# Fake invoice and payment emails: how to spot them

URL: https://iblockspam.com/blog/fake-invoice-and-payment-emails
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Phishing & threats
Author: iBlockSpam Team

> How to spot fake invoice emails: bogus renewal notices, domain and SEO bills, overdue invoices and refund call scams, plus an invoice check for staff.

## Short answer

A fake invoice email bills you for something you never ordered, such as a domain renewal, SEO, a directory listing or a tech support plan, often marked overdue. Don't pay, call or click. Check your purchase records and contact the real supplier using details you already hold. Report it to the FTC and forward phishing to reportphishing@apwg.org.

Every business pays invoices, and criminals know it. A fake invoice email doesn't need to break into anything. It only needs to look routine enough that someone in accounts pays it, or calls the number on it. This guide covers the invoice scams that bill you for things you never ordered: fake renewal notices, domain and SEO bills, "overdue" invoices and refund call scams.

If the problem is a real supplier's invoice with changed bank details, that's a different attack. See our guide to [vendor invoice fraud and payment redirection](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection).

## What is a fake invoice scam?

The [FTC](https://consumer.ftc.gov/consumer-alerts/2026/05/run-small-business-pay-your-bills-not-scammers) explains that scammers "send fake invoices to businesses for products or services they never ordered," billing for things like "tech support, domain registration, or search engine optimization services." The invoice "might look legitimate and appear to come from a well-known company like Geek Squad, or the sender might claim to be from a company you've never heard of before." Some arrive with a "past due" notice to add urgency.

There are really three scams under the same label:

1. **Pay-the-bill scams.** The criminal hopes you'll simply pay. The FTC says scammers hope the person handling your company's finances "will just pay the invoice by following the sender's instructions."
2. **Call-the-number scams.** The "invoice" is bait to get you on the phone, where the real fraud happens.
3. **Phishing disguised as an invoice.** The FTC warns that some fake invoices are "really a phishing scam designed to get access to your business's data and networks." The attachment or link leads to malware or a fake sign-in page.

## What kinds of fake invoices do businesses receive?

| Type | What it claims | What's really going on |
|---|---|---|
| Domain renewal notice | Your domain is about to expire; renew now | Not from your registrar; a fake renewal page or an overpriced service |
| SEO or "search listing" invoice | Payment for search engine optimization or submission | Services you never ordered |
| Directory or advertising listing | Your listing in a business directory is due | The FTC warns of "nonexistent advertising or a listing in a phony business directory" |
| Overdue invoice | Final notice, late fees apply | An invoice for nothing, or a phishing attachment |
| Subscription auto-renewal | You've been charged for a renewal; call to cancel | A refund call scam |
| Office supplies or goods | Payment for goods shipped after a "confirmation" call | Unordered merchandise |
| Utility or service cut-off | Pay now or lose service | The FTC lists utility impersonation as a common small business scam |

### Domain renewal and "lose your website" notices

Domain scams lean on fear of losing your website. The FTC's [small business guide](https://www.ftc.gov/business-guidance/resources/scams-your-small-business-guide-business-0) describes scammers posing as a tech company who say "your business will lose its website URL if you don't pay immediately."

ICANN, which coordinates the domain name system, warned about renewal emails that "appear to be sent by ICANN" and encourage recipients to "click here" to renew ([ICANN](https://www.icann.org/en/blogs/details/be-careful-what-you-click-alert-of-new-fraudulent-domain-renewal-emails-29-9-2014-en)). Its reply is simple: "ICANN does not process domain registrations or collect fees from registrants directly." It advises you to "contact your sponsoring registrar directly for any concerns about the status of your domain name."

Your domain is renewed by the registrar you bought it from, inside your account with them. Any notice from anyone else deserves a check before you pay. Protecting the registrar account matters too: whoever controls it controls your MX records and email. If you hold domains you don't use for mail, see [protecting parked domains from spoofing](https://iblockspam.com/blog/protect-parked-domains-from-spoofing).

### Fake subscription renewals and refund calls

A popular consumer scam now reaches work inboxes. The [FTC](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams) says scammers "send notices about automatic renewals for tech support subscriptions," telling you "you must call a phone number within 24 hours if you want to dispute the charge." When you call, they take you "to a spoofed website that looks real", then claim they refunded you too much and insist you pay them back with gift cards.

The FTC's advice: if you think the renewal might be real, contact the company directly, and "Do not use the number included in the message." Check your card or bank statement; if there's no such charge, the email was a scam.

### Unordered merchandise

Some schemes start with a call asking you to "confirm" an order, followed by goods and a bill. The FTC's small business guide says not to pay, and that you can keep and use merchandise you didn't order.

## What are the red flags of a fake invoice email?

- **You can't find the purchase.** No purchase order, no contract, nobody who remembers buying it.
- **The supplier is new to you**, or is a well-known brand you don't actually have an account with.
- **It pushes urgency:** "past due", "final notice", "within 24 hours", "service suspended".
- **It wants a phone call**, not a reply, to "dispute" or "cancel" a charge.
- **The payment method is unusual**: gift cards, cryptocurrency, wire transfer to a new account. The FTC's guide says, "If someone demands that you pay with a wire transfer, cryptocurrency, or gift cards, don't pay."
- **The attachment is odd**: an HTML file, a password-protected archive, or a "secure document" link. See [dangerous email attachment types](https://iblockspam.com/blog/dangerous-email-attachment-types).
- **The sender domain is a near miss** of a real supplier's. See [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing).

The FTC's general phishing advice covers this in one line: scammers may "include an invoice you don't recognize — it's fake" ([FTC](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)).

## How should staff check an invoice before paying?

The FTC asks businesses to "check all invoices closely" and make procedures clear "for approving purchases and invoices from vendors you actually work with." Turn that into a short check that everyone who handles invoices follows.

1. **Match it to a purchase.** Find the order, contract or person who requested the service. No match, no payment.
2. **Match the supplier.** Is this a supplier already in your accounts system, at its usual address? A new supplier goes through your normal onboarding, not an email.
3. **Match the details.** Compare the amount, reference and payment details with past invoices from the same supplier.
4. **Verify outside the email.** Call the supplier on a number from your own records or their real website. Never use contact details from the invoice itself.
5. **Research unknown companies.** The FTC suggests searching the company's name with terms like "review," "scam," or "complaint."
6. **Don't call numbers or open links to "dispute" a charge.** Log in to the real account, or check your statement.
7. **Get a second approval** for any new payee, and for anything above a threshold you set.
8. **Report what doesn't match**, even if you didn't pay.

Step 4 also protects you against payment redirection, where the supplier is real but the bank details aren't. Our [vendor invoice fraud guide](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) covers that call-back procedure in detail, and our [business email compromise guide](https://iblockspam.com/blog/business-email-compromise-prevention) covers the wider controls.

## What should you do if you get a fake invoice, or paid one?

### If you haven't paid

- Don't pay, call the number, or open the attachment.
- Report it to IT with your mail app's report button. Our guide on [how to report a phishing email](https://iblockspam.com/blog/report-phishing-email) has the steps for Outlook, Gmail and Apple Mail.
- The FTC says to "forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org" and report "fake invoices, and other scams to the FTC at ReportFraud.ftc.gov."

### If you paid or shared details

1. **Call your bank or card issuer at once**, using the number on your card or statement, and ask them to stop or reverse the payment.
2. **If you called a number and gave remote access** to your computer, disconnect it and hand it to IT.
3. **If you entered a password** on a page linked from the invoice, follow [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link).
4. **Report it.** In the US, file at ReportFraud.ftc.gov. For a business loss, the joint CISA, NSA, FBI and MS-ISAC phishing guidance also points to the FBI's Internet Crime Complaint Center at ic3.gov ([CISA](https://www.cisa.gov/sites/default/files/2025-03/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One%20508.pdf)).

## Which email controls reduce fake invoices?

- **Inbound filtering** checks sender reputation, authentication, links and attachments before an invoice reaches accounts. An [attachment-type filter](https://iblockspam.com/blog/dangerous-email-attachment-types) can block risky file types outright.
- **External sender tags** make a "supplier" you've never heard from stand out.
- **A shared accounts mailbox** with a single, documented approval process, so invoices don't arrive at random people.
- **DMARC on your own domain**, so criminals can't send fake invoices to your customers in your name. Check it with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).

## Next steps

1. Share the invoice check above with everyone who receives or approves invoices.
2. Log in to your domain registrar, confirm your real renewal dates, and turn on MFA for the account.
3. Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on your domain to see where SPF, DKIM and DMARC stand.
4. If you want phishing and attachment filtering in front of every mailbox on a domain, see [how iBlockSpam works](https://iblockspam.com/how-it-works).

Invoice fraud often comes from a domain one letter off from a real supplier's or your own. iBlockSpam's [Lookalike Domain Watch](https://iblockspam.com/features/lookalike-domain-watch) alerts you when a look-alike of your domain is registered.

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### How can I tell if an invoice email is fake?

Match it against your own records. A real invoice refers to something you ordered, from a supplier you already pay, at the usual address, with the usual payment details. If you can't find the purchase, the sender is new, or it pushes you to pay or call quickly, treat it as fake until you've checked with the real supplier.

### Do I have to pay for products I didn't order?

In the US, no. The FTC's small business guide says not to pay for merchandise you didn't order, and that you can keep and use unordered merchandise. Don't let a follow-up call or 'past due' notice pressure you into paying for something nobody at your company agreed to buy.

### Is a domain renewal notice from a company I don't know a scam?

Treat it with suspicion. Your domain is renewed by the registrar you bought it from. ICANN says it doesn't process registrations or collect fees from registrants, and advises contacting your registrar directly about your domain's status. Log in to your registrar account yourself to see the real expiry date.

### I got an email saying I was charged for a subscription renewal. Should I call the number?

No. The FTC says scammers send fake automatic renewal notices for tech support subscriptions and push you to call within 24 hours to dispute the charge. Check your card or bank statement instead. If you think it might be real, contact the company using a number you know is genuine.

### What is the difference between a fake invoice and payment redirection fraud?

A fake invoice bills you for something you never bought. Payment redirection targets a real bill: a criminal posing as a genuine supplier asks you to pay it to a new bank account. Both are stopped by checking against your records and calling suppliers on numbers you already hold.

## Sources

- [FTC Consumer Alert: Run a small business? Pay your bills, not scammers (2026)](https://consumer.ftc.gov/consumer-alerts/2026/05/run-small-business-pay-your-bills-not-scammers)
- [FTC: Scams and your small business, a guide for business](https://www.ftc.gov/business-guidance/resources/scams-your-small-business-guide-business-0)
- [FTC Consumer Advice: How to spot, avoid, and report tech support scams](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams)
- [FTC Consumer Advice: How to recognize and avoid phishing scams](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams)
- [ICANN: Be careful what you click: alert of new fraudulent domain renewal emails](https://www.icann.org/en/blogs/details/be-careful-what-you-click-alert-of-new-fraudulent-domain-renewal-emails-29-9-2014-en)
- [CISA, NSA, FBI, MS-ISAC: Phishing Guidance: Stopping the Attack Cycle at Phase One (2023)](https://www.cisa.gov/sites/default/files/2025-03/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One%20508.pdf)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/fake-invoice-and-payment-emails (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt