ProofRelayIs this invoice a scam? Seven checks before you pay
If an invoice has landed that doesn't feel right, your instinct is worth taking seriously. Invoice and payment-redirection fraud works precisely because the documents look correct — the logo is right, the reference numbers match, the amount is what you expected. The only thing that is wrong is where the money goes.
Here is what you can check yourself, in roughly the order that is worth doing it, and — just as importantly — what none of these checks can tell you.
1. Has anything about the payment details changed?
This is the single most important question, and it outranks everything else on this page. The overwhelming majority of losses come from a payment that went to a new or altered account.
Compare the bank details against what you paid last time — from your own accounting records, not from the new document. If the account has changed, treat the request as fraudulent until a phone call proves otherwise. Genuine suppliers change bank accounts occasionally; they are also entirely willing to confirm it by phone.
A changed bank account is not a small administrative detail. It is the entire scam, and everything else on the invoice will look perfect.
2. Check the sender's domain character by character
Attackers register domains that read correctly at a glance. The common tricks are an 'rn' where the real domain has an 'm', a zero standing in for the letter O, an inserted or removed hyphen, or the same company name under a different ending — .net or .co instead of .com.au.
Read the domain slowly, one character at a time, against a known-good address from an old email. Your eye will skip the substitution at normal reading speed; that is exactly what it is designed to do.
3. Look at where a reply would actually go
An email can display one address in the From line and quietly send replies somewhere else entirely. If you hit Reply, your answer — and any bank details you confirm in it — goes to the second address.
In most mail clients you can see this by expanding the message header details, or by starting a reply and looking at the address that gets filled in before you type anything. If it does not match the sender, stop.
4. Is the contact address a free mailbox?
A business that invoices you normally writes from its own domain. An invoice carrying bank details and a Gmail, Hotmail or Outlook.com reply address is one of the strongest signals there is, because it costs an attacker nothing — there is no domain to register and nothing to buy.
This is not proof on its own. Some very small operators genuinely do use a personal address. It is, however, more than enough reason to make the phone call before paying.
5. Check the ABN properly
An Australian Business Number has a checksum built into it, so a fabricated number usually fails a basic arithmetic test. A number that passes the checksum is real, but that only means it belongs to someone — not necessarily to the business on the invoice.
Look the ABN up on the ABN Lookup register and confirm the registered entity name matches the supplier you think you are paying. A mismatch between the trading name on the invoice and the registered name is worth a question; a cancelled ABN is worth a stop.
6. Read the invoice for pressure
Fraudulent payment requests are built to compress the time you spend thinking. Three ingredients show up again and again, and the combination matters more than any one of them:
- Urgency — the payment is suddenly overdue, a penalty applies, the deadline is today.
- Secrecy — the matter is confidential, or shouldn't be discussed outside the accounts team.
- Procedure bypass — don't call the usual number, the lines are down, use this number only.
Urgency, secrecy and 'don't call us' appearing together in one message is close to a signature. A real supplier chasing a real invoice has no reason to discourage you from ringing them.
7. Does the account country make sense?
If the invoice asks you to pay an overseas account for a supplier you have always paid domestically, that alone justifies stopping. Money sent across borders is far harder to recall, and attackers know it.
For international payments, an IBAN has check digits that catch a mistyped or fabricated number, and the country embedded in a SWIFT/BIC code should agree with the country in the IBAN. A mismatch between the two is a sign the details have been tampered with.
What none of these checks can tell you
Every check above is structural. They test whether the document is internally consistent and whether it resembles known fraud. None of them can tell you whether the bank account belongs to your supplier.
That matters because the most damaging version of this fraud does not involve a fake domain at all. A criminal breaks into your supplier's real mailbox, watches the thread, and replies from the genuine address with the genuine invoice template and the genuine history — changing only the account number. Every check on this page passes. The document is real. The supplier is real. The account is not.
There is exactly one thing that catches that, and it is not a piece of software.
Call the supplier on a number you already had — from an earlier invoice, their website that you navigated to yourself, or your own records. Never a number written in the email or invoice you are checking. The person who wrote that document chose that number.
What to say when you call
Keep it short and do not read the new details out first — ask them to tell you.
“I've received an email asking us to pay invoice [number] to a different bank account. I'm calling on the number I already had on file rather than the one in the email. Can you confirm the BSB and account number you want us to pay to?”
If the numbers they give you don't match the document, or they say they didn't send it: do not pay, keep the email, and tell your bank straight away. Then tell the supplier, because their mailbox may be the one that has been broken into and you will not be the only customer they emailed.
Common questions
Can any tool tell me an invoice is definitely safe?
No, and you should distrust one that claims to. A criminal with access to your supplier's real mailbox sends a genuine-looking invoice from the genuine address; the only wrong detail is the bank account, and no analysis of the document can detect that. Confirmation has to come from outside the document — a phone call to a number you already held.
The invoice is from a supplier we've paid for years. Is it still worth checking?
Yes, particularly if the bank details have changed. Long-standing suppliers are the preferred target precisely because the payment looks routine and the relationship discourages you from questioning it.
How quickly do I need to act if I've already paid?
Immediately. Recovery odds are dominated by how fast the bank is told — the first few hours matter more than anything else you will do, and after roughly 72 hours very little is usually recoverable.
Related guides
- A supplier emailed new bank details. What should you do?
The single most common way businesses lose large sums — and a short, repeatable process that stops it.
- You've paid a scammer. What to do in the first hour
If money has already gone, speed decides the outcome. The order of operations that gives you the best chance.
- How to stop invoice fraud in a small business
A practical checklist across email, process, banking and people — with an honest note about which items matter most.