What are the most common types of invoice fraud?

Bank-detail substitution (a legitimate-looking invoice redirecting payment to a new account), look-alike vendors (a name one character off a real supplier), duplicate submission of an already-paid invoice, and invoices for goods or services never delivered. The first is the most damaging: the invoice itself is often genuine — only the account number has changed.

How does changed-bank-details fraud work?

An attacker — often after compromising a supplier's email — sends an invoice or an 'updated remittance details' notice with a new account number. Everything else matches your history with that supplier, so the payment sails through. The tell is the change itself, which is why screening compares each invoice's bank details against that supplier's history.

Why must fraud screening happen before the payment run?

Because payment is the point of no return. A suspicious invoice caught beforehand costs one verification phone call. Money sent to a fraudulent account is rarely recovered in full — recovery depends on how fast the bank freezes the funds, and the fraudster is faster.

What is a fraud risk score and how should I use it?

DVAP Fraud Screen returns a 0–100 score per invoice with each contributing reason named. Low scores flow straight through; anything scoring 60 or more is routed to a human as an exception. The named reasons matter more than the number — 'bank_details_changed' tells the reviewer exactly what to verify by phone.

Can small businesses screen invoices for fraud without special software?

Yes — as an API call. DVAP Fraud Screen scores one invoice per call, statelessly, with nothing stored; the free tier covers 25 checks a month. The discipline that makes it work is procedural: verify any bank-detail change with a known contact, on a known number, before paying.

Guides · 2026-07-24

How to catch invoice fraud before the payment run

Invoice fraud works because the document looks right. It names a supplier you know, references work that happened, and lands in the same inbox as every legitimate invoice. The only reliable defence is to screen every invoice — not just the odd-looking ones — at the one moment it is cheap to act: before money moves.

The patterns, in order of damage

Changed bank details. The costliest pattern. An attacker — often sitting inside a compromised supplier mailbox — sends a genuine-looking invoice, or an “updated banking details” note, pointing at a new account. Every field a human checks (supplier, amounts, job reference) is correct; the one field nobody memorises is the account number. Businesses discover it when the real supplier chases the unpaid invoice.

The look-alike vendor. An invoice from “Acme Constructions” when you deal with “Acme Construction” — a name close enough to pass a glance and a payment history search that isn't exact. Often paired with small first invoices to establish a payment pattern before a large one.

The duplicate. An already-paid invoice re-submitted, betting that your duplicate controls are weak. Fraudulent when deliberate, but caught by the same mechanism as the accidental kind.

The phantom invoice. Goods or services never delivered, from a “supplier” created for the purpose — betting that small amounts get paid without questions. This is where PO matching is the control: no order, no match, no payment.

What screening looks for — and says

DVAP Fraud Screen scores every invoice 0–100 and names each contributing signal, so the reviewer knows what to verify rather than just that “something” is off:

Reason	Signal	What to do
bank_details_changed	The account number differs from this supplier's payment history	Call a known contact on a known number — never one from the invoice
vendor_name_lookalike	The supplier name nearly matches a vendor you already pay	Compare ABN and details against the real vendor's record
duplicate_invoice	This invoice matches one already processed	Check whether the original was already paid
currency_changed	The invoice currency differs from this supplier's history	Confirm the change was agreed — repricing is a common cover

In the full DVAP pipeline, an invoice scoring 60 or more becomes an exception: it stops, and a human decides with the reasons in front of them. Everything else flows straight through — screening every invoice only works if it doesn't slow the honest ones down.

The procedure that closes the loop

Software surfaces the suspicious invoice; a procedure stops the payment. The one rule worth writing down: any change to a supplier's bank details is verified by phone, with a contact you already know, on a number you already have — never a number printed on the invoice or emailed with the change, because in the compromised-mailbox scenario both belong to the attacker. One call, before the payment run, against a named reason. That combination — screen everything, verify the flagged few — is proportionate for a business of any size.

Frequently asked questions

What are the most common types of invoice fraud?: Bank-detail substitution (a legitimate-looking invoice redirecting payment to a new account), look-alike vendors (a name one character off a real supplier), duplicate submission of an already-paid invoice, and invoices for goods or services never delivered. The first is the most damaging: the invoice itself is often genuine — only the account number has changed.
How does changed-bank-details fraud work?: An attacker — often after compromising a supplier's email — sends an invoice or an 'updated remittance details' notice with a new account number. Everything else matches your history with that supplier, so the payment sails through. The tell is the change itself, which is why screening compares each invoice's bank details against that supplier's history.
Why must fraud screening happen before the payment run?: Because payment is the point of no return. A suspicious invoice caught beforehand costs one verification phone call. Money sent to a fraudulent account is rarely recovered in full — recovery depends on how fast the bank freezes the funds, and the fraudster is faster.
What is a fraud risk score and how should I use it?: DVAP Fraud Screen returns a 0–100 score per invoice with each contributing reason named. Low scores flow straight through; anything scoring 60 or more is routed to a human as an exception. The named reasons matter more than the number — 'bank_details_changed' tells the reviewer exactly what to verify by phone.
Can small businesses screen invoices for fraud without special software?: Yes — as an API call. DVAP Fraud Screen scores one invoice per call, statelessly, with nothing stored; the free tier covers 25 checks a month. The discipline that makes it work is procedural: verify any bank-detail change with a known contact, on a known number, before paying.

Screen your next payment run: DVAP Fraud Screen scores one invoice per call with the reasons named — nothing you send is stored, and the free tier covers 25 checks a month.