Why fake invoices work so well
Most small offices pay dozens of invoices a month, often from the same handful of suppliers. The person processing them is busy, the invoices look routine, and the accounts system happily accepts whatever bank number is typed in. Scammers rely on that rhythm. They don't need to break into your network; they just need one convincing PDF to land in the right inbox on the right day.
Some fake invoices are pure guesswork, sent to thousands of businesses in the hope a few will pay. The dangerous ones are targeted. The scammer has read a real email thread, often from inside a supplier's hacked mailbox, so they know the supplier's name, the project, the usual amounts and even the tone the account manager writes in. That is why a fake can look identical to the real thing.
The warning signs in the email itself
Look at the sender address, not just the display name. Outlook and Gmail show a friendly name like 'Acme Supplies Accounts', but the address behind it might be [email protected] or [email protected] with a capital I standing in for an l. Hover over or tap the name to see the full address. A reply-to address that differs from the sender is another red flag.
Then read the message for pressure. 'Our bank has changed, please update your records before paying', 'This is overdue and will go to collections today', or 'Please keep this between us while our accounts team is restructured' are all designed to rush you past normal checks. Genuine suppliers rarely mind waiting a day while you confirm a new account.
Finally, check the attachment and links. An invoice that arrives as a link to 'view document' on a file-sharing site, asks you to sign in to see it, or comes as a zipped or macro-enabled file deserves suspicion. Real invoices from accounting systems like Xero or MYOB usually come as a plain PDF or a link to the supplier's own payment page.
Check the invoice against what you actually ordered
Every invoice should match something real: a purchase order, a quote, a delivery docket or a recurring arrangement. If you can't tie it to one of those, don't pay it until you can. A surprising number of fake invoices are for vague services such as 'directory listing renewal', 'domain registration' or 'SEO package', aimed at businesses that won't remember whether they signed up.
Compare the invoice with the supplier's last genuine one. Look at the logo, the GST number, the invoice numbering, the payment terms and above all the bank account. Scammers often get the look right but slip on details like a GST number that doesn't match, an invoice number out of sequence, or an amount rounded oddly. Keep a copy of each supplier's confirmed bank details somewhere the whole accounts team can see.
Confirm bank details by a second channel
If an invoice shows a bank account you haven't paid before, ring the supplier on a number you already hold, from their website, an old invoice or your contacts list, never one printed on the suspicious invoice or email. Ask them to read the account number to you rather than reading it out yourself. Make a note of who you spoke to and when.
Many NZ banks now show whether the account name matches the number when you add a new payee. Treat a mismatch warning as a stop sign, not a technicality. It is also worth asking your bank whether your business account can require a second approver for new payees, so one person can't add and pay a new account alone.
Set a simple office rule and stick to it
Write down a short rule everyone follows: any new payee or changed bank account is verified by phone to a known number and approved by a second person before payment. Put it on one page, explain it at a team meeting, and make it clear nobody will be in trouble for delaying a payment to check. The rule only works if it applies to the owner and senior staff too.
Technical controls help as well. Good email filtering catches many fake invoices before they arrive, external-sender banners remind staff that a message came from outside, and multi-factor sign-in on your own mailboxes stops scammers using your accounts to fool your customers. If you'd like a second opinion on how exposed your invoice process is, a short IT health check from Office IT covers email security and payment workflows together.
If you think you've already paid a fake invoice
Speed matters more than anything. Call your bank straight away using the number on the back of your card or their website and ask them to try to recall the payment. Then tell the supplier whose name was used, because their mailbox may be compromised. Report the incident to the police and to the NCSC through its online reporting form, and keep the emails rather than deleting them. Afterwards, work out how the fake got through. Was it a lookalike domain, a hacked supplier mailbox, or a gap in your own approval process? Fix whichever one it was, and share what happened with the team so the lesson sticks without blame.
In short
- Never pay a new or changed bank account without confirming it by phone on a number you already had.
- Check the real sender address, not the display name.
- Match every invoice to a purchase order, quote or known arrangement.
- Require a second person to approve new payees, including for the owner.
- If you've paid a fake, call your bank immediately and report it.