How to Check If an Invoice Email Is Fake Before You Pay or Click

Updated

Treat every unexpected invoice as unverified until you confirm it through a channel you already trust. The fastest safe path is: inspect the sender's real address and domain, compare the invoice details against your own records, inspect any payment link without clicking it, and then verify the request by phone or a known contact — never by replying to the email. If any of those checks fails, don't pay and don't click; report it instead.

This applies whether you're a freelancer, a small business handling vendor payments, or an employee who forwards invoices to finance. The steps below work with any email client, and tools like AI Email Genie (a Chrome extension for Gmail, Outlook Web, and Yahoo Mail) can add a risk badge and red-flag summary on top of your own checks.

Start with the sender, not the display name

The display name ("Acme Billing") is free to fake. The address behind it is where fakes usually show.

  • Expand the sender to see the full email address, not just the name.
  • Check the domain character by character: acme-invoices.com, acme.co, and acmebilling.net are not acme.com.
  • Watch for look-alike tricks: swapped letters (rn for m), added hyphens, or a legit brand name in the subdomain (acme.com.billing-secure.net).
  • Check the Reply-To address if your client shows it. A mismatch between sender and reply-to is a strong signal.
  • Confirm the address matches the one you've used before, not just the company name.

If the sender is a free mailbox (Gmail, Outlook.com, etc.) claiming to be a company's billing department, treat that as a red flag on its own.

Compare the invoice against your own records

A fake invoice often gets the details almost right. The gaps are where it fails.

What to check What a fake often shows
Amount Slightly different from the PO or quote, or a round number you don't recognize
Invoice number Missing, duplicated, or out of sequence with prior invoices
Bank details Changed from the account you've paid before
Payment terms Sudden urgency — "due today," "wire only," "avoid late fees"
Line items Vague descriptions, or services you didn't order
Vendor contact A new phone number or email you've never seen

Pull up the last real invoice from that vendor and compare side by side. Changed bank details are the single highest-risk signal — that pattern is the core of business email compromise and invoice fraud. If the account number moved, stop and verify before anything else.

Inspect links before you click

Payment portals and "view invoice" buttons are common delivery points for phishing.

  • Hover over the link (or long-press on mobile) to see the real destination URL.
  • Check the domain in that URL, not the link text. Text can say acme.com/pay while the destination is something else entirely.
  • Be wary of shortened links, redirects, and login pages that ask for credentials you'd normally enter elsewhere.
  • If the email pushes you to a portal to "confirm payment details," open the vendor's site yourself by typing the known address rather than using the link.

Tools that surface link safety can help here. AI Email Genie, for example, lists "Link Safety" among its core signals and shows red flags like phishing links alongside a Safe / Caution / High Risk badge — but the hover check is something you can always do yourself.

Check authentication and warning cues

Your email provider often already knows something is off.

  • Look for spam or warning banners your provider adds. Don't dismiss them.
  • If you can see headers, check SPF, DKIM, and DMARC results. A fail or softfail on a domain that claims to be a real company is a serious problem. AI Email Genie exposes an "Auth Score" indicator for this.
  • Note whether the email arrived outside normal billing cycles, at odd hours, or as a reply in a thread that suddenly changed tone.

Authentication passing doesn't prove the invoice is real — a compromised legitimate account can still send a fake invoice. It's one signal, not a verdict.

Verify through a separate channel

This is the step that catches the fakes the technical checks miss.

  • Call the vendor using a number from your own records, a contract, or their official website — not the number in the email.
  • Ask a specific question: "Did you send invoice #4821, and has your bank account changed?"
  • For internal requests, confirm with the person directly in person, by chat, or by a known phone number.
  • Never verify by replying to the suspicious email or using contact details it provides.

If you can't reach anyone and the payment is urgent, that urgency is itself a reason to wait.

If the invoice is fake: what to do

  1. Don't pay and don't click any further links.
  2. Don't reply — replying confirms your address is live.
  3. Report it to your email provider (spam/phishing report) and to your finance or security contact.
  4. Warn the real vendor if their name was impersonated, so they can alert other customers.
  5. If you already paid, contact your bank immediately — wire recalls are time-sensitive.
  6. If you entered credentials, change that password and enable two-factor authentication.

Where a detection tool fits

Manual checks cover the essentials, but they're easy to skip when you're busy. A tool can add a consistent layer:

  • AI Email Genie runs on-demand analysis when you click, rather than scanning in the background, and adds a risk badge plus red flags (look-alike domains, invoice anomalies, payment changes, phishing links) inside Gmail, Outlook Web, and Yahoo Mail.
  • Its Free plan includes core signals (Sender Trust, Link Safety, Content Safety, Auth Score), risk badges, and 3 AI deep scans per day on 1 device.
  • Pro plans add unlimited AI deep analysis with plain-English explanations and recommended next steps: Monthly $9.99, Yearly $79.99 (3 devices), or Lifetime $129 once (5 devices).

A badge is a prompt to look closer, not a replacement for verifying payment changes with a phone call. Use it to catch what you'd otherwise skim past, then do the confirmation step yourself.