Blog · Guide
How to detect fake invoices before you pay them: a step-by-step guide
Published May 10, 2026 · 8 min read
Fake invoices succeed because AP teams lack fast, contextual proof at the moment of approval. By the time fraud is discovered — when the real vendor asks about a missing payment, or when the bank confirms the account doesn't match — the money is gone. This guide covers the red flags, verification methods, and the process that catches fakes before they pay.
Step 1: Know the 8 red flags
Most fake invoices share recognizable patterns. Train your team to flag these before approving any payment:
Vendor bank account change
Any change to routing or account number since the last payment cycle. The most common fraud vector by far.
First payment to a new vendor
New vendors with no payment history have no baseline to compare against. Higher scrutiny required before first ACH.
Invoice amount significantly above historical average
A $12,000 invoice from a vendor who normally bills $2,000-3,000 should trigger a review, not auto-approval.
Urgency paired with bank details
"Pay immediately — updated account below." Legitimate vendors do not combine urgency with routing number changes.
Slightly different email domain
vendorcorp.com vs vendor-corp.com vs vendorcorp.co — attackers register similar domains and send from them.
No purchase order or prior authorization
An invoice for services with no matching PO, contract, or prior approval chain is a gap that fraud exploits.
Round-number invoices
A $10,000.00 invoice with no line items is a common indicator of a fabricated invoice.
Vendor not in your master file
Any invoice from a vendor not already in QBO should go through new vendor onboarding before payment.
Step 2: Verify vendor identity before approving
When a red flag appears, verification is required before payment releases. The verification method depends on the risk level:
Low risk
Known vendor, no bank changes, amount within historical range.
Cross-check invoice number against prior invoices in QBO. Approve if no duplicates.
Medium risk
New vendor, or invoice amount >50% above historical average.
Confirm with the internal approver who authorized the work. Log confirmation before approving.
High risk
Vendor bank account change, or first ACH to any vendor.
Out-of-band phone call to vendor at a number from your existing records. Log call date, time, and who confirmed.
Step 3: Compare to vendor history
The most reliable signal is deviation from baseline. Pull the last 6 months of payments to the vendor and compare:
- Bank account: Does the routing and account number match prior successful payments exactly?
- Amount: Is this invoice within the normal range for this vendor?
- Invoice number format: Does it match the vendor's typical numbering pattern?
- Payment frequency: Are you getting invoices at the expected cadence, or did a new one appear out of nowhere?
In QBO, the Audit Log shows vendor record changes. Pull it before every payment cycle and flag any vendor with a changed bank account. For a full breakdown of how bank account change fraud works, see vendor bank account change fraud.
Step 4: Build a repeatable pre-payment process
Ad-hoc checks are not a process. A repeatable process runs before every payment cycle and produces a log:
Pre-payment checklist (before every ACH run)
- Pull vendor audit log — flag any bank account changes since last cycle
- Identify new vendors with pending first-time ACH payments
- Flag any invoice >50% above that vendor's average
- Verify high-risk items (phone call or internal confirmation)
- Log each review: date, vendor, what was checked, reviewer name, decision
- Release only after all flags are cleared
This process also satisfies Nacha Phase 2 fraud monitoring requirements for accounting firms that originate ACH. See the Nacha 2026 compliance checklist.
Step 5: Use automation for consistency at scale
Manual checks work for a handful of vendors. For firms managing 10+ QBO and Xero clients with dozens of vendors each, manual execution of this checklist takes 3-5 hours per payment cycle. Automation runs the same checks automatically — surfacing only the flagged items for human review.
See how invoice fraud detection software handles the baseline comparison and anomaly flagging that manual review struggles to do consistently.
FAQ
What are the most common signs of a fake invoice?
The most common red flags are: (1) a vendor bank account change paired with an urgent payment request, (2) invoice amounts that are significantly higher than historical payments to that vendor, (3) a vendor email domain that is slightly different from the known domain (e.g. vendor-corp.com instead of vendorcorp.com), (4) a new vendor you have never paid before, and (5) round-number invoices with no supporting line items.
How do you verify an invoice is legitimate?
Verify the invoice against three things: (1) the vendor record in your accounting system — does the bank account match prior payments? (2) a purchase order or prior authorization — was this work actually approved? (3) an out-of-band call to the vendor at a number from your existing records (not the one on the invoice) to confirm the amount and bank details.
Can QuickBooks Online detect fake invoices automatically?
No. QBO records invoices and processes payments but does not flag anomalies like a vendor bank account change, a first payment to a new vendor, or an invoice amount far above historical baseline. That detection layer needs to be added separately — either through a manual review process or dedicated fraud detection software.
What is the difference between a duplicate invoice and a fake invoice?
A duplicate invoice is a real invoice submitted twice — either by accident or deliberately to get paid twice. A fake invoice is entirely fabricated — the vendor may not exist or the goods/services were never delivered. Both cost money; fake invoices are harder to detect because there is no legitimate original to compare against.
Automate the detection — catch fakes before they pay
Vantirs runs the vendor bank change, new vendor, and anomaly checks automatically across every QBO and Xero client before each payment cycle.