Guide · Updated 2026-10-19 · By the PayOrScam team
How to spot a fake or altered invoice
There are two kinds of invoice fraud. A fake invoice bills you for something you never ordered, often tech support, domain registration or office supplies, sometimes stamped "past due" (FTC). An altered invoice is a real supplier's invoice with the bank details swapped, usually after an email account is hacked or spoofed. The FBI's IC3 counted about $55 billion in exposed business email compromise losses worldwide between October 2013 and December 2023.
Match it to a real order. No purchase order, contract or delivery? The FTC says don't pay, and you don't have to pay for unordered goods.
Compare the bank details with the last invoice you paid. New account, new bank or new country is the classic sign of an altered invoice.
Check the sender's address character by character. Lookalike domains (rn for m, .co for .com) and reply-to addresses that differ from the sender are common.
Call the supplier on a number you already have to confirm any change of bank details. Never use contact details from the email itself.
Check the maths and details: totals, tax, invoice numbers, the company number and address against the official register.
Look for editing traces. Mismatched fonts, a blurry or pasted logo, a "signature" in a script font, or a PDF made with a different program from the supplier's usual invoices.
Treat urgency as a warning. "Pay today or service stops" is a pressure tactic the FTC and FBI both flag.
Upload the invoice to PayOrScam. It checks the company, domain, email, phone and bank details, reverse-searches logos and images, flags script-font signatures and hidden PDF layers, and shows the source for each finding.