Fake invoices sent in your company's name: how business email compromise works

Fake invoice fraud is a form of business email compromise (BEC): a criminal sends your customer an invoice, or a "change of bank details" notice, that appears to come from your company. The customer pays, the money goes to an account the criminal controls, and both sides find out weeks later when your real invoice is still unpaid.

The FBI's Internet Crime Complaint Center defines BEC as a scam targeting businesses that work with suppliers or regularly make wire transfers, carried out by compromising email accounts or other communication channels through social engineering or computer intrusion (IC3 2025 Internet Crime Report). The same report lists 24,768 BEC complaints in 2025 with reported losses of $3,046,598,558.

Most of these schemes need no technical break-in at all. They rely on a convincing sender address, a believable story and a payment process that trusts email.

How the scam is put together

A typical fake invoice attack follows a few steps:

1. Research. The criminal learns who your customers are, who sends your invoices and what they look like. Websites, press releases, job ads and old invoices that were forwarded around all help.
2. A sending identity. Either a forged From address on your real domain, a lookalike domain such as examp1e.com or example-billing.com, or a real mailbox taken over with a stolen password.
3. The message. A short, routine note: "Please note our new bank details for this and future payments." Often it replies to a real thread to look familiar.
4. The payment. The customer updates the vendor record and pays. Urgency ("the account is being closed Friday") reduces the chance that anyone calls to check.

The victim on paper is your customer, but the damage lands on you as well: an unpaid invoice, a difficult conversation, and a customer who now wonders how safe your email is.

3 ways your name gets used

Forged From address on your own domain. Possible when your SPF, DKIM and DMARC records are missing or permissive. A DMARC policy of p=none asks receivers to deliver failing mail anyway. Our guide to SPF, DKIM and DMARC explains how to close this.

Lookalike domains. A domain one letter away from yours, or with an extra word, passes every authentication check because the criminal owns it and sets up the records correctly. Read more in lookalike domains and typosquatting.

A compromised real mailbox. If an employee's password leaked and the account lacks multi-factor authentication, the criminal can read real threads, set up forwarding rules and send from the genuine address. This is the hardest version to spot.

Warning signs to share with your customers

• A request to change bank details sent by email only.
• A new account in a different country or under a different name than your company.
• Pressure to pay quickly or to keep the change confidential.
• A sender address that is almost, but not exactly, your domain.
• A reply-to address that differs from the From address.

The FBI's advice is direct: verify requests for changes in account information through a secondary channel, and check that links and sender addresses really belong to the business they claim to be from (IC3 public service announcement, September 2024).

How to check your own exposure

You can review the email side in a few minutes:

dig +short TXT _dmarc.yourcompany.com
dig +short TXT yourcompany.com | grep spf1

Look for a DMARC policy of p=quarantine or p=reject and an SPF record ending in ~all or -all. Then search for registered domains that resemble yours: swapped letters, added hyphens, other endings like .co or .net. Check whether those domains have MX records, which means they can receive (and usually send) email:

dig +short MX examp1e.com

Finally, review your mailboxes for forwarding rules to outside addresses and make sure every account uses multi-factor authentication.

Controls that stop it

On the email side:

• Enforce DMARC (p=quarantine or p=reject) so forged mail from your domain is refused.
• Lock down domains that never send mail with v=spf1 -all and p=reject.
• Require multi-factor authentication on every mailbox.
• Alert on new forwarding rules and logins from unusual locations.

On the payment side:

• Tell customers in writing that your bank details will never change by email alone.
• Put your bank details on your website or customer portal, so customers can verify them.
• Internally, confirm any supplier bank change by phone, using a number you already have on file, never the one in the email.

If it already happened

The FBI stresses that time matters. Contact the bank that sent the payment immediately and ask for a recall, then file a complaint at ic3.gov regardless of the amount (IC3 PSA I-091124-PSA). Inform the affected customer in writing, reset the passwords of any mailbox that may be involved, and check for forwarding rules.

Where Datahorses fits

Datahorses watches what an attacker can use to impersonate you: newly registered lookalike domains and whether they can send mail, your SPF, DKIM and DMARC records, and signs of fake login pages. When something appears, a person reviews it and you receive concrete steps, as described in what happens when we find something. We do this from the outside and need no access. The related risk of messages that impersonate your executives is covered in CEO fraud and executive impersonation.