Wedding Invoice Scam: One Changed Letter Sent the $15,000 Wire Elsewhere

The caterer had already sent the payment options. When the reply came back with wire instructions, it looked like another message in the wedding plans.

The next time the caterer called, the wedding was six days away.

Overview

The wedding was real and the bill was due

The wedding invoice scam starts with a payment the couple is already expecting to make. A stranger steps into the conversation and directs that money to a different bank account.

In one October report, a couple had been discussing catering, table settings and rentals for months. The caterer sent genuine payment options. The customer suggested paying by wire.

An apparent reply supplied the bank instructions. The customer reported sending about $15,000 and receiving an email saying the payment had arrived. The wedding arrangements continued.

One letter was different in the sender’s address

The real caterer called later to ask about the payment. While comparing correspondence, the customer and caterer reportedly noticed that the fraudulent sender’s address differed by one letter.

The correspondence looked connected from the customer’s side. Exactly how the sender learned the event details is unknown.

The public account provides no technical finding about whose email, if anyone’s, was compromised.

The FBI’s Internet Crime Complaint Center, shown above, advises using a separate channel to verify changes to account information and contacting the sending bank immediately if money went astray.

The payment details are the part to verify

• You are asked to use banking instructions that differ from the ones you received earlier.
• The reply comes from a slightly different address, despite quoting a familiar conversation.
• The person sending the instructions also supplies the only confirmation that payment arrived.
• The vendor’s actual accounting team still shows a balance due.

Any of those is enough to pause before sending a wire. Call a contact you already trust and ask someone who handles payments to confirm the recipient’s details.

Why the Fake Reply Fits So Well

During the last week before a wedding, the inbox is full of decisions. The caterer wants a head count. The rental company wants measurements. Someone still needs to confirm delivery.

In that setting, a payment reply can feel like one more detail to clear. The reported message appeared to continue a conversation that had already covered linens, seating and invoices.

When the amount matches your budget, the impulse is to check the total and get on with it. The more consequential question is whose account will receive that total.

An invoice and its bank instructions can come apart. The service description and amount can both be accurate while one changed line sends the money elsewhere.

That is the useful lesson from the catering case. The real business may still be expecting payment even when an email in the thread says everything has been settled.

How the Wedding Invoice Scam Works

Step 1: The final balance comes due

The real caterer or venue has a reason to email. An earlier deposit may already have cleared. The customer is waiting for the remaining amount or a final bill.

Look for the payment method agreed in the contract or used for the deposit. Save those details where you can find them without searching through the latest replies.

Someone who never expected an invoice may question it immediately. A genuine due date makes the message feel right before you have inspected the sender.

Step 2: A reply looks like it came from the vendor

In this account, the fraudulent address was one letter off. The customer read the message as part of an ongoing exchange and proceeded on that basis.

On a phone, the display name can take up most of the space. Expand the sender details and compare the complete address to one from an earlier message you trust.

That comparison can catch a lookalike. A separate phone call still matters because the FBI’s overview also describes fraud involving genuine accounts.

Step 3: A fresh set of wire instructions appears

The customer had asked about a wire. A reply agreeing to it felt like a response to their own suggestion. It arrived when they already intended to pay.

Treat the recipient name and account information as a new decision. A change deserves a call even if it comes with a convincing reason or a revised document.

Read back the recipient name and enough account information for the vendor to identify the intended account. Use a phone number from the signed agreement or an established contact.

Step 4: An email says the money arrived

The customer reported getting an acknowledgement after sending the wire. That took away the obvious reason to chase the payment before the wedding.

An acknowledgement from the same person who supplied the wire instructions leaves the recipient question open.

Ask the real vendor to confirm that it posted the money against your event balance.

Save a receipt from your bank and the vendor’s independent confirmation separately. You may need both if the payment is later disputed or appears missing.

Step 5: The real caterer asks about the unpaid invoice

The mismatch becomes clear when the vendor checks its own records. It sees no wire against the invoice. You have a bank record showing that money was sent somewhere.

Check both records while the vendor is on an independently verified call. Give the bank the account information from the wire and the account information the real vendor expected.

Ask someone you trust to handle unrelated wedding calls while you speak to the bank. A few uninterrupted minutes can help you collect the payment details and preserve the messages.

A Payment Check You Can Use With Any Wedding Vendor

Before final payments, pull the current agreement for each vendor. Write down who handles invoices, how you have contacted them before and where you made any earlier deposit.

Give the person paying access to that list. A parent, partner or planner may see the invoice for the first time just as they are being asked to send it.

Choose a known contact method before you have a suspicious message.

A saved number from the booking or a number verified independently from the official site gives you somewhere to start.

Separate what you bought from how you pay

Verify the service and amount with the person arranging the event. Confirm the payment destination with someone who can check the vendor’s finance records.

Ask whether a different account is expected, and whether the vendor has a secure portal or another agreed option. Verify any portal independently before entering payment information.

If the bank offers a payee confirmation, read the result. Call the vendor about any mismatch. A matching name can help, but continue through the verification you agreed on.

Check the change while there’s still time

You can ask for payment details a few days before the final invoice is due.

A pending seating change or equipment addition need not hold up verification of the underlying bank instructions.

When the venue is closed, leave the payment paused and tell your known contact why. A verified phone conversation the next morning may save a much larger problem.

If a message asks you to use a new phone number to confirm a change, go back to the original contact. Let that person put you in touch with finance.

Confirm the invoice was credited

After paying, ask the vendor to confirm the balance through the separate channel.

Ask which invoice or booking the amount was applied to, especially if several vendors share an event name.

If only part of the payment appears, ask the bank and vendor to reconcile the amount. Keep the original transfer reference rather than relying on an email subject or screenshot.

If there is a second invoice for rentals or extra seats, verify it separately. A fraudster who receives one payment may continue writing while you still expect follow-up bills.

A check for the vendor receiving the money

If you handle payments for a venue or caterer, give customers one published way to verify a wire.

Include that contact in the contract and in reminders before the balance is due.

Have finance confirm any genuine change through the established route. A customer should be able to reach you using information they already had before a different account appeared.

Consider asking customers to include their booking reference when sending payment.

That gives your accounting team a way to reconcile incoming funds while keeping bank details out of ordinary planning conversations.

When a customer says they paid but your records show a balance, ask them to call.

Compare the transfer reference and beneficiary promptly. A quick check may uncover a diversion sooner.

Tell your team to preserve the messages before changing anything. Staff can help the customer identify the genuine invoice and contact their own email administrator to review suspicious activity.

What to do when the vendor sends a corrected invoice

Ask what changed. An extra rental item should explain a new amount or line item.

A change to the recipient account deserves its own verification even if the total barely moved.

Keep the earlier invoice nearby while you talk. If the vendor confirms that the recipient is unchanged, you can refer to the details you already verified for that vendor.

If the vendor confirms a new recipient, write down who confirmed it and when.

Keep the verified instructions with your records so someone helping you pay can make the same check.

For a last-minute change, confirm who has authority to approve it.

A coordinator who handles seating may need to put you in touch with finance before either of you can check.

After the event, keep the contract and proof of payment until all balances and deposit refunds are reconciled. The records can also help if an unfamiliar request appears later.

What to Do if You Have Fallen Victim to This Scam

1. Call the bank that sent the wire immediately. Tell its fraud team you were given fraudulent wire instructions and ask what can be stopped or recalled.

2. Give the bank the reference, date, amount and beneficiary details from the transfer. Ask it to contact the receiving bank and give you a case number.

3. Reach the real vendor using the signed agreement or an established phone number. Ask for an independent statement of your balance and copies of genuine instructions.

4. Preserve the emails in their original format, including headers if available. Keep the contract, invoices, payment receipt and timestamps together in a private folder.

5. For a U.S. case, file a report with IC3. Elsewhere, use your jurisdiction’s fraud reporting service and retain the reference.

6. If you spot unfamiliar account activity, secure the email account from a trusted device. Review forwarding rules, active sessions and recovery information with your provider.

7. Tell any partner or planner who was copied to pause related transfers. Give them the verified vendor contact so they can check later messages themselves.

While the bank investigates, ask the vendor to confirm in writing how the event will proceed. Share the fraud reference if appropriate and document any new payment arrangement.

The time the wire was sent and the time you first reported the problem matter. Write both down. If you make a second call, give the same fraud reference.

If you copied a family member into the payment thread, tell them what happened using a separate conversation. They may still be receiving plausible follow-up emails.

Keep the original files even if the sender deletes messages or the conversation disappears from view. Send them only through a channel the bank, police or vendor confirms.

If the vendor investigates its own mailbox, it can compare the genuine and suspect messages on its side. Your immediate priority is getting the transfer in front of your bank.

Frequently Asked Questions

Can a fake wedding invoice have the right table count and amount?

Yes. Matching event details can make the message persuasive. Check the bank instructions with someone at the vendor you reach through a separate, trusted channel.

What if the email was in a thread I already trusted?

Expand the sender details and check the full address. A familiar thread makes the reply easier to recognize, but the recipient account still needs independent confirmation.

Does a wire receipt prove the caterer got paid?

It records what your bank sent. Ask the actual caterer to confirm whether the funds reached its account and were applied to your invoice.

Can the bank take back a fraudulent wire?

Ask for a recall right away. What the sending and receiving banks can do depends on the transfer and its status. Keep the case reference.

Should I pay the same balance again?

Speak to the vendor and bank first. Get the vendor’s current balance and any proposed arrangement in writing. Verify the receiving account before sending another payment.

What should I save if I only have my phone?

Save the bank receipt and keep the messages in your mailbox. Capture the full sender address and timestamps. Ask your email provider how to export the originals if needed.

The Bottom Line

Before you wire a wedding payment, call the vendor through an established number. Verify the receiving account even if the email gets every detail of your event right.

If the wire went out, call the sending bank immediately. Confirm your balance with the vendor and keep the original emails and payment records for the fraud report.