How to Spot Fake Invoices: A Complete Guide

Fake invoices work because they ask for something ordinary: pay a bill. A fraudster either forges a vendor invoice from scratch or takes a genuine one and changes the bank details, then sends it with enough pressure that nobody stops to look twice. Many leave traces. The trick is knowing which layer to check.

This guide is the overview. It walks through the four layers of an invoice check in the order a finance team would apply them – what the invoice says, whether the vendor and bank details hold up, what the file itself shows, and what to do when something is off. Each layer links to a deeper article if you need one.

Why Invoice Fraud Is So Common

Invoices carry payment instructions, so a single altered document can redirect an entire payment to a criminal account. Once the transfer clears, recovery is often impossible. The average loss per incident runs to six figures, and the work needed to produce a convincing fake is small.

There are two common routes. In the first, the attacker invents a vendor or an order and sends a fabricated invoice, hoping it gets paid by routine. In the second, they intercept a real invoice, edit the payment details, and forward it. How criminals modify PDF invoices covers the second route in detail. The same approach shows up in altered contract PDFs, usually at much higher amounts.

The Four-Layer Check

No single check is enough. A forged invoice can look flawless, and a clean file can still come from the wrong sender. Work through the layers in order and escalate as soon as one of them fails.

Layer 1: Content and Visual Red Flags

Start with a careful read. It costs nothing and catches the low-effort fakes.

Compare Against Previous Invoices

Put the new invoice next to the last two or three from the same vendor. Look at layout, logo, fonts, number format, tax wording and how line items are described. A real vendor’s invoices look alike month after month. Differences in spacing, a slightly blurry block of text or a mix of fonts in one line are worth a second look, though a perfect-looking page proves nothing on its own.

Unusual Payment Details

Changed payment details are the most common edit in invoice fraud:

• A new bank account for a vendor you have paid before
• A personal account instead of a business account
• A different payment method than usual, such as a wire transfer from a vendor that always took ACH
• A different country for the receiving bank

Missing or Generic Business Information

Fabricated invoices often lack a full legal name, a tax ID, a street address or a working contact. A PO box alone and a free webmail address on a company invoice are weak signals, but they add up.

Language, Amounts and Urgency

Typos that were never in earlier invoices, an exact round figure with no line items, and pressure such as ‘pay today to avoid a penalty’ all point the same way. Urgency matters most: it exists to stop you doing layers 2 and 3.

Layer 2: Verify the Vendor and the Bank Details

This is the layer that stops the most losses, and it does not depend on the PDF at all.

1. Call the vendor on a number you already hold – from your records or their official website, never from the invoice or the email that delivered it.
2. Confirm the bank details out loud whenever they are new or changed. Treat every change-of-bank request as untrusted until a callback confirms it.
3. Match the invoice to a purchase order or contract your company actually issued. An invoice for something nobody ordered, or a second invoice for something already paid, needs review before anything else.
4. Check the invoice number and sender. Duplicate numbers with different payment details, unexpected gaps in a vendor’s sequence, and a sender domain that is one character off the real one are all red flags.
5. Keep a vendor record of verified bank details, changed only after a confirmed callback.

The 7-step pre-payment checklist turns this layer into a procedure your team can follow line by line.

Layer 3: The File-Level Check

Layers 1 and 2 test the content and the sender. They cannot tell you whether a real invoice was edited on its way to you, because a careful edit looks identical to the original on screen. That is what a file-level check is for.

A PDF often carries traces of how it was produced and whether it was changed afterwards. Upload the invoice to HTPBE? and you get one of three results:

• Intact – no evidence of modification was found
• Modified – the file shows signs of being changed after it was produced
• Inconclusive – the file does not carry enough information to decide either way

Read the result as evidence about the file, not about the vendor. A modified result on an invoice that should have come straight from an accounting system is a reason to stop and call the vendor. An intact result means no evidence of modification was found; it is not proof the file is untouched, and it says nothing about whether the sender is genuine, which is why layer 2 still applies. An inconclusive result is common for invoices exported from office or consumer software and is not a fraud signal – it simply means layer 2 carries the decision. For what the file records and why visual review misses it, see what PDF metadata reveals about fake invoices.

If invoices reach you at volume, run the same check at intake through the HTPBE? API instead of uploading by hand.

Layer 4: Escalation

Before Payment

1. Hold the payment. Legitimate vendors will wait while you confirm; fraudsters rely on you not doing so.
2. Report it internally to finance, fraud or compliance rather than handling it alone.
3. Preserve everything: the email with headers, the PDF, and any messages. Do not delete or forward the original.
4. Warn the real vendor. Their identity may be in use against their other customers.

After Payment

1. Call your bank immediately. The sooner you call, the better the chance of a recall.
2. File a report with the FBI’s IC3 (ic3.gov) in the United States, or the fraud reporting body in your country.
3. Keep the file-check report alongside the other evidence for your bank, the authorities or an insurance claim.

A Short Checklist

Before paying any invoice that is new, large or different from usual:

• Compared with the vendor’s previous invoices
• Bank details match the verified vendor record
• Any new or changed bank details confirmed by a callback to a known number
• Matched to a purchase order or contract
• Invoice number and sender checked
• PDF run through a file-level check
• Second approver signed off on high-value payments

A Worked Example

Consider a typical scenario. An accounts payable clerk receives an invoice from a regular office-supplies vendor, due in three days. It looks the same as last month’s, but the covering email says the company has moved banks and asks that this payment go to the new account.

Layer 1. The layout matches. The only difference is the bank account, and the email stresses the due date. That alone is enough to slow down.

Layer 2. The clerk does not reply to the email. They call the vendor on the number in their records. The vendor’s accounts team knows nothing about a bank change and has no record of sending this invoice.

Layer 3. Out of habit, the clerk also uploads the PDF to HTPBE?. It comes back as modified: the file shows signs of being edited after it was produced. Combined with the callback, the picture is clear.

Layer 4. The payment is held, the email and PDF are saved, finance and IT are told, and the vendor is warned that their invoices are being copied.

Either of layers 2 and 3 would have stopped the payment. Together they also explained what had happened. Skipping both would have sent the money to a stranger.

Prevention in Your Process

• Check every incoming invoice PDF at intake, and automate it once volume makes manual uploads impractical. See pricing for what that costs.
• Require dual authorisation for high-value payments: one person checks the file and bank details, another checks the order.
• Lock down bank-detail changes so they can only be made after a confirmed callback.
• Train accounts payable staff on current invoice fraud tactics, including how urgency is used against them.

If you want the full picture of how an invoice check fits a finance workflow, the fake invoice detection use case shows how HTPBE? is used in practice.

Conclusion

Spotting a fake invoice means testing four different things: how the invoice looks, whether the sender and bank account are real, whether the file was edited, and what you do when something fails. Fraudsters can beat any one of these. Few beat all four.

For depth on each layer, read how criminals modify PDF invoices, what the file itself records, and the pre-payment checklist.