What it looks like
A fake invoice can be an email attachment, a “view invoice” link or a letter. It often imitates a supplier you already use and copies their wording. A common version is a believable message saying “our bank details have changed”.
From: accounts@invoices-office.example
Invoice 4821 is overdue. Final notice: pay £389.00 today to avoid extra fees. Our bank details have changed, please use the account below.
Why it’s fake: an order you can’t place, a “final notice” with pressure to pay today, new bank details, and a sender domain that isn’t your supplier’s.
Made up for illustration. The sender, company and link don’t exist.
Warning signs
- You don’t recognise the orderNo purchase, no contract, nobody you work with. Check your own records before assuming you forgot.
- New or changed bank detailsA supplier suddenly using a different account is the classic fraud. Confirm by phone, using a number you already have.
- Pressure to pay today“Final notice”, extra fees, threats of court. Real reminders usually give you time.
- An odd way to payA personal account, gift cards, crypto or “pay via this link”. Businesses normally invoice to a company account.
- Sender details slightly offAn extra word or letter in the domain, or a reply-to address that differs from the sender. Don’t open attachments until you’ve checked.
What to do now
- Don’t pay, don’t open the attachment and don’t reply.
- Check your own records: orders, contracts and earlier invoices from the same supplier.
- If it looks like a supplier you use, call them on a number from your own records, not the one on the invoice.
- At work, tell whoever handles payments, and agree that bank-detail changes are always confirmed by phone.
If you already clicked or paid
- If you paid, contact your bank immediately. The sooner they know, the better the chance of recalling the transfer.
- If you opened an attachment or typed a password, change that password and run a security scan on the device.
- Tell the real supplier, in case their email has been hacked and others are being targeted.
- Keep the invoice, the emails and the proof of payment. Your bank and the police will want them.
How to report it
Report it to your local police or national fraud reporting service (in England, Wales and Northern Ireland, Report Fraud at reportfraud.police.uk; in Scotland, Police Scotland on 101). If it came by email, you can also report it as phishing to your email provider.