How Invoice Fraud Actually Happens to Small Businesses

Invoice fraud happens when attackers send your business a fake invoice or intercept a real one, changing the bank details to their own account. The email looks legitimate because it either comes from a lookalike domain, uses a compromised supplier's real email account, or displays a trusted name.

How do attackers make fake invoices look real?

Fraudsters research your business using public sources like LinkedIn, press releases, and company websites to identify vendors, billing cycles, and key finance personnel (ramp.com). They study the company's regular suppliers, how much the company typically spends with the vendor, and when the vendor submits their bill (stampli.com).

A lookalike domain is a domain name created to closely resemble a legitimate brand's domain to mislead users, commonly used in phishing, email spoofing, fraud, and impersonation attacks (powerdmarc.com). One trick uses letters that are visually similar or indistinguishable, such as a lowercase L that looks identical to a capital I, so an email from JOHN@MlCROSOFT.COM would fool even the more eagle-eyed (kaspersky.com). Combo-squatting has become popular with cybercriminals in recent years, where they create a domain that combines a company's name and a relevant auxiliary word, such as Microsoft-login.com or SkypeSupport.com.

The attacker may go to great lengths to make the email domain look legitimate, including having the malicious email server use an authentic TLS certificate, sending the email with high grade encryption, and adding strict SPF, DKIM, and DMARC entries to the malicious email server so that email authentication algorithms are satisfied even though the domain is spoofed (image-ppubs.uspto.gov).

What happens when a supplier's real email gets hacked?

In a business email compromise attack, attackers breach a legitimate vendor's email account to intercept real invoices, and before forwarding the invoice for payment, they alter the bank account details so the payment is redirected to them. The scammers appear to have hacked a supplier's email and advised businesses of a change in bank details, sending invoices with amended bank details as well as the prior email trail to and from the supplier.

This is particularly effective because once breached, bad actors use supplier details to create a convincing invoice that may have the originator's correct email address, due dates, pricing, the goods and services you ordered. Everything was a perfect copy of a real version of the invoices businesses were so used to.

How do changed bank details appear in a reply chain?

After identifying a recurring payment schedule, the attacker inserts themselves into a genuine thread using the compromised account and provides a legitimate-looking PDF with updated banking instructions. The Australian Scamwatch service reports that the change in bank details is often the only sign this is a scam, as fraudsters pose as regular suppliers and tell businesses their banking details have changed.

Cybercriminals often alter key details such as the sender's email address, bank account information, or invoice numbers to appear legitimate. The FBI warns businesses to carefully examine email addresses because scammers use slight differences to trick your eye and gain your trust.

What does email authentication actually stop?

SPF blocks unauthorized senders, DKIM protects the message, and DMARC stops attackers from using your domain in the From address. Together, they make it much harder to impersonate your business. Domain spoofing hijacks an organization's trusted domain, and this can be blocked by fully implementing DMARC email authentication on those domains.

But email authentication has clear boundaries. DMARC does not stop every form of impersonation. It does not prevent attackers from registering a lookalike domain or using a different display name. It specifically addresses unauthorized use of the protected From domain.

What passes through email authentication unchanged?

Display name spoofing sets the human-readable display name to match a trusted individual while using a completely different, legitimately registered sending address. Many email clients show only the display name and suppress the actual address. Because no header forgery occurs and the attacker's domain is real, SPF, DKIM, and DMARC all pass.

In a display name spoofing attack, the attacker sends from a domain they legitimately control, often a free email provider, so SPF passes, DKIM passes, and DMARC passes. The deception is entirely in the display name, which none of these protocols evaluate. Human awareness remains necessary because technical controls cannot catch every spoofing technique. Display name spoofing and lookalike domains pass all protocol checks, so the final layer of defense is the person reading the email.

Lookalike domain spoofing uses lookalike domains that are registered by third parties and are outside of the control of the organization being spoofed. This tactic can be prevented by lookalike domain discovery solutions that detect, analyze and flag suspicious domains. The free AI-visibility check (/check) includes security scoring across DNS records including SPF, DMARC, and DKIM configuration, helping you understand whether your domain's authentication is configured to block spoofing of your own domain name.

What controls actually prevent payment fraud?

The strongest defence is never using email as the sole confirmation for changed bank details. A supplier's email should never be the only evidence supporting a banking change. Contact the supplier directly using a second, reliable mode of communication such as a known phone number to verify any request to change bank details.

Procurement and accounts-payable teams should separate vendor communication from payment approval. Require independent callback verification for new beneficiaries and bank-account changes, using a trusted number already stored in the vendor record. If your business manages multiple client sites or vendors, ActiScore's pricing (/pricing) includes white-labelled security audits starting at $79 per month, allowing managed service providers to monitor DNS-based security controls across customer domains.

Three-way matching remains an effective operational control. Before releasing payment, all invoices should match purchase orders and delivery receipts. The managed IT lens here is straightforward: email authentication protects your domain from being spoofed by others, but it does nothing to verify that the bank details in an invoice are correct. That verification happens through process controls, not protocol checks. For ongoing security governance across your infrastructure, the guide (/guide) covers how DNS-based authentication fits into a broader security posture that includes both technical controls and operational procedures.

Human judgment is the control that bridges technical authentication and operational verification. Even when DMARC is set to reject and your domain is fully protected, your staff will still receive invoices from lookalike domains, from compromised supplier accounts, and from emails with spoofed display names. Training your team to pause before changing payment details is not a backup control. It is the primary one.