Invoice fraud succeeds by hiding inside a process built for speed. Accounts payable exists to pay legitimate invoices quickly; attackers craft documents that look exactly like the invoices you expect — often because they know, from a compromised mailbox or a talkative supplier, precisely what you're expecting. For how VerifyTheCall enforces this, see Invoice Fraud Prevention.
Six red flags in fraudulent invoices
- Changed bank details on an otherwise familiar invoice — the single most common pattern.
- Lookalike sender domains (supplier-inc.com vs supplierinc.com) or reply-to mismatches.
- Urgency framing — overdue notices, threats of service suspension, discount-for-immediate-payment.
- Round or just-below-threshold amounts sized to avoid extra approval.
- Subtle detail drift — new VAT number, changed remittance address, altered payment terms.
- A confirming phone call. Increasingly, a vishing call "from the supplier" precedes or follows the invoice to legitimize it — sometimes with a cloned voice of a real contact.
Detection methods compared
| Method | Catches | Misses |
|---|---|---|
| Manual 3-way match (PO / receipt / invoice) | Phantom goods, quantity inflation | Bank-detail changes on legitimate invoices |
| Email security filters | Lookalike domains, known-bad senders | Compromised real supplier mailboxes |
| Bank account verification services | Payee-name/account mismatches | Mule accounts opened in the supplier's name |
| Callback verification of changes | Nearly all detail-change fraud | Only fails if the callback number itself came from the attacker |
Why sub-threshold invoices slip through
The same economics as wire fraud: controls concentrate above an approval threshold, so attackers submit many small invoices rather than one large one. Recurring low-value invoices from an established vendor record get the least scrutiny of anything in AP — and losses surface only at quarterly or annual reconciliation.
Building the verification protocol
The durable fix is procedural: any change to payment details, from any channel, triggers a callback to the contact number already in your vendor master — not the number on the invoice. Enforce it by holding affected payments until the callback is logged, and measure compliance monthly. Detection tools narrow attention; the protocol provides the guarantee.