AI-Generated Fake Invoice Scam

AI-generated fake invoice scams use generative AI tools to produce fraudulent invoices, payment requests, or billing emails that closely mimic a real supplier, contractor, landlord, or service provider — often based on genuine invoices or correspondence the scammer has obtained through a prior email compromise or public data. Where older fake-invoice scams relied on generic templates and were often caught out by inconsistent branding or clumsy wording, AI tools now let scammers replicate a specific supplier's exact invoice layout, tone of voice, and even reference genuine past transaction details.

The scam targets both businesses, where it overlaps heavily with business email compromise, and individuals, who may receive a convincing fake invoice for rent, utilities, subscriptions, or freelance work claimed to be owed. The fraudulent invoice typically directs payment to a bank account controlled by the scammer rather than the legitimate payee, sometimes accompanied by an AI-drafted email explaining a 'recent change of bank details.'

Because the invoice can be generated to match a real, previously seen supplier relationship in exacting detail — correct logo, correct invoice numbering conventions, references to a real prior order or contract — recipients are far less likely to notice anything is wrong compared with earlier, more generic fake-invoice attempts.

The scam often begins with a compromised email account — either the supplier's or the target's — giving the scammer access to genuine past invoices, email threads, and communication style to feed into an AI tool as source material. Where no compromise has occurred, scammers can still gather convincing detail from publicly available website branding, LinkedIn activity, or leaked data, then use AI image and document tools to recreate an invoice template that is visually near-identical to the real thing.

The scammer then sends the fake invoice from a lookalike email domain (often differing from the real one by a single character) or, in more advanced business email compromise cases, from the actual compromised account itself. The message is drafted by AI to match the supplier's usual tone, sometimes referencing a genuine recent order, project milestone, or previous invoice number to build credibility, and includes an explanation for updated bank details — commonly a claimed change of bank, an audit, or a new payment processor.

Because businesses often process a high volume of routine invoices with limited scrutiny, and the fake document matches expected formatting exactly, payment can be authorised and sent before anyone notices the banking details have changed. By the time the real supplier chases the unpaid invoice, the money has already left the target's account.

Invoice processing is often a routine, high-volume task performed under time pressure, and people default to pattern-matching — if a document looks exactly like the hundred previous invoices from the same supplier, it doesn't prompt the same scrutiny a genuinely unfamiliar request would. AI removes the small inconsistencies (wrong logo resolution, odd phrasing, mismatched invoice numbering) that used to be the main giveaway, closing the last easy detection gap for a busy accounts-payable employee or individual paying routine bills.

The scam also exploits organisational hierarchy and process gaps: a claimed 'change of bank details' is a mundane, plausible administrative event that rarely triggers independent verification unless a specific policy requires it, especially when the request appears to come from a long-established, trusted supplier relationship.

Please note our bank has changed processors — kindly update our account details to [account] for this and future invoices.

Following our recent order, please find attached invoice [number] for [amount], payment due within 5 business days.

Apologies for the short notice, our finance team requires this invoice settled today to avoid a late fee.

Due to an internal audit, please direct all future payments to the new account listed below.

Any invoice containing a change of bank account details should be verified through a phone call to a known, independently sourced number for the supplier — never a number or contact listed on the invoice itself, since that may be part of the fraud. For businesses, implement a mandatory callback policy for any banking-detail change before the first payment to the new account is made, regardless of how convincing the paperwork appears.

Cross-check the sender's email domain character by character against previous genuine correspondence, and compare the new invoice against the supplier's last few genuine invoices for subtle formatting drift. If in doubt, contact the supplier through an entirely separate channel — their main published switchboard number or a long-standing personal contact — before releasing payment.