The Real Cost of Invoice Fraud for Finance Teams

A fraudulent invoice that gets paid is never just the amount on the invoice. The transfer is the visible part. Behind it sit weeks of recovery work, a vendor who is still owed money, an audit question about why the control failed, and an insurer who wants to know what was in place. This article puts numbers on each of those layers so a finance lead can compare them with the cost of a pre-payment check.

It is the business-case companion to the rest of the invoice series. The complete guide to spotting fake invoices covers red flags and process, invoice fraud: how criminals modify PDFs covers the attack itself, what PDF metadata reveals covers the file-level evidence, and the pre-payment checklist covers the steps. Here the question is only: what does this cost, and what does a control cost against it?

What the public data says

Three named sources give the scale. Each is a reported figure, so treat it as a floor rather than a census.

• FBI IC3, 2025 Internet Crime Report (published April 2026). Business email compromise (BEC) – the category that includes redirected invoice payments – accounted for about $3.05 billion in reported losses across 24,768 complaints. Dividing one by the other gives an average of about $123,000 per reported complaint (our arithmetic, not an IC3 headline figure). Source: IC3 2025 Internet Crime Report.
• AFP Payments Fraud and Control Survey (published April 2026, 465 treasury practitioners). 76% of US organizations experienced attempted or actual payments fraud in 2025, and 74% were affected by BEC. Financial losses were reported by 48% of organizations with revenue under $1 billion and 66% of those above it. Source: AFP press release.
• ACFE Occupational Fraud 2024: A Report to the Nations. Billing schemes – fraud carried out through fake or manipulated invoices, usually by insiders, sometimes colluding with vendors – made up 22% of asset misappropriation cases, with a median loss of $100,000. This is a different fraud population from external BEC, but it shows the same invoice-shaped hole in the process. Source: ACFE Report to the Nations 2024.

Two cautions. The IC3 average is a mean, and a few very large cases pull it up; many incidents are smaller and some are much larger. And the figures cover all BEC, not only edited PDF invoices, so they bound the problem rather than measure it for any one company.

The four cost layers

1. Direct loss

The amount transferred to the wrong account. This is the number everyone quotes, and it is also the one you can sometimes reduce. IC3’s Recovery Asset Team reported freezing $679 million of more than $1.1 billion in attempted thefts it acted on in 2025, a 58% rate as reported (see the IC3 report and its Financial Fraud Kill Chain brochure). That figure covers cases where a victim bank and IC3 acted quickly on domestic transfers across fraud types, not BEC alone and not every victim, so it says what is possible with fast reporting, not what to expect. Delay, international routing and funds already moved on all lower the odds.

Also remember that the real vendor still has an unpaid invoice. Unless the money comes back, the company pays twice, and the second payment is a cash cost the first loss does not show.

2. Recovery effort

Even a recovered case consumes time: calling the bank, filing with IC3, assembling the invoice, email headers and payment records, answering law enforcement, reconciling the ledger, and handling the vendor relationship. This is staff time with a real hourly cost, and it falls on the people who are already busiest at month-end.

3. Review time

There are two review costs, and finance teams tend to see only one. After an incident, every recent change to vendor bank details gets re-examined. Before an incident, the cost of preventing it is also review time: callbacks, second approvals, and handling the invoices a control flags. Both are measurable in hours, which is why the worked example below counts them.

4. Audit and insurance consequences

A control failure over payments is an audit finding in its own right: auditors will ask what the control was, why it did not operate, and what changed. For insured companies, cyber and crime policies commonly carry retentions, sublimits, and conditions about the controls the insured had in place, and a claim may be contested if a required verification step was skipped. Read your own policy wording for this; terms vary widely and we are not citing a figure here. Treat insurance as a way to transfer part of the loss, not as proof the control exists.

A worked example: cost versus control

The numbers below are illustrative assumptions, not statistics and not customer data. Replace them with your own.

Assumed company: 300 vendor invoice PDFs a month, a $60 loaded hourly cost for AP staff.

One successful incident (illustrative):

Annual cost of a pre-payment check (illustrative):

Prices are the published HTPBE? prices at the time of writing; see pricing for current ones. Teams with lower volume can use pay-per-check credits instead, and the API lets the check run automatically when an invoice arrives.

Break-even. $3,588 divided by $135,600 is about 2.6%. If the control prevents a loss of this size more often than roughly once in 38 years, it has paid for itself. Put differently: it only has to stop one incident in a few decades, or a much smaller incident sooner. A $20,000 loss avoided once every five years also covers it.

How to read the break-even. The $123,000 anchor is the upper reference: an average over all reported BEC, not over attacks carried out through an edited invoice file, and it is pulled up by large cases. A file-integrity check only prevents the share of incidents that run through a changed file, so count your own exposure: your typical payment size, and how many of your vendor payments are made against emailed PDFs. The $20,000 line above is the more conservative reading; if your largest regular payments are smaller still, use that figure.

What the example does not claim. A file-integrity check addresses one route: an invoice file that was changed after the vendor issued it. It does not catch an invoice a criminal created from scratch, a request to change bank details sent by email with no attachment, or a vendor whose own accounts are compromised and who issues a genuine file with the wrong details. It also does not replace a callback. That is why the cost of the control above includes callback time, and why it is one layer in the process rather than the whole process.

Where the check sits in an AP process

The control has to run before payment approval and has to produce a decision the approver cannot skip:

1. Invoice PDF arrives and is matched to the purchase order and vendor master as usual.
2. The PDF is checked for modification, in the web interface or through the API at intake. The fake invoice detection use case and the accounts payable page describe the workflow.
3. An intact result continues to normal approval. A modified or inconclusive result routes the invoice to a callback to the vendor on the number in your vendor master, never the number on the invoice.
4. Payment above your high-value threshold needs the callback regardless of the result.

A modified result is evidence that the file changed, not proof of fraud: vendors do sometimes revise a PDF legitimately. It tells the approver where to spend the fifteen minutes. New accounts can start with 5 free checks, enough to run your last few suspicious invoices and see how the process feels before committing.

What to do with this

Take the example table, replace the assumptions with your invoice volume, hourly cost, audit fees and policy retention, and compare the two totals. If the break-even probability comes out in the low single digits, the question is no longer whether a check is affordable but why the process lacks one. For the process steps themselves, start with the complete guide and the pre-payment checklist.