Fake invoice red flags
Fraudulent invoices tend to share the same warning signs. One alone is not proof; several together are a reason to stop.
- You do not recognise the supplier, or have no order behind the invoice.
- The bank details are new or changed, especially if announced by email.
- Pressure to pay quickly, such as "final notice" or "pay today".
- An odd invoice number: missing, repeated, or not in the supplier's usual pattern.
- Details that differ from your records: a name with one letter changed, a different address or tax ID.
- No purchase order or reference where your process normally has one.
- Vague or round amounts, such as "services rendered" with no breakdown.
- A sender address that does not match, for example a lookalike domain or a free mailbox.
- Numbers that do not add up. Run the check above to find out in seconds.
The full list, with what to do about each, is in our guide: how to identify a fake invoice.
How to check a suspicious invoice
- Do not act on the message. Do not reply, click links or open unexpected attachments.
- Upload the PDF to test the arithmetic and basic details.
- Look up the supplier yourself. Use your own records or an independent source, not details from the invoice.
- Match it to an order or delivery. A purchase order, quote, contract or delivery note.
- Call to confirm. Use a phone number you already hold, particularly for bank detail changes.
- Report it if it is fraudulent, and ask your bank to act if money has already left.
What a calculation check does and does not prove
A passed result means the numbers on the page agree with each other. It does not mean the invoice is real. A failed result means something is wrong, which may be a fake or may be an honest mistake; either way, do not pay until it is explained. If it turns out to be an error, see how to fix invoice errors.
Related pages
- Invoice verification: confirming an invoice against your records.
- Invoice validation: the document checks in detail.
- Common invoice errors.
Privacy
For guests, the PDF is processed in memory and is not saved. See the security practices for details.