A legitimate-looking invoice can arrive at exactly the wrong moment: when goods are awaiting release, a shipment is delayed, or finance is trying to meet a payment deadline. That pressure is what makes invoice impersonation effective. Knowing how to detect invoice impersonation is not just an accounts-payable task. It is a control that protects cash flow, supplier continuity, and the company’s ability to make defensible payment decisions.
Invoice impersonation occurs when a fraudster poses as a real supplier, service provider, executive, or finance contact and sends payment instructions that appear credible. The fraudster may copy a genuine invoice, alter bank details, use a lookalike email domain, or intercept an existing email thread. The goal is simple: redirect a legitimate payment to an account controlled by the criminal.
For importers, traders, and procurement teams, the risk is particularly acute. A payment can be time-sensitive, cross-border, and large enough that a single transfer creates a material loss. The controls below help identify suspicious invoices before funds leave the business.
How to detect invoice impersonation before payment
The most reliable approach is to treat every unexpected payment change as unverified until it has been independently confirmed. A familiar supplier name, logo, invoice number, or email signature is not sufficient proof. Fraudsters can reproduce all of them.
Start by comparing the invoice against the approved supplier record, purchase order, contract, delivery documents, and prior invoices. Check the legal entity name, registered address, tax or business registration details, payment terms, currency, and beneficiary account. A mismatch does not automatically prove fraud, but it should stop routine processing until the discrepancy is explained and documented.
The highest-risk signal is a request to change bank account details. A supplier may legitimately move banks or open a new collection account, especially in international trade. However, a genuine operational change can withstand verification. A request that arrives suddenly, asks for secrecy, cites urgency, or directs payment to an account in a different country deserves immediate escalation.
Do not verify the change by replying to the message that requested it. Call a known contact using a phone number from your approved vendor master file, signed contract, official website, or a previously verified communication. If the supplier cannot be reached, pause payment. The commercial inconvenience of a short delay is usually far smaller than the cost of an irreversible transfer.
Examine the email, not just the invoice
Many invoice impersonation attacks begin with email spoofing or a compromised supplier mailbox. The message may look authentic at first glance because the sender’s display name is correct. What matters is the actual email address and the context around it.
Review the domain carefully. A fraudster may replace a letter, add a hyphen, use an extra word, or register a domain that looks nearly identical to the supplier’s real domain. For example, a message from `accounts@company-trading.com` may be fraudulent if the established supplier uses `accounts@companytrading.com`. On a mobile screen, that difference is easy to miss.
Other warning signs include a new contact who bypasses the usual account manager, unusual grammar in a previously polished correspondence, pressure to pay within hours, or a request to keep the change confidential. Be cautious with emails that refer to an ongoing order in precise terms. That knowledge may mean the fraudster accessed a mailbox or obtained documents through a prior data breach, not that the request is legitimate.
If the supplier’s message is part of an existing email thread, remain alert. Business email compromise can allow an attacker to reply within a real conversation. In that scenario, the thread history looks genuine because it is genuine. The new payment instruction is the item that needs independent confirmation.
Check the invoice for small inconsistencies
A copied invoice often contains clues that are visible only when someone compares it with original records. Look for changes in beneficiary name, bank country, SWIFT or routing information, tax identification numbers, invoice numbering patterns, addresses, and payment deadlines. Confirm that the goods or services billed were actually ordered, received, or contractually due.
For trade transactions, reconcile invoices with packing lists, bills of lading, inspection certificates, customs documents, and agreed Incoterms where applicable. An invoice may be real while the payment account is not. Document matching should therefore support, not replace, beneficiary verification.
Verify the supplier entity and the payment destination
Invoice checks are strongest when they sit within a broader supplier-verification process. Before approving a new counterparty or a high-value transaction, confirm that the business exists, is properly registered, and is operating under the name shown on the contract and invoice.
The depth of verification should reflect the size and risk of the payment. A low-value, repeat purchase from a long-established local vendor may require a lighter review than a first order with an unfamiliar overseas supplier. But even trusted vendors can have compromised email accounts, so bank-detail changes should always trigger the same independent callback procedure.
For unfamiliar or higher-risk counterparties, assess whether the company’s registration status, ownership, business address, directors, regulatory position, and market presence are consistent with the proposed transaction. A company may be legally registered yet still be a poor payment risk if its ownership is unclear, its claimed operations cannot be corroborated, or it has adverse regulatory or public-record indicators.
Beneficiary verification also matters. The account holder’s name should align with the contracted supplier or have a credible documented reason for being different, such as an approved group treasury entity. A request to pay an individual, a newly formed company, or an unrelated third party should not be accepted on an email explanation alone.
Build a payment control that works under pressure
Fraud prevention fails when it depends on one busy employee noticing every anomaly. The better solution is a clear process that makes verification routine, especially when deadlines are tight.
Separate the person who sets up or changes vendor bank details from the person who approves payment. Require a second reviewer for changes to beneficiary information, first payments to new vendors, and transfers above a defined threshold. The reviewer should have access to the underlying purchase order, supplier record, and evidence of independent confirmation.
Maintain a controlled vendor master file with verified legal names, contact details, bank information, and records of who approved each change. Do not allow payment instructions stored in a single email inbox or messaging app to become the source of truth. If a supplier requests a change, record the date, the individual who verified it, the phone number used, and the supporting documentation.
For high-risk payments, use a callback with a known authorized contact and a separate confirmation from finance or procurement. It may feel repetitive, but repetition is the point. Fraudsters rely on an employee assuming that someone else has already checked the details.
Train staff beyond finance. Sales, operations, logistics, and procurement employees often receive supplier messages first and may forward them internally with an assumption of legitimacy. They need to recognize that urgency, account changes, and altered contact details are risk events, not routine administrative updates.
What to do when an invoice looks suspicious
Do not send the payment while the issue is unresolved. Preserve the invoice, email headers, attachments, and any related communications. Notify the finance lead, procurement owner, and relevant manager promptly so that no one processes the transfer through another route.
Contact the supplier using independently verified details and ask whether it issued the invoice and requested the stated payment instructions. If payment has already been sent, contact your bank immediately. Fast action may improve the chance of recalling, freezing, or tracing funds, although recovery is never guaranteed. Your organization should also review whether supplier email accounts, internal mailboxes, or vendor records may have been compromised.
A suspicious invoice can expose a weakness beyond one payment. It may show that vendor data is outdated, approval limits are unclear, or employees lack a reliable verification path. Addressing that weakness is part of the response.
Due diligence reduces the room for impersonation
Invoice fraud is easier when a business does not have a verified picture of who it is dealing with. Informal referrals, polished websites, and a history of routine correspondence can create false confidence. Before significant funds, contracts, or strategic commitments are involved, independent due diligence helps establish the facts that payment teams need: the company’s identity, registration status, ownership, regulatory exposure, and credible operating footprint.
SDDCheck supports this discipline with source-cited company and risk reviews designed to turn fragmented information into practical decisions. The objective is not to slow down legitimate trade. It is to ensure that urgency does not replace verification.
A supplier that is genuine will understand why you must confirm payment changes through a known channel. Make that expectation clear before the next invoice arrives, when there is still time to verify rather than react.