Is itCheck something

Scam library

Fake invoices and changed payment details

An invoice or email says to pay a new account. The money goes to a scammer instead.

Social interactions today710
TrendRising
Last 14 days

How much people are talking about "fake invoice scam" online, measured by LunarCrush. Attention, not a count of victims.

What it looks like

Hi, please note our bank details have changed due to an audit. Please send this month's invoice payment to the new account below.
Closing update: Wire instructions for your down payment have changed. Please use the attached instructions and wire by 2pm today.
Invoice #44190 attached for services rendered. Payment is past due. Please remit by wire within 3 business days.

How it works

Scammers break into or copy the email of a vendor, title company, lawyer or coworker. They reply on a real thread with 'updated' bank details, or send a fake invoice that looks normal. Payments go to their account, often a large wire for a home closing or business bill, and are moved quickly.

Warning signs

  • A change in bank or wire details sent by email
  • Urgency right before a deadline, like a closing
  • A slightly different sender address or reply-to address
  • An invoice for something you did not order
  • A request not to call, or to keep it quiet
If you got one of these
  1. Call the vendor or title company using a number you already had, not one in the email.
  2. Confirm any bank detail change by phone before paying.
  3. For home purchases, confirm wire instructions in person or by a known phone number.
  4. Do not pay an invoice you cannot match to a real order.
If you already paid or shared something
  1. Call your bank right away and ask them to recall the wire. The first hours matter most.
  2. Report it at ic3.gov as soon as possible.
  3. Tell the real vendor or title company so they can secure their email.
  4. If it was a business payment, tell your finance team and save every email.

Who gets targeted

Home buyers, small businesses, office finance staff and anyone paying contractors.

Also read: My email got hacked. What do I do?

Got one? Paste it in