How to Protect Your Business From Fake Invoice and Email Payment Scams
In This Article:
- ✓ Fake invoices can redirect real payments
- ✓ Simple signs a request isn't genuine
- ✓ Email habits that make scams easier to catch
Most Philippine small businesses pay suppliers and get paid the same way they always have: email, Messenger, or a quick bank transfer confirmation. That familiarity is what makes fake invoice and payment scams work: a scammer doesn't need to break into your bank account, only look convincing enough, at the right moment, to redirect a payment. This fraud, often called business email compromise, is one of the most financially damaging forms of online crime worldwide, and businesses of any size can be targeted, including small businesses that handle their own invoicing. The good news: these scams follow recognizable patterns, and a few consistent habits — not new software or added expense — significantly reduce the risk. This guide covers how the scam works, the signs worth slowing down for, what to do if you've already paid, and how your email setup helps.
Quick Answer: Fake invoice and payment scams work by impersonating a supplier, customer, or executive — usually through a spoofed or compromised email — to redirect a real payment to a fraudster's account. The most reliable protection is a simple habit: never change payment details or send money based on an email or message alone. Confirm any change to bank details, GCash numbers, or payment instructions by phone, using a number you already have on file, before paying.
Table of contents
How Fake Invoice and Payment Scams Work
Fake invoice scams rarely start with a dramatic hack. More often, a scammer either gains access to a real email account through a phishing link, or registers a domain name that looks almost identical to a real one — swapping a letter, adding a hyphen, or using a different extension than the business actually uses. From there, they quietly watch an ongoing conversation about an invoice or payment, then send a message timed to look like a normal part of that exchange: "Please note our bank details have changed" or "Kindly send future payments to this GCash number instead." A sense of urgency — a deadline today, an executive who is "traveling and hard to reach" — is often added on purpose, since it discourages the phone call that would otherwise catch the scam.
This is a global problem with real financial weight. The FBI's Internet Crime Complaint Center, in its 2025 Internet Crime Report released in April 2026, logged nearly 24,800 business email compromise complaints and more than $3 billion in reported U.S. losses, up from the year before. In the Philippines, the BSP advises users to verify sources and immediately report suspicious transactions to their bank or e-money issuer. Its fraud guidance also lists phishing, website spoofing, and fake documents among common scams.
Red Flags Before You Pay a New Request
Most fake invoice attempts share a handful of tells. No single sign proves fraud on its own — but any change to bank details, GCash numbers, e-wallet details, or payment instructions must always be verified through a channel you already trust, whether or not other signs are present. The signs below raise concern; they are not a threshold to reach before verifying a payment change.
Watch for: A request to change payment details that arrives only by email or Messenger, with no easy way to reach the sender by phone to confirm it.
Watch for: A pushed sense of urgency — a same-day deadline, a threatened late fee, an executive who is "unreachable" — designed to discourage the double-check that would otherwise catch the scam.
Watch for: A sender address that's almost right: an extra letter, a different domain extension, or a reply-to address that doesn't match the name shown. See our guide to lookalike domains for more.
| What You See | Why It Needs Verification | Quick Check |
|---|---|---|
| "Our bank details have changed" mid-conversation | Could indicate account compromise or spoofing | Call the supplier on a number you already had on file |
| Sudden switch to a personal number or e-wallet | May indicate an attacker avoiding a monitored business account | Confirm through your existing business contact, not the new one |
| Urgent tone with a same-day deadline | Often a pressure tactic meant to discourage verification | Slow down — a genuine partner rarely penalizes one phone call |
| Slightly different domain in the email address | Possible lookalike or spoofed domain | Compare the full sender address character by character |
Philippine Patterns Worth Watching For
These scams fit how Philippine businesses actually operate. A home-based seller running a shop on Facebook or Messenger may get a "buyer" who sends a screenshot claiming a GCash payment was made, pressuring the seller to ship before the money actually lands. A trading or supply business may see an email that looks like it's from a long-time customer's accounting staff, asking that the next payment go to a "temporary" account while the usual one is "being audited." A freelance consultant may get a message claiming a client's account is unavailable, requesting payment through a new one right before an invoice is due. Each request looks reasonable alone — it's the lack of a second channel to confirm it that turns a normal invoice into a costly mistake.
A Simple Verification Habit That Significantly Reduces Risk
Diagnosing a suspicious message matters less than what happens next. A consistent verification habit, applied every time payment details change, can stop many of these attempts before money moves.
- Confirm any changed payment details by phone, using a number you already have on file
- Never rely only on the contact information included in the suspicious message itself
- Treat urgency as a reason to slow down, not a reason to move faster
- Check the sender's full email address, not just the name displayed
- Have a second person review unusually large or first-time payment changes
- Keep a simple, up-to-date record of verified bank and GCash details for regular suppliers
Already paid? Act now — speed matters most.
- Contact your bank or e-wallet provider immediately about recalling, holding, or tracing the transfer.
- Preserve the original email, headers, invoice, and transaction records.
- Report to your bank first, then the BSP, NBI Cyber Crime Division, or PNP Anti-Cybercrime Group.
- If your email may be compromised, change the password, end active sessions, and enable two-factor authentication.
Recovery isn't guaranteed, but acting immediately gives you the best chance.
How Your Business Email Setup Reduces the Risk
A verification habit is the most important protection, but your email account also matters. A free, generic address gives customers no consistent address to compare a suspicious message against, making impersonation easier. A professional address on your own domain gives your team something concrete to recognize and verify — though owning the domain alone doesn't stop someone from forging a message. Technical protection against a forged sender address comes from correctly configuring SPF, DKIM, and DMARC, which let receiving mail systems verify a message actually came from your domain; Z.com's Titan setup guide covers MX, SPF and DKIM, while Titan's separate DMARC guide explains how to add DMARC.
Built-In Authentication and Filtering
The email platform adds another layer, and each control does a different job. Titan Email includes two-factor authentication, which helps prevent account takeover if a password leaks, plus anti-spam and anti-virus filtering that reduces malicious mail reaching the inbox. Google Workspace's business plans include filtering that Google states blocks more than 99.9% of spam, phishing, and malware reaching a Gmail inbox, alongside two-step verification. None of these replace the habit of confirming a payment change by phone, and none guarantee spoofing or account takeover can't happen.
Choosing a Setup That Fits Your Team
The right platform depends more on team size and budget than on fraud risk alone. A solo seller or small team may prefer Unlimited Email Hosting, which charges for storage rather than per mailbox, so adding staff accounts later doesn't add a recurring per-user cost. A growing team relying on shared calendars and document collaboration may get more day-to-day value from Google Workspace, while Titan Email sits in between, built around a professional inbox with read receipts and follow-up reminders. Whichever fits, a matching custom domain is what actually makes a lookalike email easier for your team to spot on sight.
Key takeaway: Fake invoice scams succeed by exploiting trust and urgency, not technical weakness. A simple phone-call verification habit, paired with a properly configured business email account, removes a major opportunity scammers rely on.
Frequently Asked Questions
What is business email compromise?
Business email compromise is a type of fraud where a scammer impersonates a supplier, customer, or executive — usually through a hacked or spoofed email account — to trick a business into sending a payment to the wrong account. It's often built around a real, ongoing invoice or transaction rather than an obviously fake one, which is what makes it convincing. It's grown into one of the most financially damaging forms of online fraud globally, and businesses of any size can be targeted, including small businesses that manage their own invoicing.
How do I know if a request to change payment details is real?
Treat any change to bank details, GCash numbers, or payment instructions as something to confirm out loud, not just in writing. Call the supplier or client using a phone number you already had on file before this message arrived — never the number included in the message itself. If the sender resists a quick call or pushes urgency instead, that reluctance is itself a warning sign worth taking seriously.
What should I do if I've already sent money to a scammer?
See the "Already paid? Act now" steps above — contact your bank or e-wallet provider first, since speed matters most in the first hours after a fraudulent payment, then report through the appropriate channels and secure your email account if it may have been compromised.
Can a professional business email address really prevent this?
Not by itself. A custom domain helps your team recognize and compare a suspicious sender address, but stopping a forged address technically depends on correctly configured SPF, DKIM, and DMARC. Two-factor authentication and spam filtering separately reduce the chance of account hijacking or a scam reaching an inbox. None of this replaces verifying a payment change by phone, which catches the attempts that get through anyway.
Fake invoice scams rely on a business moving as fast and trustingly as it normally does. One habit — confirming any changed payment detail by phone — removes a major opportunity scammers rely on, and a properly configured business email account makes the attempts that do arrive far easier to catch.
Build customer and supplier trust with a professional business email address on your own domain that is easier to recognize and verify.
Get Professional Email