Invoice scam checker

Why a change of bank details matters most

Most invoice fraud comes down to one move: an email that looks like it is from a supplier you already pay, saying their bank details have changed. The goods and the invoice can be real. Only the account number is not. UK Finance describes it as criminals "posing as a supplier, and claiming that the bank account details have changed", often by intercepting emails or taking over an email account.

The check that stops it is the same everywhere. Australia's cyber security centre puts it plainly: call the sender "on a known and verified phone number (not a phone number from the email, as this could be operated by a cybercriminal)".

The IBAN checker can tell you whether a new IBAN is mistyped, but not whose it is: a fraudster's account number passes it too, so the phone call is still the check that counts.

If you have already paid

Call your bank first, then report it. Speed matters more than anything else here. The FBI advises contacting your bank "as soon as fraud is recognized to request a recall or reversal", and its Recovery Asset Team froze $679 million across 3,900 incidents in 2025. In the UK you can reach your bank's fraud team by calling 159.

The lookalike tricks the address check looks for

The comparison looks at the part of each address somebody has to register, so billing.acme.com counts as acme.com, and acme.com.pay-portal.net counts as pay-portal.net, which is who really owns it. Against your supplier's usual address it flags:

• Swapped lookalike characters: 0 for o, 1 or I for l, rn for m, vv for w.
• One or two letters added, removed or swapped: acmme.com, amce.com.
• The same name with a different ending: acme.co instead of acme.com, or acme.com instead of acme.co.uk.
• The real name with words added: acme-invoices.com, acmepayments.com.
• The real domain buried inside someone else's: acme.com.pay-portal.net.
• A free mailbox such as Gmail or Outlook where the supplier has its own domain.
• Letters from another alphabet that look identical to Latin ones.

The Australian Cyber Security Centre covers invoice fraud and company impersonation in its guidance on protecting against business email compromise, and the FBI warns of misspellings of the actual domain name.

What this checker does not do

• It cannot tell you an invoice is genuine. If your supplier's own mailbox has been taken over, the email comes from the right address and none of these boxes gets ticked. A clean result means nothing was ticked, not that the invoice is safe to pay.
• It does not read the email itself. It sees only what you type. It cannot check the email's headers, the reply-to address or the attachment.
• The weighting is ours. Every sign here comes from an official warning list, but how much each one counts towards the result is a judgement, not a rule from any authority.
• It does not keep anything. Nothing is written to your browser's storage and nothing you type is sent to us.

Related

If you send invoices rather than pay them, the same fraud can be run against your clients in your name, and a client who has only ever seen your bank details on your invoices has nothing to check a change against. Say on every invoice that your bank details will not change by email. What to put on an invoice covers the rest of the document, and the invoice generator has a payment details section for exactly that note.

When an invoice looks different from what you expect, the invoice requirements checker lists what a correct invoice must show in your country.