Business and Invoice Scams
Criminals impersonate vendors or executives to redirect invoices, payroll, or high-value transfers.
How this scam operates
A criminal impersonates a supplier, senior employee, or trusted business contact and requests an urgent payment or change to bank details. Email accounts and previous invoice formats may be copied or compromised. The fraud succeeds when the payment change is approved within the same channel instead of checked separately.
Details can vary, but the goal is usually to create enough trust, fear, or urgency that you act before verifying the story. Caller ID, profile names, logos, and polished websites can all be copied.
What the scammer wants
Money, payment details, personal information, or an action that removes normal payment protections.
Common tactics
Impersonation, false authority, urgency, threats, and instructions not to verify through another channel.
Commonly documented operational hotspots
These are recurring locations in law-enforcement cases and established fraud research—not a ranking of countries or people.
Nigeria Significant
Major federal investigations repeatedly identify Nigeria-linked networks in business email compromise involving vendor invoices, executive impersonation, payroll, real-estate closings, and altered wire instructions.
- Association
- Significant documented location
- Evidence source
- Cyber-enabled fraud prosecutions — U.S. Department of Justice
- Last verified
Warning signs to look for
Changed payment details
Invoice or payroll instructions suddenly direct funds to a different account.
Look-alike contact details
The sender address, domain, profile, or phone number resembles but does not match an official one.
Manufactured urgency
You are pressured to act before you can stop, verify, or ask someone you trust.
What to do next
Take protective action even if you are not yet certain this is a scam.
-
verification
Confirm payment changes
Use a known phone number and a second approval channel before changing payment details.
-
Immediate response
Preserve evidence and secure access
Save messages, receipts, account names, URLs, and transaction details. If credentials were exposed, change them from a trusted device and review active sessions.
How to protect yourself
Pause unexpected requests involving money, codes, documents, or account access. Leave the original conversation and verify the claim using an official app, a known website, or a number from a statement or card. Do not rely on caller ID, profile names, or links supplied by the sender.
If you were affected
Stop contact and further payments. Contact the bank, payment service, marketplace, or platform through its official channel. Secure exposed accounts from a trusted device, preserve messages and transaction records, and report through the appropriate official service. Watch for follow-up recovery scams.
Open the recovery checklistOfficial help and reporting
Choose the service for your location. External links open the organization’s official website.
ReportFraud.ftc.gov
Federal Trade Commission
Official United States service for reporting fraud, scams, and bad business practices.
Action Fraud
City of London Police
The United Kingdom’s national reporting centre for fraud and cybercrime.
Phone: 0300 123 2040
Canadian Anti-Fraud Centre
Royal Canadian Mounted Police, Ontario Provincial Police, and Competition Bureau Canada
Canada’s central service for information about fraud and for reporting fraud and cybercrime.
Phone: 1-888-495-8501
Scamwatch
National Anti-Scam Centre
Australian government information and reporting guidance about scams.
Related scam types
Bank and Payment Scams
Messages and calls impersonate banks or payment services to steal credentials, verification codes, or money.
Read related guide