The first hours after discovery
With fake invoice fraud, timing matters more than almost anything else. Contact your bank immediately and ask it to send a recall request to the receiving bank, and report the incident to the FBI's Internet Crime Complaint Center, which can sometimes help freeze funds that have not yet moved. Preserve the emails, invoice files, and payment records exactly as they are, and do not delete the messages even though they are fraudulent. If the request came through a compromised email account, yours or the vendor's, secure the account by changing credentials and enabling stronger login protections, while keeping the logs intact for later review. Notify your insurer early, because many policies have prompt notice requirements.
Who bears the loss
Business accounts do not receive the consumer protections that apply to unauthorized electronic transfers from personal accounts. For commercial wires, the allocation of loss often turns on the security procedures agreed between the company and its bank and whether they were followed, and a payment that an employee authorized, even under deception, is usually difficult to recover from the bank. Disputes with the real vendor are common, especially when the vendor's own email was hacked, and the contract terms and each side's precautions shape the outcome. Standard crime insurance policies may not cover social engineering losses unless a specific endorsement was purchased, so the policy language needs a close read.
When the fake vendor is inside
Some fake invoice schemes are internal: an employee sets up a shell vendor, submits invoices, and approves or routes them for payment. Those cases call for an investigation that preserves evidence and protects privilege, careful handling of the employee, and attention to insurance notice and a possible criminal referral. Changes to the vendor master file, bank account updates, and approval logs usually tell the story. Whichever kind you are facing, our first review covers the payment trail, what has been reported so far, and the contracts and policies that may decide who absorbs the loss.
