Article
What Is Invoice Fraud? Types, Warning Signs, and How to Prevent It
Invoice fraud is any scheme that tricks a business into paying for goods, services, or amounts it does not actually owe, whether the invoice is entirely fake, altered, or real but padded. It shows up as a bill from a vendor who does not exist, a changed bank account on a real supplier's invoice, or a legitimate contractor invoice quietly billing above the agreed rate.
Most AP teams think of fraud as rare and dramatic. In practice it is common and quiet. The Association of Certified Fraud Examiners (ACFE) has found for years that organizations lose a median of 5% of annual revenue to occupational fraud, and asset misappropriation, the category that covers invoice and billing schemes, accounts for roughly 85% of all fraud cases the ACFE studies, even though it causes the smallest median loss per case of the three fraud categories the ACFE tracks (corruption and financial statement fraud run higher per incident). Invoice fraud wins on volume, not on any single big number.
What Counts as Invoice Fraud?
Invoice fraud covers three overlapping situations: a completely fabricated invoice from a vendor that does not exist, a real invoice that has been altered (a changed bank account, an inflated amount, a different payee), and a legitimate invoice that overbills against the actual agreement, such as a contractor billing more hours than the statement of work allows or a rate that does not match the signed rate card. The first two are outright fraud committed by an outsider. The third can be committed by a real, ongoing vendor who is simply padding what they bill, which is why it is harder for a busy AP reviewer to catch: nothing about the vendor relationship looks unusual.
What Are the Most Common Types of Invoice Fraud?
A handful of tactics show up again and again in services firms that pay subcontractors, agencies, and consultants on MSAs, SOWs, and T&M terms.
| Tactic | How it works | Red flag |
|---|---|---|
| Fake vendor / shell company | Fraudster sets up a vendor record and submits invoices for work never done. | New vendor, no onboarding paperwork, generic invoice template. |
| Changed bank details | Fraudster impersonates a real vendor by email and asks AP to update payment details before the next invoice. | Bank-change request arrives by email only, with urgency, near a payment date. |
| Look-alike / duplicate invoice | Same invoice resubmitted with a slightly different number or date, hoping it slips through as new. | Same amount, same PO, or same line items as one already paid. |
| Rate-card or scope-creep overbilling | A real vendor bills at a higher rate than the contract, or for hours or deliverables outside the SOW. | Rate or hours doesn't reconcile against the signed agreement, not just the PO. |
| Threshold parking | An invoice is priced just under the dollar amount that would trigger a second approver. | Amount sits suspiciously close to (but under) an approval limit. |
| Business email compromise (BEC) | Fraudster impersonates an executive or vendor contact by email to push through an urgent, off-process payment. | Urgency, pressure to bypass normal approval, request to keep it quiet. |
The FBI's Internet Crime Complaint Center (IC3) has ranked Business Email Compromise among the costliest categories of internet crime it tracks for several years running, and BEC scams routinely use exactly the fake-invoice and changed-bank-detail tactics above. The U.S. Postal Inspection Service documents a related pattern it calls the false invoice scam: a business receives an invoice for goods or services it never ordered, and the scam works only if someone pays it without checking.
Why Does Invoice Fraud Slip Past Normal AP Review?
Most invoice fraud is not stopped by a careful read of the invoice itself. It is stopped by checking the invoice against something outside it: a purchase order, a contract, a rate card. A three-way match (invoice, PO, and receiving record) catches a fake invoice with no matching PO. It does not catch a real vendor billing above their contracted rate, because the PO amount and the invoice amount can match perfectly while the underlying rate is wrong. That gap is exactly where rate-card violations and scope creep live, and it is why firms that pay mostly on MSAs and SOWs, with few or no POs, are especially exposed. Our full breakdown of common invoice matching errors covers this gap in more detail.
A real incident makes the pattern concrete. Our account of a $67,000 fake invoice scam walks through exactly how a well-run AP process still let a fraudulent invoice through, and what changed afterward.
What Are the Warning Signs of a Fraudulent Invoice?
A handful of signals should stop any invoice for a second look, whether it comes from a brand-new vendor or one you have paid for years:
- A request to change bank or payment details, especially by email only, with no phone confirmation.
- An invoice amount that lands just under an approval threshold.
- Hours, rates, or deliverables that do not match the signed SOW or rate card, even if the PO total matches.
- An invoice number or amount that closely resembles one already paid.
- Pressure to process a payment outside the normal approval sequence, often with urgency or a request for confidentiality.
- A vendor with no onboarding record, no W-9 or equivalent on file, or a mismatched company name and bank name.
How Can a Services Firm Prevent Invoice Fraud?
Prevention is layered, not a single tool. The controls that matter most for a contract-governed services firm are:
- Verify vendor changes out of band. Any bank-detail change request gets confirmed by phone, using a number already on file, never the number in the email asking for the change.
- Segregate duties. The person who approves an invoice should not be the same person who releases the payment. This is a long-standing internal control principle covered repeatedly in AICPA-affiliated accounting guidance, and it remains one of the simplest, cheapest fraud controls a firm can put in place.
- Match against the whole agreement, not just the PO. Checking an invoice against the contract, SOW, and rate card catches rate-card violations and scope creep that PO-only matching misses. Our guide to implementing invoice matching walks through how to set this up.
- Track duplicates and near-duplicates automatically. Manual review is good at catching an obviously wrong invoice and bad at catching one that looks almost identical to one already paid.
- Keep a complete, exportable audit trail. When a dispute or an auditor's question comes up, being able to show exactly what was checked and approved, and why, closes the conversation quickly.
Should You Hire Someone or Automate Fraud Detection?
This is the honest tradeoff, and it depends on volume. Below roughly 200 invoices a month, the return on automation is weak: a careful bookkeeper or the owner doing a Friday review, with the controls above in place, catches most of what matters, and the software cost is hard to justify against that volume. Above that volume, manual review becomes the actual fraud risk, because reviewers start skimming, and skimming is exactly the moment a padded invoice or a changed bank account gets through. The right frame is to absorb the extra review work before adding another hire, not to plan on replacing whoever already does your AP. A person still approves every payment; the question is whether that person is spending their week on data entry and rechecking or on the invoices that actually need judgment. Our piece on measuring AP leakage walks through how to size this before deciding either way.
FAQ
Is invoice fraud a crime? Yes. Invoice fraud is a form of financial fraud and, depending on the method (mail, wire, or email), can be prosecuted under mail fraud, wire fraud, or related statutes. The U.S. Postal Inspection Service and FBI both investigate invoice-fraud schemes that use the mail or interstate wires.
Can invoice fraud happen even when there is a purchase order? Yes. A three-way match confirms the invoice matches a PO and a receipt, but it does not confirm the underlying rate or scope is correct. A vendor can bill the exact PO amount while still violating the contracted rate card or expanding scope beyond the signed SOW, which is why agreement-level checks catch fraud that PO-only matching misses.
What is the difference between invoice fraud and a duplicate payment? Invoice fraud is an intentional attempt to get paid for something not owed. A duplicate payment is usually an error, the same legitimate invoice getting paid twice, though a fraudster can also deliberately resubmit a near-identical invoice hoping it passes as a duplicate error rather than a scam.
What should an AP team do after finding a fraudulent invoice? Stop any pending payment immediately, notify the bank if a payment already went out, preserve the invoice and any related emails as evidence, and report it. The FBI's Internet Crime Complaint Center accepts reports for wire-based and email-based fraud, and the U.S. Postal Inspection Service accepts reports where mail was used.
Does segregation of duties alone stop invoice fraud? No single control stops it alone. Segregation of duties reduces the risk that one person can both create and approve a fraudulent payment, but it needs to be paired with vendor-change verification and matching against the actual agreement to catch the tactics that don't rely on an insider.