarios come up again and again:

1. **An invoice for something never ordered:** "annual maintenance", "advertising services" or "domain renewal", items nobody tracks closely.
2. **An altered copy of a real invoice:** the amount and invoice number are right, only the bank account is different. It usually comes from a [lookalike domain](https://digitalbridge.com.tr/en/glossary.html#lookalike-domain) resembling the supplier's. The freight-invoice variant is covered in [logistics email fraud](https://digitalbridge.com.tr/en/blog/logistics-email-fraud.html).
3. **An "invoice" carrying malware:** an office document asking for macros, a password-protected archive, or a "view your invoice" link to a login page. How these attachments work is explained in [malicious email attachments](https://digitalbridge.com.tr/en/blog/malicious-email-attachments.html).
4. **Public body or courier impersonation:** small but urgent-looking demands such as "unpaid e-invoice balance", "customs duty" or "delivery fee".
5. **An invoice that appears pre-approved:** a note saying "Approved by the MD, please pay today" imitates the approval chain.

## Why do fake invoice emails keep working?

Paying invoices is the accounts team's job, and at month end dozens or even hundreds land in the same week. A fake invoice email slips into that routine: ordinary business language, a convincing logo, a realistic amount. There is usually no trigger word or link for a spam filter to catch.

For companies operating in Türkiye, electronic invoicing has changed the shape of the risk rather than removing it. Between two businesses registered with the Revenue Administration (GİB), an [e-Fatura](https://digitalbridge.com.tr/en/glossary.html#e-fatura) (the mandatory electronic invoice) travels through an accredited integrator or the GİB portal; the PDF that arrives by email is usually just a courtesy copy. Attackers imitate that copy, and if the team trusts the PDF without checking that the invoice actually exists in the e-invoicing system, the fake gets processed.

## What does paying a fake invoice cost a business?

Fake invoices are a well-known form of [business email compromise (BEC)](https://digitalbridge.com.tr/en/glossary.html#bec), and losses from BEC are large.

> The [FBI IC3 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) records 24,768 BEC complaints in the US in 2025, with total reported losses of $3.05 billion, making BEC the crime type with the second-highest losses after investment fraud.

- According to the [APWG Phishing Activity Trends Report for Q2 2026](https://docs.apwg.org/reports/apwg_trends_report_q2_2026.pdf), the average amount requested in wire-transfer BEC attacks rose to $61,732, up 45% on the previous quarter.
- Speed matters. The same [FBI IC3 2025 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) notes that its Recovery Asset Team initiated 3,900 incidents in 2025 involving $1.16 billion in attempted theft and froze $679 million of it, a 58% success rate, and stresses that time is of the essence once a fraudulent transfer is discovered.
- The [Verizon 2026 Data Breach Investigations Report](https://www.verizon.com/business/resources/T1ae/reports/2026-dbir-data-breach-investigations-report.pdf) found that pretexting, where the attacker builds a plausible story to win trust, was the initial access vector in 6% of all breaches. A fake invoice is a typical example of that story.

When a fake invoice is paid, on top of the direct loss come the internal investigation, the dispute with the genuine supplier and the effort spent trying to recover the money.

## How do you spot a fake invoice email? A 9-point checklist

Keep this fake invoice checklist on the desk of your accounts and purchasing teams. One warning sign is not proof, but every row that gets a "yes" means the invoice must be confirmed before it is paid.

| Check | What to look for |
|---|---|
| Sender address | Does it differ from the supplier's known domain by a letter, hyphen or extension? |
| Reply-To | Does "Reply" produce a different address? |
| Order match | Is there an approved purchase order and a delivery note or service sign-off for this invoice? |
| Tax number | Does the tax number on the invoice match the supplier master record? |
| Bank details | Does the invoice or email give an account that is not on the supplier record? |
| E-invoice record | Does the invoice also appear in your integrator's or the GİB portal's inbox? |
| Amount and date | Is the amount outside the usual range, or the due date unusually short? |
| Attachment type | Is it a macro-enabled document, an archive or a link instead of a PDF? |
| Tone and pressure | Are there phrases like "must be paid today", "keep this confidential" or "already approved"? |

A second copy of the same invoice is also a warning: a duplicate invoice number, or the same amount requested again with different bank details, should be stopped before payment. For the broader set of warning signs, see [how to spot phishing emails](https://digitalbridge.com.tr/en/blog/how-to-spot-phishing-emails.html); firms that process invoices on behalf of clients can tie this checklist into [accounting firm document management](https://digitalbridge.com.tr/en/blog/accounting-firm-document-management.html).

## A six-step payment security process against fake invoices

1. **Use three-way matching.** No payment unless the purchase order, delivery (delivery note or service approval) and invoice match. This can be enforced as a rule in your [ERP system](https://digitalbridge.com.tr/en/software-solutions/erp-enterprise-resource-planning.html).
2. **Make the supplier master record the single source of truth.** Bank and tax details come only from the supplier record; if the account on the email or PDF differs, the payment stops.
3. **Treat bank-detail changes as a separate process.** Changing the account on a supplier record should require a call-back on the number already on file and a second person's approval. The callback protocol and how the attack is built are covered in [bank detail change email fraud](https://digitalbridge.com.tr/en/blog/bank-detail-change-email-fraud.html).
4. **Require two approvers for the first payment to a new or changed account.** No money leaves for an account seen for the first time on one person's decision. You can apply the same rule to payment confirmation emails with an [email approval workflow](https://digitalbridge.com.tr/en/blog/email-approval-workflow.html).
5. **Check the e-invoice record.** Rely on the record in your integrator's system, not the PDF that came by email. Why e-invoices are verifiable, and how they connect to your accounting software, is explained in [e-invoice integration in Türkiye](https://digitalbridge.com.tr/en/blog/e-invoice-integration-turkey.html).
6. **Act fast when something goes wrong.** If a fraudulent payment is discovered, call your bank immediately, keep all correspondence and tell IT, because a mailbox may have been compromised.

Some payment security steps depend on human discipline; many can be automated. A workflow that reads invoice fields and compares them with ERP records can be built with [document OCR](https://digitalbridge.com.tr/en/technology-hardware/document-ocr.html) and [RPA process automation](https://digitalbridge.com.tr/en/software-solutions/rpa-process-automation.html). We explain which fields OCR reads from an invoice, and how, in [OCR invoice processing](https://digitalbridge.com.tr/en/blog/ocr-invoice-processing.html).

For companies that trade internationally the fake invoice risk is higher, because overseas suppliers are harder to verify. How to check an invoice against the packing list and transport document in the same shipment file is covered in [import export document management](https://digitalbridge.com.tr/en/blog/import-export-document-management.html).

## How does Digital Bridge tackle fake invoice risk?

At Digital Bridge we treat fake invoice risk as part of the payment process, not only as an email problem:

- **Process map:** we trace who checks what from the moment an invoice arrives by email to the moment the payment leaves, and flag steps that depend on one person.
- **Control points:** we define three-way matching, approval of supplier-record changes and dual approval for first payments in a way that fits your existing systems.
- **Email layer:** as part of our [cyber security consultancy](https://digitalbridge.com.tr/en/consultancy/cyber-security.html), we review your domain's [SPF/DKIM/DMARC set-up](https://digitalbridge.com.tr/en/blog/spf-dkim-dmarc-explained.html) and bring in an email platform that checks incoming invoices automatically.
- **Integration:** where it helps, we build the automation that compares invoice data with your ERP.

## What SmartMail and SmartFiles do with an invoice email

SmartMail and SmartFiles, part of the [Smart360](https://digitalbridge.com.tr/en/smart360.html) family developed by Digital Bridge, take on three separate jobs in the accounts inbox.

**First, SmartMail questions the sender.** SmartMail puts every inbound message through three groups of checks: identity (it calculates SPF, DKIM, DMARC and PTR results itself), structure (lookalike domains and international characters, display-name and brand impersonation, Reply-To and link mismatches) and content (the whole text assessed with AI, including signs of a bank or payment detail change). The result is a reasoned assessment, and messages below the trust threshold set by the company administrator wait in quarantine rather than being deleted. Who manages quarantine and what may be released is covered in our [email quarantine policy](https://digitalbridge.com.tr/en/blog/email-quarantine-policy.html) guide.

**Second, SmartMail reads the invoice without opening the file.** SmartMail's attachment analysis extracts the parties, issue and due dates, subtotal, VAT, total, document number and tax number from an invoice PDF **without the file being downloaded**, and automatic classification tags the message as "invoice/payment".

A concrete scenario: an invoice arrives from an address resembling a supplier's, and the tax number differs from the one on your supplier record. The accounts specialist sees these fields on the message screen, without downloading and opening the PDF, and spots the mismatch; the same message may already have been flagged for its lookalike domain.

**Third, the reply and the archive stay under control.** A payment confirmation sent on behalf of the organisation can be routed through SmartMail's send approval to one or more approvers, with approval, revision with reasons, or rejection recorded with date and time. In a shared accounts mailbox, access is split into nine separate permissions and every message carries an activity log; the day-to-day routine for that mailbox is covered in [managing invoices in a shared inbox](https://digitalbridge.com.tr/en/blog/accounts-payable-shared-inbox.html). A verified invoice can be saved to the accounts area in SmartFiles with one click; SmartFiles analyses each document on upload, producing a four-part report that includes "Notable Details", and keeps every file uploaded under the same name as a new version.

## Next step

The fastest way to reduce fake invoice risk is to walk through the path an invoice takes from inbox to payment. How supplier addresses are imitated, and how to detect it, is covered in [lookalike domain attacks](https://digitalbridge.com.tr/en/blog/lookalike-domain-attacks.html). If you are thinking of replacing your email platform, score it against the [eight criteria for choosing business email](https://digitalbridge.com.tr/en/blog/business-email-how-to-choose.html); the other fraud types are gathered in our [Business Email & Documents guide](https://digitalbridge.com.tr/en/blog/topic/kurumsal-eposta.html).

You can explore SmartMail's invoice attachment analysis and security checks on the [SmartMail product page](https://digitalbridge.com.tr/en/smart360/smartmail.html) and the versioned invoice archive on the [SmartFiles document management](https://digitalbridge.com.tr/en/smart360/smartfiles.html) page; you can buy SmartMail directly on the [Smart360 Buy Now page](https://smart360.com.tr/satin-al?urun=smartmail), or [contact us](https://digitalbridge.com.tr/en/contact.html) to review your own invoice workflow with our team.

## Frequently Asked Questions

### How can I tell if an invoice email is fake?

Compare the sender address letter by letter with the supplier's known domain, check the tax number and bank details on the invoice against your supplier master record, and confirm there is an approved purchase order and delivery record. If any of these do not match, do not pay until you have called the supplier on a number you already hold.

### We use e-invoicing in Türkiye. Can we still receive fake invoice emails?

Yes. Attackers can imitate e-invoice notification emails and PDF copies. What counts is not the file attached to the email but whether the invoice actually exists in your integrator's or the GİB portal's inbox. Make that check a fixed step before any payment; any difference between the PDF and the system record needs confirming.

### What should we do if we have paid a fake invoice?

Call your bank at once and ask for the transfer to be stopped or recalled, keep all correspondence and report the fraud to the authorities. Because a mailbox may have been compromised, change passwords and end active sessions as well. The sooner you act, the better the chance that the transfer can be stopped.

### What is the difference between a fake invoice and bank detail change fraud?

In a fake invoice email the attacker imitates the document to be paid: an invoice for goods never received, or a real invoice with the bank account changed. In bank detail change fraud the invoice is genuine and the attacker only announces that the supplier's account has changed. The fix is the same: take bank details only from the supplier record and confirm any change by phone on a number already on file.

### How does SmartMail show invoice details?

SmartMail's attachment analysis extracts fields such as the parties, dates, subtotal, VAT, total, document number and tax number from an invoice PDF without downloading the file and shows them on the message screen. That lets you compare the invoice details quickly with your supplier record. Automatic classification also tags the message as "invoice/payment" so it reaches the right team.

### Is technology enough to stop invoice fraud?

No. Technology flags suspicious messages and speeds up checking, but without process rules such as three-way matching, phone confirmation of bank-detail changes and dual approval for first payments, the risk is not fully closed. The best results come from using both together. When the process rules are defined in your ERP system, the control no longer depends on one person.