Invoice Fraud

Layer 8: People High risk

How it works

Invoice fraud targets the routine of paying suppliers. Attackers may compromise a vendor's mailbox, impersonate a supplier with a lookalike domain, or simply send a believable invoice for services that sound plausible. A common version is a notice that a supplier has changed banks, with new deposit details attached on letterhead that looks authentic. Some attackers also study real invoices from a compromised mailbox so their versions match exactly.

Because the amounts often match real invoices and arrive at expected times, accounts payable staff may process them without a second look. The fraud is usually discovered only when the genuine supplier follows up about an unpaid bill, weeks later. By then the money has typically been moved out of the receiving account. Organizations with many suppliers, construction and project-based firms, and those paying by electronic transfer are frequent targets.

Warning signs

• A supplier announcing new banking details by email
• Invoices from new vendors without a purchase order
• Small differences in sender domain, logo or invoice format
• Unusual urgency or threats of late fees
• Bank account names that do not match the supplier

How to defend against it

• Confirm any banking change by calling a known contact at the supplier
• Match invoices to purchase orders before payment
• Use dual approval for new payees and changed details
• Keep a vetted vendor master list with controlled edits
• Train accounts payable staff on common invoice scams

If it happens to you

1. Call your bank right away to request a recall or freeze
2. Contact the real supplier through verified details
3. Preserve the emails and invoice files for investigators
4. Report to police and the Canadian Anti-Fraud Centre