Article
What the Barbara Corcoran Invoice Scam Teaches AP Teams About Verification
A single misspelled email address nearly cost Barbara Corcoran's company $388,700. In 2020, a scammer impersonated her assistant, sent her bookkeeper a fake renovation invoice, and the bookkeeper wired the money before anyone checked the request through a channel the scammer did not control. The story resurfaced in 2026 coverage of the scam as a case study in business email compromise (BEC), and it is worth re-reading closely, because the failure mode it describes - an invoice approved inside a familiar thread with no independent check on the payee - is still the one costing businesses the most money today.
What happened in the Barbara Corcoran invoice scam?
Corcoran's bookkeeper received an email that looked like it came from Corcoran's real assistant. It asked her to pay a $388,700.11 invoice from a company called FFH Concept GmbH for a real estate renovation - a plausible request, since Corcoran regularly invests in property. Nothing about the email looked unusual. The bookkeeper replied to the thread with a few routine questions, got answers that matched what she expected, and wired the money to the account in the email, according to CNN's original reporting.
The scam only came apart when the bookkeeper separately emailed Corcoran's real assistant to confirm the payment had gone through. The real assistant had no idea what she was talking about. Only then did anyone notice that the sender's address was off by a single letter. Corcoran's bank was eventually able to intercept the transfer before it left Germany, and the money was recovered - but the near-miss happened because every check that was performed happened inside the compromised thread.
Why does this same-thread BEC pattern keep working on finance teams?
Because it exploits a request that looks ordinary, sent through a channel the recipient already trusts. The bookkeeper had no reason to be suspicious: the invoice matched Corcoran's real business activity, came from a name she recognized, and arrived in an existing conversation. That is the pattern behind most business email compromise, and it is expensive at scale. The FBI's 2025 Internet Crime Report recorded 24,768 BEC complaints and $3.05 billion in reported losses for the year, making BEC the second-costliest cybercrime category the FBI tracks, behind only investment fraud.
The reason same-thread verification fails so reliably is structural, not a lapse in judgment. Every signal the bookkeeper could check - the name, the tone, the invoice detail, the reply to her question - was generated or approved by the same attacker. Asking "does this look right?" inside the thread only tests whether the attacker is convincing, which they usually are once they have studied a real business relationship. It never tests whether the person on the other end is actually who they claim to be.
What is the one verification step that breaks this pattern?
Second-channel confirmation: before paying or changing payment details on any unfamiliar or high-value request, confirm it through a channel the attacker does not control - a phone call to a number already on file, not one provided in the email, or a direct message through a separate system. Corcoran's scam was only caught because her bookkeeper eventually did this, just after the money had already moved instead of before. Flip that order and the scam has nothing left to work with: a misspelled email address is easy to miss in a reply, almost impossible to miss on a phone call to a known number.
This single habit is cheap to build and does not require new software. It does require treating "the request came from someone I know" as a necessary condition for payment, not a sufficient one. How the fraud gate on a matched invoice can still get paid wrong is worth reading alongside this, since the same logic applies: an invoice can match everything on paper and still be fraudulent if the underlying request was never verified independently.
What should a $388,700 invoice trigger before anyone approves it?
Size and novelty should both raise the bar. A large invoice from a new or rarely-used vendor, a request to change bank details, or any payment tied to a request that arrived by email alone are all conditions that should trigger a stop before approval, not after a problem surfaces. The table below compares how much each common layer of invoice verification actually catches.
| Verification layer | What it catches | What it misses |
|---|---|---|
| Trusting the email thread | Obvious typos, blatantly wrong amounts | A convincing impersonation with no second channel involved - Corcoran's scam went undetected here |
| Second-channel confirmation (phone call to a known number) | Impersonated senders, spoofed or lookalike addresses, bank-detail changes | Invoices from a real, already-compromised vendor account |
| Matching against the purchase order only | Wrong quantities or amounts versus what was ordered | Anything with no PO at all - most services-firm invoices run on a contract or SOW instead, as this breakdown of three-way matching's limits covers |
| Matching against the whole agreement (contract, SOW, rate card) plus a payee check | Rate-card violations, scope creep, a payee or bank account that does not match what is on file for that vendor | Fraud that falsifies the underlying agreement itself, which is rare and usually caught by other controls |
No single layer is complete on its own. The point of stacking them is that an attacker who can fake an email thread usually cannot also fake a phone call to a number you already had, and cannot fake an agreement they never saw.
How does matching an invoice against the agreement on file catch this earlier?
Agreement-level matching checks an invoice against the contract, SOW, or rate card tied to that vendor - not just whether a PO number exists. In Corcoran's case there was no agreement on file for "FFH Concept GmbH" at all: it was a vendor nobody in the business had a prior contract with, for a project that had never been scoped in writing. A control that asks "do we have a signed agreement with this payee, and does this invoice match its terms" would have flagged the invoice as unverifiable before anyone picked up the phone.
That is also where most services-firm fraud hides today, separate from headline-grabbing BEC cases. AI-generated fake invoices are getting more convincing, and most of them share one weakness: they invent a vendor relationship, a rate, or a scope that does not exist in any agreement the business actually signed. A manual reviewer scanning a plausible-looking PDF can miss that. A check that reads the agreement first does not.
Bank-detail changes deserve their own flag regardless of the invoice amount. Most firms still do not catch this consistently - only 18% of firms continuously revalidate vendor bank details once a vendor is set up, which is exactly the gap a payee mismatch like Corcoran's would exploit if the invoice had come from an existing vendor instead of a brand-new one.
None of this is about replacing the person who approves payments - it is about absorbing the checking work before the business has to hire someone whose whole job is catching this manually. A human still approves every payment; the agreement check just means they are approving it with the right information in front of them, not a plausible story inside a thread.
The honest limits of automating this
Automated agreement matching earns its keep once a firm is processing enough invoices that manual second-channel checks on every unfamiliar vendor start to slip - broadly, invoice automation becomes cost-effective in the 100-200 invoices a month range, and a firm below that volume may do just as well with a strict manual policy and a controller who enforces it. The policy matters more than the tool at low volume. At higher volume, the risk is that the policy exists on paper but nobody has time to actually make the call.
The financial case for closing this gap is not abstract. Across 1,686 organizations, APQC's benchmarking data puts duplicate or erroneous payments at a median of 1.5% of total disbursements, with top performers down at 0.8% and bottom performers above 2%. Fraud specifically tends to surface through a tip rather than a routine check: the ACFE's Report to the Nations has consistently found tips are the single most common way occupational fraud gets detected, well ahead of internal audit or management review - a sign that routine review alone is not catching most of what is out there.
FAQ: questions AP teams are asking about this scam
What exactly happened in the Barbara Corcoran email scam?
A scammer impersonated Barbara Corcoran's assistant by email, using an address misspelled by one letter, and sent her bookkeeper a $388,700.11 fake invoice for a real estate renovation. The bookkeeper wired the money, and the scam was only caught when she separately emailed the real assistant to confirm the payment, per CNN's reporting.
Did Barbara Corcoran get her money back?
Yes. Her bank intercepted the wire before it left a German intermediary bank, and the funds were frozen and recovered, according to FinanceBuzz's account of the incident. Recovery after a fraudulent wire is not guaranteed and depends heavily on how fast it is reported.
What is second-channel confirmation, and why does it stop this kind of scam?
Second-channel confirmation means verifying a payment request through a channel the requester does not control, such as a phone call to a number already on file, instead of replying inside the same email thread. It works because an attacker who has compromised or spoofed an email account usually has no way to also control a phone line you already had on record.
How is business email compromise different from a typical phishing scam?
Business email compromise relies on impersonating a trusted person or vendor to request a legitimate-looking payment, rather than tricking someone into clicking a malicious link. It is the costliest cyber-enabled fraud category tracked by the FBI's IC3 after investment fraud, with $3.05 billion in reported 2025 losses.
Does matching an invoice against a purchase order catch this kind of fraud?
Not on its own. PO matching only checks that an invoice lines up with an order that already exists in the system - it says nothing about whether the vendor or request is legitimate, and most services firms do not issue a PO for every engagement at all. Checking the invoice against the signed agreement and verifying the payee through a second channel catches what PO-only matching misses.
At what invoice volume does automated verification make more sense than manual checks?
Automation economics generally improve once a firm is processing more than roughly 200 invoices a month; below that, a well-enforced manual policy - including a hard rule on second-channel confirmation - can work about as well. The policy is what matters at any volume; the tool mainly helps it hold up as volume grows.