How to spot a fake invoice email
Invoice fraud can use lookalike addresses or compromised real accounts. Here are warning signs and a payment-verification process that reduces reliance on email alone.
Section 01
Why fake invoices work so well
A fake invoice can come from a lookalike address or a real account that has been compromised. Familiar tone, formatting, and conversation context are not proof that changed payment instructions are legitimate.
Section 02
The red flags that actually matter
Forget 'look for bad grammar' — modern invoice fraud is clean. Look for these instead:
- ■Any change in bank account, routing number, or payment method — verify it through a trusted channel before paying
- ■Urgency plus secrecy: 'please process today', 'the CEO needs this handled quietly'
- ■A reply-to address that differs from the sender address (check the actual header, not the display name)
- ■Lookalike domains: yourvendor-inc.com instead of yourvendorinc.com — one character off
- ■An invoice arriving at an unusual time in the billing cycle, or for a slightly different amount than usual
Section 03
A strong payment-verification habit
Verify every payment-detail change by phone or another trusted channel, using contact information you already have on file rather than details supplied in the message. This reduces reliance on a potentially compromised email channel but does not eliminate fraud risk.
Make it policy: no one in your company changes where money gets sent based on an email alone, no matter how legitimate it looks or who it appears to come from.
Section 04
Watch for the takeover before the invoice goes out
Some account-takeover attempts produce supported audit records before a fraudulent message, such as suspicious sign-ins, inbox-rule changes, or forwarding changes. Other activity may be unavailable or delayed.
InboxGuards checks those available audit records at the fastest cadence available on standard Microsoft 365 and Google Workspace plans — no premium security licensing required — and alerts in plain English when a configured account-takeover signal appears. It cannot guarantee an alert before a fraudulent message or payment. $2 per user per month, with customer-admin authorization for read-only access.
Start monitoring your inboxes
Customer-admin authorization · Read-only access · $2/user/mo · 30-day money-back guarantee