Invoice Fraud: A Practical Guide to Prevention

13 October 2026

Estimated Reading Time: 8 minutes

Invoice fraud is one of the cheapest crimes to commit and one of the hardest to recover from. A single altered bank account number on one invoice can send a five- or six-figure payment to a stranger, and once the money has left the account, banks can rarely get it back. This guide sets out how the fraud works, the controls that stop it, and what to do in the first hour if you think you have been hit.

Why it happens

Invoice fraud rarely relies on clever hacking. It works because accounts payable is built on trust and routine, and fraudsters exploit both. The cost goes beyond the lost payment: there is the time spent investigating, strained supplier relationships, awkward conversations with auditors and insurers, and possible exposure of supplier or customer data.

The businesses most exposed tend to share a few conditions:

• Manual, inconsistent processing. When invoices arrive as PDFs and paper and are keyed in by hand, nobody has a reliable baseline to spot what looks wrong. A PDF is also easy to edit.
• One person doing too much. If the same person can set up a supplier, approve an invoice and release the payment, there is no second set of eyes, whether the problem is fraud or simple error.
• Hundreds or thousands of invoices a month means each one gets seconds of attention. Fraudsters count on that.
• Email as the main channel. Invoices, payment instructions and bank detail changes all travelling by email give an impersonator a familiar and convincing route in.
• Light-touch supplier checks. New suppliers are onboarded without verification, and long-standing ones are trusted so completely that their invoices are barely reviewed.
• Untrained staff. The person processing invoices is the last line of defence. If they don’t know what a scam looks like, the controls around them have to be perfect.

The common schemes

Most invoice fraud falls into seven patterns. Some come from outside the business, some from suppliers, and some from within.

1. Bank detail substitution

This is the most damaging scheme in Australia. A fraudster gets into a supplier’s email account, or sometimes yours, and watches real invoice traffic. When a genuine invoice is due, they send a near-identical copy, or a “we’ve changed banks” letter, with their own BSB and account number. The invoice is real, the amount is right, the timing is right. Only the destination has changed.

The same result can come from inside. An employee with access to supplier master data quietly swaps a supplier’s account for their own, pays a few invoices, then changes it back.

2. Business email compromise (BEC)

Here the fraudster impersonates someone the AP team trusts, usually the CEO, CFO or a familiar supplier contact. The email is urgent, often sent late on a Friday or while the executive is known to be travelling, and asks for a payment to be made quickly and quietly. The sender’s address is off by a single character (harbour-freight.com.au instead of harbourfreight.com.au), or a free mail account carries the right display name.

Phishing is the usual starting point. One click on a fake login page or a malicious attachment gives the attacker access to a real mailbox, and from there their requests look entirely legitimate.

3. Fake suppliers

An invoice arrives from a business you have never dealt with, for goods or services that sound plausible: IT support, cleaning, consumables, a software renewal. Often the name is close to a real supplier’s (Southern Office Supplies versus Southern Office Supply Co). If nobody checks it against a purchase order or a known supplier, it gets paid. A variation is the “directory listing” or “domain renewal” invoice that looks official but is an unsolicited offer.

4. Duplicate invoices

The same invoice is submitted twice. The second copy may carry a slightly changed invoice number (INV-1043 becomes INV-1043A), a different date, or a note saying the original was never paid. Sometimes it’s deliberate, sometimes it’s sloppy supplier admin, but either way the business pays twice. The risk is highest with high-volume suppliers who send many similar invoices each month.

5. Overbilling

A legitimate supplier charges more than was agreed: more units than were delivered, a higher unit price than the purchase order, hours that weren’t worked, or line items for things that weren’t requested. One instance may be a genuine mistake. A pattern from the same supplier is a warning sign.

6. Collusion

An employee works with a supplier, or with an outsider posing as one, to push through inflated or fictitious invoices and split the proceeds. Because the insider knows the approval limits and who checks what, these schemes can run for years. Watch for invoices that sit just under an approval threshold, or a supplier who only ever deals with one person.

7. Expense and receipt manipulation

Staff alter receipts or invoices they submit for reimbursement: an extra night on a hotel bill, a taxi fare edited from $48 to $148, a personal purchase presented as a business expense. Individual amounts are small, but they add up, and they point to a culture problem worth addressing early.

Controls that stop it

No single control is enough. The goal is to layer several so that one failure doesn’t result in a payment going out.

Never accept bank detail changes on trust

This one rule prevents more loss than any other.

1. Treat every request to change a supplier’s bank details as suspicious until proven otherwise, however routine it looks.
2. Verify by phone using a number you already hold on file or find independently. Never use the phone number, email or link in the request itself.
3. Speak to a contact you have dealt with before, and confirm the new BSB and account number with them.
4. Have a second person approve the change in your accounting system, and record who verified it, when, and with whom.
5. Make a small test payment and have the supplier confirm receipt before the next large payment goes out.
6. Where your bank offers payee name checking when you set up or pay to an account, use it and act on mismatch warnings.

Match before you pay

Every supplier invoice should be checked against what was actually ordered and received.

• Two-way match: the invoice agrees with the purchase order on supplier, items, quantities and prices.
• Three-way match: it also agrees with a goods receipt or delivery confirmation, so you only pay for what arrived.
• For services without a purchase order, require the budget owner to confirm the work was done before approval.
• No purchase order, no payment, except for a short, defined list of exempt categories such as utilities and rates.

Separate the duties

Split the key steps across different people so that no one can complete a fraudulent payment alone:

In a small business where the team is too small to split everything, compensate with review. A director should look over the supplier master change log and the payment run every time, before funds are released.

Vet suppliers properly

• Check the ABN on the Australian Business Register (ABN Lookup) and confirm the legal name, status and GST registration match the invoice.
• Confirm a physical address, a landline or main switchboard number, and a named contact before the first payment.
• Collect bank details on the supplier’s letterhead or through a secure portal, and verify them by phone exactly as you would a change.
• Review the supplier list at least once a year. Deactivate suppliers you haven’t paid in 12 months so they can’t be quietly reused.

Lock down email and access

• Turn on multi-factor authentication for every email account, the accounting system and internet banking. This one step blocks most mailbox takeovers.
• Set up email authentication (SPF, DKIM and DMARC) on your domain so others can’t easily send mail pretending to be you.
• Flag external emails in the subject line or banner, and warn on lookalike domains.
• Restrict who can edit supplier bank details in the accounting system, and keep the audit log switched on.
• Where suppliers can submit invoices or update details through a portal rather than email, use it, and treat any off-portal change request as a red flag.

Train your people

Your AP staff and anyone who approves invoices should know the patterns in this guide and have permission to slow things down. Brief them at onboarding and refresh at least twice a year, using real examples of attempts the business has received. The key messages:

• Check the actual sender address and the reply-to address, not just the display name.
• Don’t click links or open attachments in unexpected invoice emails. Go to the supplier’s system or call them instead.
• Urgency, secrecy and changed payment details are the three biggest warning signs, and together they are almost always fraud.
• Nobody, including the CEO, will be in trouble for calling to check a payment request. Make sure leadership says this out loud.

Where technology helps

The controls above work on paper, but they are hard to apply consistently by hand when invoice volumes grow. Automation makes the checks happen every time, not just when someone has a spare minute. You don’t need a large enterprise platform to benefit. Most of the gains come from a few capabilities.

Capture invoice data automatically

Use a tool that reads PDF, scanned and emailed invoices and extracts the supplier, ABN, invoice number, dates, line items, amounts and bank details into structured data. Once every invoice is data rather than a document, every invoice can be checked the same way. It also builds a clean history, which is what any later anomaly checking depends on.

Rule-based checks before payment

Set hard rules that stop an invoice and route it for review when it:

• matches an existing invoice on supplier, amount and date, even if the invoice number differs slightly
• shows bank details that differ from the supplier master record
• comes from a supplier that is new, inactive or not on the approved list
• carries an ABN that doesn’t match the supplier record or isn’t active
• doesn’t match its purchase order or goods receipt within an agreed tolerance
• falls just under an approval threshold, or exceeds a set amount
• arrives from a sender domain that doesn’t match the supplier’s known domain

Keep the rules under change control so nobody can quietly switch one off, and log every override with a name and a reason.

Anomaly detection

Rules catch what you already know to look for. Pattern analysis across your invoice history catches what you don’t: a supplier whose invoice amounts suddenly jump, unusual invoice frequency, round-number invoices, invoices submitted outside normal hours, or one approver who handles a disproportionate share of one supplier’s invoices. AI-based tools can now do this well even at modest volumes. The important test is whether the tool can explain why it flagged something, so your team and your auditors can act on it with confidence.

Integrate with your accounting system

Checks are only useful if they sit between the invoice and the payment. Connect the capture and checking tools to your ERP or accounting system so flagged invoices can’t be paid until someone clears them, and so supplier master data has one source of truth.

Safer payment methods

For suitable suppliers, virtual cards (a card number issued for one supplier or one payment) limit what can go wrong. A redirected payment instruction is useless when the card is locked to a specific merchant and amount.

Red-flag checklist

Stop and verify before paying if an invoice or request shows any of these:

☐ New or changed bank details, especially an account in a different name or at a different bank

☐ Pressure to pay urgently, outside the normal cycle, or to keep the payment confidential

☐ A sender address, domain or reply-to that is slightly different from usual

☐ A supplier you don’t recognise, or a name very close to one you do

☐ No matching purchase order, delivery or person who requested the goods

☐ An invoice number, amount or date that closely mirrors one already paid

☐ Prices or quantities that differ from the purchase order or contract

☐ Changes in invoice layout, logo, fonts or wording from a regular supplier

☐ An ABN that is missing, inactive or doesn’t match the business name

☐ Amounts sitting just under an approval limit, or many small invoices where one would be normal

☐ A request that arrives only by email when the supplier normally uses a portal or other channel

If you think you’ve been hit

Speed matters most. The chance of recovering funds drops sharply after the first few hours.

1. Call your bank immediately and ask them to recall the payment and contact the receiving bank. Use the bank’s fraud line, not general enquiries.
2. Report it through ReportCyber at cyber.gov.au, which routes it to the right police agency, and to Scamwatch.
3. Contact the real supplier on a known number to confirm what happened and whether their systems were compromised.
4. Secure your accounts. Reset passwords on affected mailboxes, check for inbox forwarding rules an attacker may have set up, and confirm MFA is on.
5. Preserve the evidence. Keep the emails with full headers, the invoices, payment records and system logs. Don’t delete anything.
6. Tell your insurer if you hold cyber or crime cover. Most policies have strict notification windows.
7. Check your privacy obligations. If personal information was exposed, you may need to assess whether it is a notifiable data breach under the Privacy Act.
8. Review and fix the gap. Work out which control failed or was missing, fix it, and brief the team on what happened.

Invoice fraud succeeds because it looks like normal business. The defence is equally unglamorous: verify every bank change, match every invoice, split the duties, and give your people permission to ask questions.

Micro Image Intelligent Document Processing helps clients strengthen invoice verification by extracting and validating key invoice data, checking payment details, amounts and dates, identifying potential duplicate invoices, and matching invoices against purchase orders.

By applying these checks consistently across invoice volumes, organisations can improve visibility of exceptions, reduce reliance on repetitive manual checking and give finance teams greater confidence in the information progressing through their accounts payable workflows.

Invoice fraud prevention is not simply a matter of spotting suspicious emails. It is about building verification into the process itself—so that an invoice must satisfy the right checks before it is paid.