Invoice fraud is when someone gets a company to pay an invoice it does not owe. The invoice might come from a fake vendor, from a criminal posing as a real vendor, or from a real vendor or employee who inflates, repeats or invents charges. Most schemes leave warning signs in the vendor file, the invoice or the payment request that an AP clerk can check.
How common is fraud in accounts payable?
It is common enough that fraud examiners track it every year. The ACFE’s Occupational Fraud 2026: A Report to the Nations looked at 2,402 cases from 143 countries. The median case cost the organization $104,000 and ran for 12 months before anyone found it. More than half of the cases involved either a lack of internal controls or someone overriding the controls that existed. A tip was the most common way schemes came to light, in 43% of cases, and more than half of those tips came from employees.
Outside fraud is a separate problem. The FBI’s 2025 IC3 annual report recorded 24,768 business email compromise complaints in 2025, with reported losses of $3,046,598,558. Many of those schemes end with a fake invoice or a changed bank account on a real one.
What are the most common invoice fraud schemes?
Fake vendors and shell companies
Someone sets up a company that exists only on paper, gets it added to the vendor master file, and sends invoices for work nobody did. The person behind it is often an employee, sometimes with help from outside. Invoices tend to be for services, because services leave no goods to count at the loading dock.
Vendor impersonation and changed bank details
A criminal poses as one of your real suppliers, usually by email, and asks you to update their bank details. The next legitimate invoice gets paid into the criminal’s account. The email may come from a lookalike domain or from the vendor’s own mailbox after it has been hacked, so it can look completely normal.
Inflated or duplicate invoices sent on purpose
A real vendor bills more than the agreed price, bills the same work twice, or resubmits an old invoice with a new number and date. Many duplicate payments are honest mistakes (see how duplicate payments happen), and so is a lot of double billing. The deliberate version looks the same on paper, which is why the check has to happen before anyone decides intent.
Invoices for goods or services never delivered
The invoice matches a purchase order and the amount looks right, but nothing arrived or the work was never done. This works best where no one confirms receipt, or where the person who confirms receipt is in on it.
Kickbacks and padded pricing
A buyer steers work to a vendor who pays them back personally. The vendor recovers the kickback through prices a little above market, extra line items or small increases over time. Nothing about any single invoice looks wrong. You see it when you compare prices across vendors or across time.
How do you detect fake invoices? A warning signs checklist
None of these proves fraud. Each one is a reason to look at the vendor or the invoice again before approving it.
- A new vendor with only a PO box, a residential address or a mobile phone number, and no website or tax ID you can confirm
- A vendor whose address, phone number or bank account matches an employee’s
- Invoices in round amounts, such as $5,000.00, where real work usually produces odd totals
- Sequential invoice numbers from one vendor over months, which suggests you are its only customer
- Invoice numbers, logos or formatting that differ from the vendor’s earlier invoices
- A request to change bank details that arrives by email, especially just before a payment run
- Pressure to pay fast, to skip the usual approval, or to keep the request confidential
- Invoices that fall just under an approval limit, or one purchase split across several invoices that each stay under it
- Vague descriptions such as “consulting services” or “miscellaneous” with no dates, hours or quantities
- Prices that rise faster than the contract allows, or line items that were never in the agreement
- An employee who insists on handling one vendor personally and resists anyone else looking at the account
If you want to go through your own history for some of these, an accounts payable audit covers the vendor file and payment review in more depth, and price variance checks cover the pricing side.
What controls reduce the risk of invoice fraud?
Controls work because they make one person unable to do everything alone. The ACFE finding above, that more than half of cases involved missing or overridden controls, is the practical argument for each of these.
- Verify every bank detail change by calling the vendor on a number you already have on file, from a contract or an earlier invoice, never the number in the email asking for the change.
- Separate duties. The person who adds or edits vendors should not approve invoices, and the person who approves invoices should not release payments.
- Check new vendors before their first invoice is paid. Confirm the legal name, tax ID, address and bank account, and look for matches against employee records. The FTC’s advice for small businesses on fake bills suggests looking up any company you don’t recognize before paying it.
- Set approval limits and watch for invoices clustered just below them. A second approver above a set amount is cheap insurance.
- Confirm receipt of goods or services with someone other than the buyer before paying.
- Review the vendor master file on a schedule. Deactivate vendors you have not paid in a year or more, and look at every change to bank details or addresses since the last review.
- Give staff a way to raise concerns without going through their manager. Tips are the most common way fraud comes to light.
What should you do if you suspect invoice fraud?
- Hold the payment if it has not gone out. Put the invoice or the vendor on hold through your normal process.
- Do not contact the vendor through the email address or phone number on the suspicious invoice, and do not tell the employee involved. Warning them gives them time to cover their tracks.
- Keep everything. Save the invoices, emails with full headers, vendor file history, approval records and payment records. Do not delete or forward the suspicious emails in ways that strip the headers.
- Escalate to the person your policy names, usually the controller, CFO, internal audit or legal counsel.
- If money has already gone out by wire or ACH, call your bank at once and ask it to recall the funds. The 2025 IC3 report stresses that speed matters once you discover a fraudulent transfer.
- In the US, report business email compromise to the FBI at ic3.gov, whatever the amount lost, with full transaction details. The FTC also takes reports at ReportFraud.ftc.gov.
- Once things settle, work out which control failed and fix it.
Warning signs specific to construction and property management
Some industries have their own patterns because of how they buy.
In construction, look closely at change orders that arrive after the work is done or without a signed approval, and at change orders that push a job just past its original budget. Compare progress billing against the actual percentage complete on site, since billing ahead of progress is common and easy to hide. Subcontractor invoices deserve the same vendor checks as any other supplier, including a sub you have never heard of on a job run by one project manager. Collect lien waivers with each payment and check that the waiver amount matches what you paid; a missing or mismatched waiver can mean the money never reached the sub.
In property management, the same maintenance vendor often works across many properties, and each site manager sees only their own invoices. Look at a vendor’s totals across the whole portfolio and compare what they charge for the same job at different sites. Match invoices to closed work orders, and spot check that the work was actually done. Watch for repeated emergency call-outs at one property, and for a vendor whose invoices stop when a particular manager leaves.
Where does software fit?
Software can help with the symptoms that show up in invoice data. OverpayAlert flags potential duplicate invoices and unusual price increases against a vendor’s history so someone on your team can review them. Some of those flags will overlap with the warning signs above, such as a resubmitted invoice or a price that crept up. It does not decide whether anything is fraud. That judgment, and the investigation, stay with your team and your controls.
If you want to see what it flags in your own invoices, you can start a 7-day free trial.