Fake Unpaid Invoice Scams

Fake unpaid invoice scams send invoices — by email, post, or PDF attachment — for goods or services that were never ordered, never delivered, or have already been paid. A variant sends duplicate invoices for a real transaction with subtly altered bank details. The core mechanism is the same in both cases: the invoice looks legitimate enough that a busy accounts payable team processes it without checking whether the underlying transaction was real.

This fraud exploits a fundamental reality of modern accounts payable: the volume of invoices processed by most businesses is high, the per-invoice review time is low, and the pressure to maintain good supplier relationships creates a bias toward payment rather than investigation. Scammers exploit this with invoices set at amounts that feel routine — low enough to avoid senior sign-off thresholds, high enough to be worth pursuing at scale.

Some fake invoice operations are highly systematic. Scammers purchase or scrape data on businesses and their suppliers, create invoices that reference plausible service names or product descriptions, and send mass campaigns knowing that a small percentage of recipients will pay without investigation. The cumulative financial impact across many targets can be substantial.

In the most basic form, an invoice arrives from a company the recipient has never done business with. The invoice may reference a plausible service — 'IT support', 'office cleaning', 'subscription renewal', 'delivery services' — at an amount low enough to avoid triggering unusual scrutiny. 'Overdue' or 'final notice' language is used from the first contact to create urgency and imply an existing relationship.

In more targeted versions, the scammer has researched the victim company's suppliers. The invoice mimics the formatting and branding of a real supplier, uses a plausible invoice number sequence, and references a service the company actually receives. The bank account details are different from the real supplier's.

In the duplicate invoice variant, the scammer intercepts a genuine invoice (often following a business email compromise) and resends it with altered payment details, relying on the recipient not to notice that the bank details have changed.

In some cases, the invoice arrives as a PDF attachment that contains malware rather than — or in addition to — the invoice document itself.

Fake invoice scams succeed because they target routine process rather than exploiting exceptional circumstances. An accounts payable team that processes hundreds of invoices weekly will inevitably face pressure to maintain throughput. Any invoice that passes a casual visual check — familiar format, plausible supplier name, reasonable amount — is likely to move toward payment.

The 'overdue' framing adds a secondary pressure point: if the invoice is already late, staff may feel that questioning it would cause a further delay and damage a supplier relationship. The implication of an existing obligation is very effective at suppressing the instinct to investigate.

Small amounts are deliberately chosen to stay below the thresholds that require management approval. Fraudsters understand that a £150 invoice for 'office consumables' is unlikely to receive the same scrutiny as a £15,000 invoice for specialist services.

An accounts payable team receives an email with a PDF attachment labelled 'Invoice [number] — overdue'. The amount is modest and the formatting looks professional. There is no existing purchase order record, but the 'overdue' framing and 'final notice' language create a sense that this is a legitimate obligation that has been missed. The payment is processed. The supplier cannot be identified and the bank account leads nowhere.

FINAL NOTICE: invoice [invoice number] for [amount] is overdue. Please pay immediately to avoid referral to our debt collection team.

Please find attached invoice [invoice number] for services rendered in [month]. Payment of [amount] is now due. Please process at your earliest convenience.

This is your third reminder for invoice [invoice number] ([amount]). Failure to pay within 48 hours will result in additional late payment charges.

OVERDUE: invoice [invoice number] for [amount] remains unpaid. Our records show payment was due [date]. Please settle by return to avoid further action.

Invoice attached for [service description] — [amount]. Please process payment to the account below. Do not hesitate to contact us if you have any queries.

As discussed, please find invoice [invoice number] for [amount] covering [vague service description]. Payment within 14 days would be greatly appreciated.

The most effective single control is purchase-order matching: every invoice should correspond to an approved purchase order before payment is authorised. Where this is not possible, a secondary verification step is essential:

- PO matching: maintain a purchase order register. No invoice should be paid that does not reference an approved PO number that exists in your system. - Supplier verification: for any invoice from a supplier not on your approved list, verify the company's registration and bank details independently before adding them to your payments system. - Bank detail cross-check: compare the bank details on any invoice against your existing records for that supplier. Any change should trigger the same callback process as for invoice redirection fraud. - Dual authorisation: apply a two-person approval rule for payments above a defined threshold, particularly for invoices from new or unfamiliar suppliers. - Attachment caution: treat PDF invoices from unknown senders as potential malware delivery. Open in a sandboxed environment or verify before opening if there is any doubt.