Invoice fraud happens when someone tricks an organization into paying for goods or services that were never delivered, or into sending a real payment to the wrong account. It affects large companies with mature controls as much as small businesses. The FBI's Internet Crime Complaint Center has warned repeatedly about business email compromise, much of it carried out through fake or altered invoices and payment instructions.
As more invoicing moves online, the tactics keep evolving. This guide, refreshed for 2026, describes the most common types of invoice fraud, the red flags to watch for and the controls, manual and automated, that stop it.
What are the common types of invoice fraud?
1. Inflated invoices
A fraudulent or altered invoice charges more than was agreed. The increase is usually small enough not to raise questions, and the fraudster relies on volume rather than one large payout.
Controls: match every invoice against the purchase order and the contract rate, and automate the comparison so small differences are not missed. Watch for red flags such as a logo that looks wrong, poor grammar, new contact details or bank accounts, round amounts and repeated figures.
2. Fake vendor invoices
An invoice appears to charge for legitimate goods or services from a vendor the company uses regularly, but nothing was delivered. Because the vendor is familiar, nobody questions it.
Controls: require a purchase order and a goods or service receipt before payment. If the goods cannot be found in inventory or there is no purchase order, stop and investigate.
3. Duplicate invoices
Duplicates are a large source of leakage. AuditNet lists them among the main signs of accounts payable fraud. Insiders may resubmit an invoice, and outside parties may send copies with small changes, hoping they pass. Not all duplicates are fraud, but they are a common tactic. Read about duplicate invoices.
Controls: set a standard policy for entering invoice numbers, including rules for prefixes, capitalization and punctuation, and use duplicate detection that compares invoices across many fields, not just exact matches.
4. Payment redirection
A fraudster impersonates a real supplier, often through a compromised or look alike email account, and asks for future payments to go to a new bank account. The invoices are genuine. The destination is not.
Controls: never change bank details based on an email alone. Confirm by phone using contact details already on file, require a second approver for any change, and hold the next payment to a changed account for extra review.
What red flags should accounts payable watch for?
- New or changed bank details, especially requested urgently
- Invoices from vendors with no purchase order or no receipt
- Round amounts or the same amount repeated across invoices
- Invoice numbers out of sequence or with small changes
- Unusual pressure to pay quickly or to skip normal approval
- Sender email addresses that differ slightly from the known domain
- Vendors with a post office box only, or details matching an employee
How does automation reduce invoice fraud?
Prevention starts with a thorough, consistent review process, and consistency is where automation helps most. A person can check a sample of invoices closely. Software checks all of them the same way, every time.
| Control | What automation does |
|---|---|
| Matching | Compares each invoice with the purchase order, receipt and contract terms |
| Duplicate detection | Compares new invoices with history across many fields |
| Vendor verification | Validates vendor records at onboarding and flags changes to bank details |
| Approval rules | Enforces thresholds and segregation of duties for every invoice |
| Audit trail | Records who approved what, when and why |
In Invoiceflow, Aavenir AI reads each invoice, runs these checks and routes exceptions to a person to approve or reject. Supplier records and bank details are verified through Onboardingflow. See two way and three way matching.
What should you do if you suspect fraud?
- Hold the payment and do not contact the supplier through details on the suspect invoice
- Verify with the supplier using contact details already on file
- Inform your finance leadership, internal audit and, if money has moved, your bank immediately
- Preserve the invoice, emails and system records
- Review recent payments to the same vendor and account for similar patterns
The bottom line
Invoice fraud relies on volume, familiarity and small differences. Match every invoice against the purchase order, receipt and contract, verify bank detail changes independently, detect near duplicates and keep a person approving every exception.