Google and Facebook each paid hundreds of thousands of dollars to a fraudster who simply sent them invoices impersonating a real hardware supplier they already worked with. The invoices looked legitimate. The vendor name was familiar. And because no one verified the bank details independently, the payments went through.

That story is extreme, but the mechanism is not unusual. According to the Association for Financial Professionals' 2025 Fraud and Control Survey, 79% of organizations experienced payments fraud attacks or attempts in 2024. Business email compromise (BEC) was cited by 63% of respondents as the number one avenue for fraud attempts, with vendor impersonation being the most frequent type.

Invoice fraud does not require sophisticated malware or a data breach. It exploits the way accounts payable teams work: fast, trusting, and mostly through email. This guide covers the most common types, the red flags that are easiest to miss, and the controls that reliably stop them.

What invoice fraud actually costs businesses

The financial impact of invoice fraud has grown substantially. The FBI's Internet Crime Complaint Center (IC3) recorded close to $2.8 billion in BEC-related losses in 2024 alone, with over $8.5 billion in total BEC losses reported across the previous three years. These are only the cases that were reported.

For smaller businesses, the per-incident impact can be existential. A demolition company with fewer than 50 employees had its email compromised and ended up sending a $56,000 payment to a fraudulent account. They had no cyber insurance, so the loss was split between them and the vendor.

Beyond deliberate fraud, duplicate invoices compound the problem. Research by AP automation provider OpenEnvoy found that 8.5% of invoices companies receive are duplicates, after reviewing $500 million in customer invoices over 12 months. That figure is consistent with broader industry data: between 0.8% and 2% of total annual disbursements end up as duplicate or erroneous payments, even at well-run companies. At scale, this adds up fast.

BEC attacks rose 15% in 2025. LevelBlue SpiderLabs tracked a 15% increase in business email compromise attacks in 2025 versus 2024, intercepting over 3,000 BEC messages per month on average. AI-generated emails are now nearly indistinguishable from genuine business correspondence, making human detection alone an unreliable defense.

The five most common types of invoice fraud

1. Fake vendor invoices

An attacker creates an invoice that looks like it comes from a real vendor the business already works with. The company name, logo, and contact details are copied. The only difference is the bank account number. Because the vendor is familiar, AP processes the payment without independently verifying the account details.

2. Business email compromise (BEC) with invoice redirect

In a BEC attack, an attacker either spoofs or actually compromises a vendor's email account. They monitor real payment conversations, then insert themselves at the right moment: 'Please note we have updated our banking details. Please use the new account for your next payment.' Because the email comes from a known address and references real transactions, it passes most checks.

Vendor email compromise (VEC), where a supplier's actual email account is breached rather than spoofed, saw a 137% increase in 2023 according to Hoxhunt's research, and continued growing through 2024 and 2025. These attacks are particularly hard to detect because the email is genuinely from the supplier's domain.

3. Duplicate invoice submissions

Vendors sometimes resubmit invoices when payment is delayed. Without automated duplicate detection, both versions can get processed and paid. This is often not deliberate fraud on the vendor's part, but the financial result for your business is the same: double payment for a single service. Recovering overpayments from vendors can take weeks and strains the relationship.

4. Ghost vendor fraud

A fraudster, sometimes an internal actor, creates a fictional vendor in the AP system and submits invoices for services that were never delivered. Without proper vendor onboarding controls and invoice matching, these payments can continue for months before anyone notices an anomaly.

5. Inflated invoice fraud

A real vendor submits invoices for amounts higher than agreed, or for quantities that do not match purchase orders. In high-volume AP environments where invoices are processed quickly without line-item verification, these discrepancies rarely get caught at the time of payment.

Red flags that are easy to miss in a busy AP inbox

Most invoice fraud succeeds not because the signs were invisible, but because no one was looking for them at the right time. Here are the signals worth checking on every invoice from a new vendor and periodically on existing ones:

Bank account changes requested by email. Any request to update payment details should trigger a phone verification call to a number you already have on file, not the one in the email. This is the single most reliable defense against BEC redirect fraud.

Slight variations in vendor email addresses. Attackers often register domains that look almost identical to the real vendor's domain, using character substitutions or extra words. vendor@acme-corp.com and vendor@acmecorp.co are different addresses.

Round number amounts with no line items. Legitimate supplier invoices almost always have line items. An invoice for exactly $5,000.00 with no breakdown is a red flag, especially from a vendor you have not paid before.

Urgency language. Phrases like 'payment overdue', 'final notice', or 'account will be suspended' are designed to bypass normal review steps. Urgency is a social engineering tactic, not a reason to skip verification.

Invoice numbers that do not match prior sequences. If vendor A has been invoicing you with numbers in the 1000-1100 range and suddenly sends invoice #87, that is worth a call before payment.

New vendor, first invoice, large amount. The combination of no payment history and a high invoice value deserves extra scrutiny. Ghost vendor fraud and fake invoice schemes often start with a single large payment to establish a pattern.

The controls that reliably stop invoice fraud

Training alone is not enough. BEC emails in 2025 are AI-generated and nearly indistinguishable from legitimate correspondence. The defenses that work are structural, not awareness-based.

Segregation of duties in AP

No single person should be able to create a vendor, approve an invoice, and authorize payment. Separating these functions means that fraud or error at any one step requires either collusion or a control failure at another step to result in a payment. This is the most basic and most effective AP fraud control.

Automated duplicate detection

Manual review cannot reliably catch duplicate invoices at volume. Automated systems flag invoices with matching vendor names, amounts, and dates before they are processed. The duplicate invoice detection guide covers how automated detection works and what to look for when evaluating tools.

Vendor banking detail verification policy

Write a policy that no payment account changes are processed based on an email request alone. Every banking detail update requires a callback to a verified number from your vendor master file. This one control stops the most common BEC redirect tactic entirely.

Approval thresholds and two-person authorization

Set a payment threshold above which two approvers are required. What the threshold is depends on your business, but having it means that a single compromised account cannot authorize a large fraudulent payment without a second person's sign-off.

Structured invoice capture instead of email attachments

One of the structural vulnerabilities in email-based invoice processing is that there is no system between the email arriving and the AP team acting on it. When invoices are captured automatically through a tool that extracts structured data, every invoice goes through the same extraction and validation process. Anomalies, such as new banking details, unusual amounts, or first-time vendors, can be flagged automatically rather than depending on someone noticing them manually.

This is part of what Gennai handles. Beyond extraction, the system maintains an audit trail for every invoice: when it arrived, what was extracted, and what was exported to your accounting platform. That trail is useful for investigating suspected fraud and for demonstrating controls to auditors. The invoice data security guide covers the full security framework worth having in place.

What good controls look like in practice. The AFP's 2025 survey found that 22% of organizations recovered 75% or more of fraud losses in 2024. That means 78% did not. Early detection is the difference: once a fraudulent payment has cleared and the funds have moved, recovery is rare. The controls worth investing in are the ones that catch fraud before payment, not after.

If you suspect a fraudulent payment has already been made

Act immediately. Contact your bank and request a wire recall or payment reversal as soon as possible. The FBI's IC3 recommends contacting your financial institution within 72 hours of a suspected fraudulent transfer, as recovery rates drop sharply after that window.

File a report with the IC3 at ic3.gov. In the US, this also triggers the Financial Fraud Kill Chain, a coordination mechanism between the FBI and financial institutions designed to freeze and recover funds from international wire transfers.

Preserve all related emails, invoice documents, and communication records. Do not delete or modify anything. If an email account was compromised, reset credentials and check for mail forwarding rules set up by the attacker, a common way to maintain access after a breach is detected.

Invoice fraud is a process problem as much as a security problem

The businesses that get hit repeatedly tend to have the same gaps: no segregation of duties in AP, payment changes processed based on email alone, and invoice volumes too high for manual review to be reliable. Fixing those three things removes most of the attack surface.

Automation helps because it removes the human discretion that fraud exploits. When every invoice goes through the same structured extraction, duplicate check, and validation step before anyone sees it, the attack surface shrinks considerably. If you want to see how Gennai handles invoice capture and validation, the product walkthrough covers the full workflow.

References

Association for Financial Professionals. 2025 AFP Payments Fraud and Control Survey Report. financialprofessionals.org
FBI Internet Crime Complaint Center (IC3). 2024 Annual Report. ic3.gov
Nacha. FBI's IC3 Finds Almost $8.5 Billion Lost to Business Email Compromise in Last Three Years. nacha.org (2025)
LevelBlue SpiderLabs. BEC Email Trends: Attacks Up 15% in 2025. levelblue.com (January 2026)
Hoxhunt. Business Email Compromise Statistics 2026. hoxhunt.com (January 2026)
OpenEnvoy (cited by Resourceful Finance Pro). Nearly 1 in 10 Invoices Are Double-Paid. resourcefulfinancepro.com
HighRadius. How to Avoid Duplicate Payments in Accounts Payable. highradius.com (2025)
Eftsure. 20 Business Email Compromise Statistics 2025. eftsure.com
Connecting Point. Email Scams Are Targeting More Companies. cpcolorado.com (March 2026)

TL;DR

79% of organizations experienced payments fraud in 2024 — BEC and vendor impersonation are the top attack vectors
The five most common types: fake vendor invoices, BEC with invoice redirect, duplicate submissions, ghost vendors, and inflated invoices
Red flags to watch: bank detail change requests by email, slight domain variations, round-number invoices with no line items, urgency language, and out-of-sequence invoice numbers
The defenses that work are structural, not awareness-based: segregation of duties, automated duplicate detection, banking verification policies, approval thresholds, and structured invoice capture
If a fraudulent payment has been made, contact your bank within 72 hours and file a report with ic3.gov to trigger the Financial Fraud Kill Chain
Invoice fraud is a process problem — fixing AP controls and automating invoice capture removes most of the attack surface

Invoice Fraud: How to Detect and Prevent Fake Invoices in 2026