A fake invoice email works because the payment looks routine: a real vendor, a real amount, and one changed detail, the bank account. Before you pay any invoice that arrives with new payment instructions, verify the change by phone on a number you already have, not one in the email.
The invoice looks right. The vendor is real, the amount matches what you expected, the logo and the layout are the ones you have seen a hundred times. The only thing wrong is the bank account at the bottom, and the note explaining that the vendor has changed banks. That is the whole scam, and it is the most expensive one in American cybercrime.
The FBI's Internet Crime Complaint Center counted 21,489 business email compromise complaints in 2023, with adjusted losses above $2.9 billion. In 2024 the count was 21,442 complaints and $2.77 billion. The fake invoice is the most common version of it, because it targets the one process every business runs every week: paying vendors.
There are two versions, and they look identical from the accounts payable desk. In the first, the attacker breaks into the vendor's real email account and sends the fake invoice from it, with doctored banking details attached. In the second, the attacker spoofs the vendor's address with a lookalike domain, one letter different, and sends the invoice from there. Either way the email arrives in a thread you already trust, which is why it works.
The SEC's 2018 investigation of nine public companies found the pattern in the open: after breaking into a supplier's email, the attackers requested banking changes and attached doctored invoices reflecting the new, fraudulent account information. One company in that investigation paid eight invoices totaling $1.5 million over several months, and only discovered the fraud when the real vendor complained about past-due invoices.
First, the domain. Read the sender's address character by character, not the display name. A lookalike domain, vendor-payments.com instead of vendor.com, or a single letter swapped, is the most common tell. If the invoice came from a thread you trust, check that the address in this message matches the address in the last real message from that vendor.
Second, the change itself. A real vendor changes banks rarely, and when they do, they tell you in advance, on the phone, through a contact you already know. A bank change announced for the first time inside an invoice is not a bank change. It is the scam. Treat every first-time payment instruction change as unverified until proven otherwise.
Third, the urgency. The invoice is always due now, or the vendor will suspend service, or the discount expires today. Urgency is the tool that stops you from making the phone call. A real vendor who wants to be paid will wait twenty minutes while you verify. A scammer cannot afford that call.
Fourth, the verification call. Phone the vendor on a number you already have, from your own records, not from the email. Ask whether they changed banks and whether this invoice is theirs. The call takes three minutes. The wire takes three seconds, and the recovery takes months, if it happens at all.
If the money already went out, speed is everything. The FBI runs a Financial Fraud Kill Chain through its Recovery Asset Team, and in 2024 it handled 3,020 requests covering $848.4 million in attempted theft, freezing $561.6 million, a 66 percent success rate. That recovery is measured in hours, not days, and it only works if you report immediately.
File at ic3.gov with the transaction details, call your bank's fraud team, and tell the real vendor what happened. Then fix the process that let it through: no payment instruction changes accepted by email, ever. Changes come by phone from a known contact, or they do not happen.
Two earlier posts on this site cover ground “Fake Invoice Emails: The Red Flags That Catch a BEC Scam Before You Pay” builds on: Fake Ticket Listings: The Resale Checks That Catch Most Scams, Fake Charity Scams After a Disaster: How to Check Before You Give.
Read the sender's domain character by character, and treat any first-time bank change announced inside an invoice as unverified. A real vendor changes banks rarely and tells you in advance through a contact you already know. Verify by phone on a number from your own records.
It is a scam where an attacker spoofs or hijacks a trusted email account and sends payment instructions that move money to an account they control. The FBI counted 21,489 complaints and over $2.9 billion in losses in 2023, and $2.77 billion in 2024.
Sometimes, if you move fast. The FBI's Recovery Asset Team froze $561.6 million of $848.4 million in attempted theft in 2024, a 66 percent success rate. File at ic3.gov immediately, call your bank's fraud team, and tell the real vendor.
No. That is the process fix that ends this scam. Payment instruction changes should come by phone from a known contact, never inside an invoice email. Write the rule down, and make it apply to every vendor, including the ones you trust most.