Invoice Fraud

Overview

What does Invoice Fraud mean?

Invoice Fraud is the creation, alteration, substitution, or misuse of an invoice or payment instruction to obtain money, goods, credentials, or sensitive information through deception.

How it works in practice

Invoice fraud involves creating or altering payment instructions to trick someone into sending money or assets to an unauthorized recipient. Attackers may compromise email, replace a QR code, alter a wallet address or impersonate a supplier requesting an urgent change. Protection focuses on authenticating the merchant and independently verifying material changes to destination, amount or beneficiary. Invoice systems should retain immutable versions of the original instructions and record who approved edits and which channel delivered them.

Further operational details

Invoice Fraud is the creation, alteration, substitution, or misuse of an invoice or payment instruction to obtain money, goods, credentials, or sensitive information through deception. The control exists to prevent deceptive or unauthorized transactions, reduce customer and merchant loss, and preserve evidence for recovery, dispute handling, and investigation. It includes more than a false invoice because legitimate invoices can be redirected by changing bank, wallet, beneficiary, amount, tax, or contact details.

The workflow combines identity, device, behavior, communication, beneficiary, transaction, and historical signals before and after payment. High-risk changes or instructions should be verified through a trusted independent channel, and controls should not rely on information supplied inside the potentially compromised message or session. In this context, controls should authenticate changes through an independent channel, compare beneficiary history, separate approval duties, and preserve the original invoice and communication trail.

Limits and common misunderstandings

Blockchain finality usually prevents a simple reversal once a fraudulent transfer confirms. Checking a familiar company name or logo does not verify an invoice's destination. An attacker controlling the email thread can also intercept a verification reply sent to that same compromised channel.

Related glossary terms

Beneficiary Name Check; Business Email Compromise (BEC); CEO Fraud