Fake Unpaid Invoice Scams on Microsoft Teams
Fraudsters use Microsoft Teams chats to chase payment for invoices a business never agreed to, exploiting the platform's internal trust to extract money.
Part of: Fake Unpaid Invoice Scams
Last reviewed: 1 June 2026
Fake unpaid invoice scams can be delivered through Microsoft Teams, where a chat chasing an overdue payment can feel like a routine internal or supplier message. The informal channel removes the formal cues that would normally prompt verification of an invoice.
A compromised account or an external guest can present an invoice for goods or services never ordered and press for payment. The internal feel of Teams and the speed of chat encourage a quick response before staff check whether the order was ever placed.
How this scam works on Microsoft Teams
The attacker messages finance or operations staff through Teams, attaching an invoice or payment reminder for supplies, advertising, a listing, or similar, and referencing a supposed prior order or completed delivery.
They press for prompt payment, sometimes citing late charges or disruption, and the recognised or internal-seeming source reduces suspicion. The supposed order is vague and matches no genuine purchase record.
If the business pays, the money funds the fraudster for something never ordered. Because the request arrived through a trusted internal tool, it may avoid the checks applied to formal invoices until the loss is later uncovered.
Common red flags
- An invoice chased through a Teams chat for an unrecognised order
- An external-guest account presenting an overdue invoice
- An attached invoice that matches no purchase order
- Claims of a prior order or delivery with no record
- Pressure to pay quickly to avoid charges or disruption
- Vague descriptions of the supposed goods or services
How to protect yourself
- Match any invoice to a purchase order and delivery before paying
- Treat chat-attached invoices with the same scrutiny as emailed ones
- Verify with the colleague supposedly responsible for the order
- Restrict and label external-guest access in Teams
- Keep invoice approval within an audited, central process
- Confirm unfamiliar suppliers through independent records
How to report it
- Report the impersonating or compromised account to IT security
- File a report with your national consumer protection or fraud body
- Notify your bank if a payment was made
Frequently asked questions
An overdue invoice was chased in our Teams. Should finance just pay it?
Not without checking. A compromised account or guest can present a fake invoice in chat. Match it to a genuine purchase order and delivery, and confirm with the colleague who would have ordered it before paying.