Check your bill: do not fall for invoice fraud

Scammers use information about your purchase and send you a fake invoice that closely resembles one from your supplier. Sometimes criminals even manage to intercept the real invoice, and you get a fake invoice with a different account number instead. This type of crime is called invoice fraud. Read how to recognise fake invoices and avoid making a fake payment.

Invoice fraud was rare 10 years ago, but today it is one of the forms of fraud reported most often to the Fraud Helpdesk. It is a form of business identity fraud (in Dutch): the scammer uses the name and the identity of a well-known company. In invoice fraud, scammers pretend to be your supplier, from whom you recently ordered something or with whom you regularly place orders. The scammer sends you a fake invoice on behalf of your supplier. When you pay, the money goes, not to your supplier, but into the fraudster’s bank account.

Protecting against invoice fraud

These tips will help you recognise fake invoices and protect yourself from invoice fraud: 

• Have you received an invoice? Check that you have actually placed an order. If you have any doubts, ask the sender why you have received an invoice. If there is no proof that you have ordered a product or service, you are simply not obliged to pay an invoice.
• Have you indeed placed an order? Check the order and/or the invoice number on the invoice. Check in your records whether you find a purchase order or an order confirmation that corresponds to the information on the invoice. Check whether the bank account number appears in your records. Fraudsters often use foreign bank accounts.
• Check which email address the invoice was sent from, and whether it contains the correct domain name. Fraudsters will often use a domain name that is quite similar to a real company name. Check whether the domain name matches the website address. For instance, fraudsters replace letters from the domain name with numbers. You may not notice if the number 1 is substituted for the letter l in an email address.
• Do you feel you cannot trust the invoice? If in any doubt, check to see if the name of the sender is correct by calling the client. Use the phone number from your own records and not the one from the invoice that is attached to the email.
• Be extra vigilant about so-called rush payments, where you are asked to deviate from normal procedures. In 2018, the Pathé cinema chain paid a total of €19.2 million to scammers (in Dutch). In this case, the fraudster posed as the company’s senior executive, in a ruse known as CEO fraud (in Dutch).

Paid to the wrong party

Jacob van der Vis, business advisor on the KVK Advisory Team, talks to business owners about fraud. A victim of invoice fraud reported the following: “We placed an order and got an email that looked exactly like the real thing, supposedly from our supplier in the UK. The message contained other bank details, and so we unknowingly transferred a hefty sum to a criminal’s bank account. We found out only a few weeks later, when the supplier asked about the outstanding invoice. We reported everything to the Fraud Helpdesk, the bank, our insurance company, and the police. We lost the €17,000 we had transferred to the criminal.”

Phantom invoice 

Sometimes a scammer will send you an invoice when you have not ordered anything. The amounts involved are often small. Companies send you phantom invoices like this in the hopes that you will not pay attention and just go ahead and pay.

Recognising phantom invoices 

Phantom invoices are often for relatively small amounts. The fraudster assumes that you will not check invoices for small amounts that carefully. To whom is the invoice addressed? A phantom invoice often uses a general rather than a specific salutation. Sending a phantom invoice is a form of acquisition fraud and is a criminal offence. Report it to the Fraud Helpdesk (in Dutch) and file a report with the police.

Who pays for the damage?

Especially in the case of international payments, it is difficult to get your money back. Filing a report with the police is important for the investigation, and helps make the growing problem of invoice fraud visible. The identity of international cybercriminals is difficult to ascertain.

If the criminal used a Dutch bank account number, there are more opportunities to get your money back. Have you paid a fake invoice by mistake? Get in touch with your bank, which may try to undo (in Dutch) the transaction and get the amount back from the fraudster’s bank. If the transaction cannot be undone, and if you have been scammed, you can get the name and address of the sender. A successful trial was conducted in early 2022, with collection agencies holding Dutch scammers liable (in Dutch).

Check your business partner 

On the KVK website, you can check 24/7 who you are doing business with. For example, check who is allowed to sign on behalf of a company. The Business Register (in Dutch) lists all companies, legal entities, and other organisations participating in the country’s economic life. You can use the search function to request information on companies. If you do business in foreign countries, check your business partner in foreign business registers.

Invoice from KVK

Also be alert to invoices you receive from the KVK. There are scammers sending fake invoices in the name of KVK. Have you received an invoice from the Netherlands Chamber of Commerce? Check whether it is correct. There are also scammers offering so-called 'Business Register extracts' online. Do not fall for this. Official extracts from the Business Register can be requested only from KVK, never through other providers.