Fake invoice scam is targeting small business owners this quarter
A wave of convincing fake vendor invoices is hitting accounts-payable inboxes. Here's the exact pattern, the senders to block, and what to check before you pay anything.
- Filed
- Jul 28, 2026
- Region
- United States, remote
- Filed By
- Dispatch Desk
- Read Time
- 6 min read
Over the last three weeks, more than forty small business owners have reported the same invoice scam landing in their accounts-payable inbox. It is polished enough that two accountants told us they nearly paid it before checking the routing number twice.
What the report describes
The email arrives from a domain that is one character off from a real, well-known supplier — a swapped letter, an extra hyphen, or .co instead of .com. It references a plausible order number and attaches a PDF invoice that looks identical to a legitimate one, right down to the logo and the layout.
The only real difference is the bank routing information at the bottom of the invoice, which has been quietly changed. In every report we've collected, the new account is at a different bank than the vendor's usual one.
"It looked exactly like our normal supplier invoice. Same font, same PO format. The only tell was the sort code didn't match what was already saved in our accounting software." — submitted by a reader in the logistics industry
Why it's working
- The sender domain is close enough to pass a quick glance
- The invoice amount matches a real, recent order — likely pulled from a prior data breach or a compromised email thread
- It's sent at month-end, when AP teams are processing a batch of invoices quickly
What to check before paying any invoice
- Call the vendor using a phone number from your own records, not the one on the invoice
- Compare the bank details against the last confirmed payment, not just the last invoice received
- Treat any "updated bank details" notice as suspicious until verified by phone
- Flag and hold any invoice where the sender domain doesn't exactly match previous correspondence
If you've already paid
Contact your bank's fraud department immediately — same-day reporting significantly improves the odds of a reversal. File a report with your local cybercrime unit and notify the vendor being impersonated so they can warn other customers.
We'll keep this report updated as more domains are identified.