A small-business invoice arrives from an unknown vendor

Fake invoices exploit the fact that a busy team pays many routine bills. They may demand payment for a listing, software renewal or service nobody ordered. Some attachments and links are phishing attempts aimed at business accounts rather than a bill at all.

Before you start​

Keep purchasing records and approved-vendor contacts separate from the incoming email. If you are not the buyer, involve the person who normally approves this category.

Do it step by step​

1. Read the vendor name, service period, purchase order and amount without opening unexpected attachments or calling the number printed on the invoice.
2. Search internal records for an actual order, contract or prior invoice. An invoice number alone is easy for a scammer to invent.
3. Contact the claimed vendor using a number or portal already in your records. Ask whether the invoice exists and whether the payment destination is unchanged.
4. If no purchase exists, mark the message as suspicious under your team's process and tell the accounts-payable staff not to pay it. Keep evidence without forwarding a live malicious link broadly.
5. If someone already paid or opened a credential-harvesting page, contact the bank immediately and secure the affected account. Document the invoice and report fraud through the relevant channel.

Check the result​

An approved payment should correspond to a real contract, known vendor and verified destination. Ask a second person to review unfamiliar first-time vendors.

If something goes wrong​

A real company's logo, address or tax number can be copied. If the sender is an existing supplier with new bank details, use the separate bank-change verification process as well.

Know the limit​

FTC warns that small businesses receive fake invoices and phishing attachments; its guidance favors independently checking the company and purchase. FTC's small-business invoice warning