We paid a fake invoice

Last updated 2026-10-14 · Written with AI assistance, reviewed by a person

It's a sinking feeling: the real vendor calls asking why they haven't been paid, and you realize the money went somewhere else. You're far from alone. Invoice and payment fraud (often called business email compromise) is one of the costliest crimes small organizations face. The people behind it are very good at it. The single most important thing is speed: call the bank now. Everything else can wait an hour.

This playbook is for any payment sent after a fake invoice, changed bank details, or a request from someone pretending to be a vendor, a client or your own boss. The banking and reporting steps are for the US. Elsewhere, the same steps apply through your own bank, plus your police.

Who does what. Whoever handles money makes the bank call. The owner makes the business decisions. IT (a staff member, your provider or you) checks whether an email account or device was involved.

Do this now

Call the bank or payment company that sent the money. Use a number from your banking app, a statement or its official website. Say this is an active business payment fraud, then ask for the fraud or payment recovery team.
Ask them to stop or recover it. Pending? Ask them to stop it. Already sent? Ask for a recall, reversal or fraud claim. For a bank transfer, ask them to contact the receiving bank urgently. [1] [2]
Pause anything related. Scheduled transfers, installments, duplicate invoices, other bank-detail changes. Write down the hold, so nobody releases it by mistake.
Tell the owner, plus IT, by phone if email might be compromised. Pick one person to coordinate.
Keep everything: the invoice, the emails, attachments, confirmations, approvals. Don't delete or overwrite the fake bank details in your accounting system until you've saved a copy.

Just one person? Call the bank first, stop related payments, then report. Gathering every document can wait until the recovery request is in.

What to say to the bank

Our business was tricked into paying a fraudulent invoice. We sent [amount and currency] on [date, time, time zone] by [payment method]. The reference is [transaction number]. Please put me through to your fraud or payment recovery team, then start any stop, recall or recovery you can right now. What do you need from me, and what's the case number?

Describe what happened, plainly: who set up the payment, who approved it, how they were fooled, whether any account was broken into. Let the bank decide how to classify it. Don't argue about labels while the clock is running.

Ask what paperwork they need for a recall. The FBI's IC3 specifically suggests asking your bank about a recall, plus a "Hold Harmless Letter" or "Letter of Indemnity". Let the bank guide the forms rather than writing your own legal letter. [1]

What to ask for, by payment type

These are requests to make, not promises. Ask your bank which processes, deadlines and forms apply to your business account.

How it was paid	What to ask
Wire, domestic or international	Can it be stopped? If it's gone, start a fraud recall now, with an urgent message to the receiving bank. What references or forms do you need?
ACH or another bank transfer	Is it still pending? Which cancellation, return or recovery options fit this transfer?
Business credit or debit card	Which fraud or dispute process applies? Should the card be blocked or replaced?
Check	Has it cleared? Can you stop it? If it was altered, what's the fraud process, plus extra protection for the account?
Payment app or money transfer service	Can it be cancelled or recovered? If a card or bank account funded it, open a case there too.
Cryptocurrency or gift cards	Contact the exchange, platform or card issuer straight away. Ask whether any funds can be frozen. Keep transaction hashes, wallet addresses, cards with their receipts. Reversal is unlikely, so don't count on it.

Consumer protections often don't apply to business accounts, so your rights may differ from what you read for personal accounts. [3]

Get a record of every call: case number, who you spoke to, the time, what you asked for, what they actually did, when they'll update you. "We opened a case" doesn't mean the payment was stopped, or that the other bank was contacted. Ask.

After hours? Use the bank's verified after-hours fraud line. Found out days later? Report it anyway: there's no universal cut-off. Got a provisional credit? That's not final until the bank confirms it.

Report it to the FBI the same day

File a detailed report at ic3.gov, with every transaction detail you have, including the receiving bank. Keep a copy plus the complaint number. Reporting fast matters: for some larger transfers, especially international wires reported quickly, the FBI can work with banks to try to freeze the money. Reporting doesn't replace the bank call, and it doesn't guarantee a recovery.

Also:

The FTC accepts business impostor reports at ReportFraud.ftc.gov.
Your insurer or broker, if you might have cover. Ask which reporting rules apply. Don't assume a cyber policy covers invoice fraud.
Legal or incident support if sensitive data may be exposed, the loss is large, or there's a dispute over who bears it. Keep recovery moving while that's worked out.

Watch for the second scam. Check anyone who calls claiming to be a bank investigator, the police or a "recovery specialist", using a number you look up yourself. Never give passwords or codes, move money to a "safe account", or pay someone who guarantees recovery.

Build the recovery pack

Finance owns this. IT helps save the original messages. Send sensitive details only through the bank's, insurer's or law enforcement's verified channels.

What	Collect
Your business	Legal name, authorized contact, safe callback number
Each payment	Amount, currency, date and time with time zone, method, status, reference or trace number
Sending bank	Bank or provider, account holder, account details (through its secure process)
Destination	Recipient name, bank, account number with routing, SWIFT or IBAN, or the wallet address
The invoice	Original file, invoice number, claimed vendor, purchase order, the real invoice if there is one
The instructions	Original emails with headers, attachments, phone numbers, the bank-change request
Timeline	Request received, details changed, approved, paid, discovered, bank called
Recovery	Case numbers, forms sent, contacts, confirmed status

Don't hold up the first call because something's missing. Give what you have, mark the gaps, then add to the case. Keep full account numbers out of general internal updates.

Talk to the real vendor

Call a contact you already know, on a number you had before any of this started. Never use the details in the suspicious invoice, and never reply to the same email thread. Checking payment changes by phone is the FBI's top recommendation. [2]

Ask whether the invoice is real, whether they asked for any change, whether they received anything. Ask them to involve their finance plus IT people if their mailbox might have been misused.

Keep it factual. A convincing fake could come from your mailbox, their mailbox, a lookalike address or a made-up invoice. It doesn't show whose systems were broken into, or who bears the loss.

Don't automatically pay the invoice again. Agree next steps with the verified vendor, the bank, your advisers. Keep the real invoice separate from the fraud recovery, so you don't pay twice or pay the wrong account.

Is the intruder still in?

Whoever runs IT:

What you find	What to do
Someone typed a password, approved a prompt, or the mailbox shows strange activity	Start A work email account was hacked. Block access, then investigate: a password reset alone isn't enough. [5] [6]
The request came from the vendor's real address	Ask their verified contact to investigate their side. Check yours too: a real address doesn't make the request genuine.
A lookalike address or a made-up invoice, with no sign of account access	Keep it, report it, look for related messages, then fix the approval gap. Don't say a mailbox was hacked without evidence.
Banking logins, one-time codes or remote access were given away	Tell the bank now. Follow its account-protection steps from a trusted device. Isolate any device that might have malware or a stranger's remote control.
Vendor details changed inside the accounting system	Review users, access, change history, other vendors. Save the audit trail before you correct anything.

Export the relevant emails plus accounting records while they're still there. Restrict who can see them. Don't upload invoices, email threads or bank details to public scanning tools.

Look for other losses

Finance with IT:

Check other payments to the same destination, plus any other changes by the same person or in the same period.
Check the queue: scheduled payments, payroll changes, new vendors, other invoices in the same conversation.
Look further back if the evidence points to an earlier start. Finding it today doesn't mean it started today.
Ask colleagues whether they acted on similar requests. Thank them for owning up fast.
Pause only the affected payment routes unless there's evidence of something wider. Write down who can release each hold, plus what checks they need first.

Track each suspect payment on its own line. An update on one transfer says nothing about the others.

Before you pay this vendor again

Finance checks where the money is going. The owner approves the release.

The real vendor plus the real debt are confirmed, by a trusted contact.
Payment details were checked on a number you had before, not from the request.
Queued payments with changed vendor records have been reviewed.
Any affected account or device has a recorded containment decision.
A second person checked the evidence, then approved the release.
The real vendor's payment is reconciled separately from any bank recovery. Money returned to you doesn't pay the vendor: check for a duplicate before paying again.
Your accounts show the vendor debt, the fraudulent transfer, any recovery as separate lines.

In a very small business the second person can be the owner, or an authorized outside bookkeeper. Reading the same email twice isn't independent checking.

Track the outcome

One access-controlled record, one row per transfer:

Field	What to write
Lead	Name, trusted contact method
Transfer	Amount, currency, date, reference, destination (masked in routine updates)
Bank action	Stop, recall or dispute requested; time; case number; what was confirmed
Status	Pending, recall requested, funds held, returned, or not recovered
Evidence	Where the originals, logs, invoices, approvals are stored
Account compromise	Confirmed findings, possible exposure, unknowns
Outside cases	Bank, law enforcement, insurer, provider references
Next	Owner, due time, the decision expected
Closure	Approver, reconciliation, open items with owners

A recall request isn't money back. Confirm the funds actually arrived, then reconcile them, before you report them as recovered. If the bank misses an agreed update, escalate through its fraud process.

The IT clean-up may finish long before the money question does. Keep someone named on the bank or insurance case until it's closed.

Make the next one much harder

Pick a few controls you'll actually follow:

Never change bank details on an email's say-so. Call the vendor on a number you already had, then have a second person check the evidence before the record changes. Caller ID, a familiar voice or even a video call isn't proof: voices can be faked. You place the call.
Match invoices to real orders or services before paying. Make exceptions visible to the owner. [4]
Split the jobs where you can: one person changes payment details, another releases money. In a one-person finance team, the owner reviews every release.
Use your bank's controls: dual approval, payment alerts, Positive Pay for checks, ACH debit blocks. Make sure someone actually reads the alerts.
Protect email plus accounting with two-step sign-in, ideally passkeys. Remove access people don't need.
Publish DMARC for your domain, so nobody can send email from your exact address. [7]
Say it out loud: urgency, a familiar name or a request from the boss never skips the check.

Test it: pretend a vendor emails new bank details. Can whoever pays the bills say who they'd call, which number they'd use, who has to approve the change?

Keep a simple record

Write down discovery, containment, recovery, plus each decision, with times and time zones. Name one person for the money, one for the systems, with a safe way to reach both. One person can wear both hats. Escalate straight away for ongoing losses, admin account access, sensitive data exposure, or anything you can't contain.

If personal information might be exposed, start a short notification log early: who might need telling, by when, under which rule. Your adviser decides which rules apply. Don't wait for the full investigation to begin the list.

Keep original evidence access-controlled. Use copies for analysis. Leave secrets, full account numbers plus personal data out of routine updates.

Sources

Checked October 14, 2026. Recovery, deadlines, liability plus insurance depend on the account, payment method, jurisdiction and facts. This playbook follows NIST SP 800-61 Rev. 3 for incident response. It's a careful, documentation-based guide, not a guarantee of any outcome. A business banking specialist hasn't reviewed it yet.