Fake invoices and business impersonation scams

Scams aimed at small businesses work the same way most scams do. The scammer poses as a company or agency the business already trusts, adds pressure so nobody stops to check, and asks for payment in a form that's hard to get back. A contracting business pays a steady stream of supplier bills, which makes a fake one easy to slip in.

Fake invoices

A fake invoice bills the business for something nobody ordered. Tech support, domain registration and search engine optimization are common. Some copy a well-known brand, some come from a company the business has never heard of, and some arrive marked past due to add urgency. An invoice sent by email can also be phishing, built to get someone to click into the business's accounts and network.

A related version starts with a phone call to "confirm" an order, "verify" an address or offer a free catalog or sample. Saying yes leads to merchandise nobody ordered, followed by a demand for payment.

Listing and advertising pitches

A caller offers a free online listing or asks the business to confirm its information. A large bill follows, sometimes with a recording of the first call used as pressure to pay.

Impersonating a utility, an agency or a tech company

• The utility. A caller says a late bill means the gas, electric or water will be shut off.
• The government agent. A caller threatens fines, lawsuits or a suspended license over supposed taxes or renewals.
• Compliance posters. A seller charges for workplace posters the U.S. Department of Labor gives away free.
• Grants. A seller charges a fee to apply for a government business grant that doesn't exist.
• Trademarks and web addresses. A caller posing as the U.S. Patent and Trademark Office or a tech company says the business will lose its trademark or website address without an immediate payment.

The warning signs

• Urgency. A deadline or threat that leaves no time to check.
• The payment method. Any demand for a wire transfer, cryptocurrency or gift cards is a scam.
• Caller ID. Scammers fake the number that shows up, so a familiar name on the screen proves nothing.
• Unexpected links. An attachment or link in a text or email nobody was expecting.

What stops them

• An approval step. Set clear procedures for who approves a purchase, and check every invoice against the vendors the business really uses.
• Research. Search an unfamiliar company's name with "review," "scam" or "complaint."
• A callback. Hang up and call the utility, agency or supplier at a number you already have.
• Training. Train the office and the crew on these scams. Nobody sends a password or sensitive information by email, even when the request looks like it's from the boss. Anyone unsure checks with a coworker first.
• Reporting. Report fake invoices and other scams at ReportFraud.ftc.gov, and phishing emails to reportphishing@apwg.org.

Fake check scams and the money you're asked to send back covers the overpayment version.

An annotated example

What to do next

Write down who can approve a vendor invoice, keep a list of the vendors the business really uses, and go over the warning signs with the office and the crew.