Example 1: vendor bank change
A known supplier claims their accounting team changed banks this week.
- Red flag: new bank details by email.
- Red flag: same-day payment pressure.
- Control: callback on known vendor number and dual approval.
Example 2: reply-to mismatch
The From address appears corporate, but Reply-To points to a free-mail address.
- Red flag: replies go outside the vendor domain.
- Red flag: attacker controls the conversation after AP replies.
- Control: start a fresh verification through known records.
Example 3: executive pressure
A CFO or CEO asks AP to process a confidential wire while unavailable.
- Red flag: secrecy plus urgency.
- Red flag: bypass of normal approval workflow.
- Control: in-person or phone verification and dual approval.
Fake Invoice Examples FAQ
Do fake invoices always use bad grammar?
No. Many are polished, targeted, and based on real vendor workflows.
Can an invoice be fake if the vendor is real?
Yes. Attackers can impersonate or compromise real vendors and redirect payment instructions.