How do you spot a fake invoice or a payment-change email?

Ascent Vision · Published October 24, 2026

Be wary of any email that asks you to pay a new account, change bank details or rush a payment, even when it seems to come from a supplier or customer you know. The FBI's Internet Crime Complaint Center calls this business email compromise. Check every payment change by calling a number you already have, not one in the email. If money has already gone, contact your bank at once and file a complaint at ic3.gov.

What business email compromise is

The FBI's Internet Crime Complaint Center (IC3) describes business email compromise as "a sophisticated scam targeting both businesses and individuals performing a transfer of funds". It says the scam is frequently carried out by compromising legitimate business email accounts, through social engineering or computer intrusion. As general advice, that means a request can be fake even when it comes from an address you know. Its 2024 public service announcement says the scam targets everyone from small local businesses to larger corporations and has been reported in all 50 states.

It is a different trap from a fake domain renewal or a spam inquiry, which the related answers on fake domain renewal notices and on spam and scam inquiries cover.

Warning signs

A request to change bank details, or to pay a new account, even from a supplier you have paid for years.
A sender address close to, but not exactly, the one you know. IC3 advises checking that the sender's address matches who it claims to be from, especially on a phone.
Links with a small misspelling of the real company's web address, which IC3's announcement warns about.
A request for your login details or personal information by email, which IC3 advises never to send.
As general advice: pressure to pay today, a request to keep it quiet, or an invoice for work you do not recognize.

The call-back rule

Before paying any new account, call the supplier on a number you already had, from an earlier invoice or a contact you saved, never the number in the email. IC3's first tip is to use secondary channels or two-factor authentication to verify requests for changes in account information. Its announcement also advises a unique password for every online service you use.

As general advice, the same works in reverse: tell your customers how you take payment, that you will never change your bank details by email alone, and that they should call you on a number they already have if they ever get such a request.

If you already paid

Contact your bank as soon as you notice, to request a recall or reversal; IC3 also suggests asking for a Hold Harmless Letter or Letter of Indemnity. Its announcement says time is of the essence.
File a detailed complaint at ic3.gov, including the banking information. IC3's announcement says to file regardless of the amount lost, and that it may be able to help banks and law enforcement freeze funds.
As general advice, change your email password and turn on two-factor authentication, in case the request came through your own account.

Sources

Lead generation and lead tracking

A lead that waits a day goes cold, and a lead with no source teaches you nothing. Ascent Vision fixes both.

See the service Work with us