Guide
How to check if an invoice is legit
The one check that catches most of them
Almost every convincing invoice fraud ends in the same moment: someone is asked to pay a familiar supplier into a different account. So the check that matters is not whether the email looks right. It is whether the bank details match.
Verify them against something that did not arrive with the email — a previous invoice, a statement, your accounting software, a signed contract. Then confirm with a phone call to a number you already have. Not the number in the email: the attacker supplies that one too.
What a fake invoice looks like
Changed bank details. The single strongest signal. Legitimate suppliers change banks occasionally; they do not usually announce it in an email with no warning.
A reply-to that does not match the sender. The message says it comes from your supplier's address; replies quietly go somewhere else.
A domain that is nearly right. A hyphen added, a letter swapped, a different ending. supplier-invoices.com instead of supplier.com.
A new address, or a free one. A supplier who has emailed you for two years suddenly writing from a Gmail address is either compromised or impersonated.
Urgency and a small window. A discount that expires today, a payment that must clear before a shipment, a director who is unreachable.
A change in the paperwork. A different invoice layout, different numbering, different VAT or company details, or a PDF where you normally get an inline invoice.
Why it works so often
Business email compromise — the category this sits in — is the most expensive cybercrime reported to the FBI. In 2025 the IC3 logged 24,768 business email compromise complaints with reported losses of $3.05 billion. Reported, not total: most of these never get reported at all.
None of this relies on breaking encryption or finding a software flaw. It relies on a person being busy, trusting a familiar logo, and doing what the email asks.
If you have already paid
Speed decides the outcome. Ring your bank immediately and ask them to recall the payment — the first hours matter most, and international transfers are close to unrecoverable after a day.
Then tell the supplier, using a number you already hold, so they know their name is being used. Report it to the police and to your national fraud reporting centre. Keep the original email and its full headers; banks and investigators will ask for them.
A sixty-second check before you pay
1. Does the bank account match the one already in your records?
2. Is the reply-to the same domain as the sender?
3. Has this sender's address or domain changed recently?
4. Is anyone rushing you?
5. Have you confirmed by phone on a number you already had?
If any answer is wrong, stop. A held payment costs an awkward phone call. A sent one costs the money and often the relationship.
Questions
What is the fastest way to check an invoice is genuine?
Compare the bank details against a previous invoice or statement you already hold, then ring the supplier on a number from your own records. Do not use the phone number or account details contained in the email you are checking.
Do fake invoices always ask for a different bank account?
Not always, but it is the most common and most expensive pattern. Some fake invoices purely harvest information, or attach a document that installs malware. If the bank details are unchanged and independently verified, the risk drops sharply.
What should I do if I already paid a fake invoice?
Contact your bank immediately and ask for a payment recall, tell the real supplier, report it to the police and your national fraud centre, and preserve the original email with its full headers.
Check a message before you act
If you have a message in front of you and you are not sure, paste it into Globosafe. You get a verdict — genuine, suspicious or fraudulent — with the specific warning signs and what to do next. Check a message.