A customer got a fake invoice from you: what to do

A customer calls: "We got your email about the new bank account. Just checking before we pay." Or worse, they call to say they've paid, and you've received nothing.

Someone is sending invoices in your name. The good news is that a customer who calls before paying has already done the right thing. The job now is to stop the money, work out how it happened, and protect everyone else on your customer list.

First ten minutes: protect the money

1. Tell the customer not to pay, and to keep the email. Ask them to forward it to you as an attachment, or send a screenshot that shows the full sender address. Don't ask them to delete it; it's evidence.

2. If a customer has already paid, they call their bank, now. The customer's bank is the one that can try to recall the transfer, so they must call it and report fraud. Speed decides whether the money comes back. In 2025 the FBI's recovery team froze $679 million of the $1.16 billion in fraudulent transfers it was asked to act on (FBI Internet Crime Report, 2025). Both of you should file a report at ic3.gov.

3. Call your other customers who are due to pay you. Use the numbers you already have. Tell them: any change to our bank details will be confirmed by phone, and we haven't changed them.

Ten to thirty minutes: hacked or faked?

There are two ways this happens, and the fix is different for each. Look closely at the sender's address on the fake email.

What you see	What it means
Your real address, and the email is in a genuine thread with real details	Your mailbox, or the mailbox of someone at your business, has probably been taken over
An address that's almost yours, like a swapped letter or an extra word	A lookalike domain. Your mailbox may be fine; someone registered a similar name
Your real address in the name, a different address behind it	Spoofing: faking the "From" line. Proper email settings make this much harder

If it looks like your real mailbox, treat it as a hacked account and follow what to do when your work email is hacked. The tell-tale signs are inbox rules you didn't create, forwarding to an outside address, and sent messages you didn't write. A real thread with your real invoice details means the attacker has been reading your mail, often for weeks.

If it's a lookalike domain, your mailbox may be clean, but someone knows who your customers are. That usually came from somewhere: a customer's mailbox, a supplier's, or yours. Check your own account anyway.

If it's spoofing, your domain's email settings are letting strangers pretend to be you. Three settings on your domain, called SPF, DKIM and DMARC, tell other mail servers which senders are really you. See what email security does.

Thirty to sixty minutes: tell people and keep evidence

4. Send a short warning to customers. From your secured account, or by phone for the important ones:

We've learned that someone has been sending emails pretending to be [business], including invoices with new bank details. Our bank details have not changed. Please don't pay any invoice with new details without calling us on [number] first.

5. Keep everything. The fake emails with their full headers, your inbox rules if you find any, and a note of who received what. If the mailbox was accessed, ask whoever runs your email to export the sign-in records today; they're only kept for a limited time.

6. Call your cyber insurer if you have one, before hiring anyone. Most policies require prompt notice.

Do you have to tell anyone else?

If your mailbox was accessed and it held customers' personal information, such as ID copies, Social Security numbers or account details, Florida's data breach law may require you to notify them within 30 days. See Florida's data breach law, and get advice from a breach lawyer. Your insurer will usually supply one.

What stops the next one

• Multi-factor authentication on every mailbox. Most takeovers start with a stolen password. See why MFA comes first.
• SPF, DKIM and DMARC set up properly on your domain, so nobody can easily send email that claims to be from you.
• Email security that catches the fake sign-in pages these attacks start with. See what email security does.
• A rule your customers know about: you never change bank details by email. Put it on every invoice. Our payment change verification procedure is free.
• Someone watching the mailbox, so a new forwarding rule or a sign-in from another country raises an alert the same day.

What it costs, against what's at stake

	What it comes to
Our Business plan for ten people	$1,490 a month, with email security, account monitoring and staff training
Average reported loss to email payment fraud	About $123,000. The FBI counted $3.05 billion lost across 24,768 complaints in 2025.
A customer who paid a criminal "you"	Often, an argument about who carries the loss
Your name on the scam	Customers who stop opening your invoices

Next steps

1. Put a line on every invoice: "Our bank details will never change by email. Call us to confirm."
2. Check your mailbox for rules and forwarding you didn't set up.
3. Book a free Security Check, and we'll tell you whether your email could be used against your customers today.