How to Detect Email Scams and Fake Invoices Before You Click or Pay

You can catch most email scams before you click or pay by checking four things on every suspicious message: the sender's real domain, whether the invoice was expected, whether payment details changed, and where the links actually point. If any of those look wrong, treat the email as high risk and verify through a channel you already trust — a phone number or address you look up yourself, not one in the email. This guide covers the red flags, a fast triage method, and how an in-inbox detection tool fits alongside manual checks.

The four red flags that catch most scams

Most phishing, fake invoice, and payment fraud emails fail on at least one of these points. Check them in order.

1. Look-alike sender domains

The display name says "Accounts Payable" or your real vendor, but the domain behind it is slightly off. Watch for:

• Character swaps: rn for m, l for I, 0 for O
• Extra words: vendor-billing.com instead of vendor.com
• Free or unrelated domains: a "supplier" writing from a generic mail service
• Subdomain tricks: vendor.com.payments-secure.net

Hover over the sender address (or expand it on mobile) to see the full domain, not just the display name.

2. Unexpected invoices

A real invoice usually follows a known order, contract, or recurring cycle. Treat as suspicious:

• An invoice for a service you don't recognize
• A first-time invoice from a vendor you've never paid
• An invoice arriving right after a "we've changed our bank details" email

3. Last-minute payment changes

This is the core of business email compromise. The scammer impersonates a vendor, executive, or colleague and asks you to send money to a new account, often with urgency ("before close of business today"). Any change to bank details should trigger independent verification — always.

4. Suspicious links and attachments

• Link text and the real destination don't match (hover to check)
• Shortened links that hide the destination
• Attachments you didn't expect: .html, .zip, macro-enabled Office files, or invoice files that ask you to "enable content"

A fast triage method: Safe / Caution / High Risk

You don't need to fully investigate every email. Sort them into three buckets and act accordingly.

This is the same logic behind the risk badges in tools like AI Email Genie, which labels messages Safe, Caution, or High Risk and lists the specific signals it found (look-alike domains, invoice anomalies, payment changes, phishing links). The badge is a starting point for triage, not a replacement for your own judgment on anything involving money.

How to verify an invoice or payment request

Verification is the step that actually stops fraud. Do it through a channel the email can't control.

1. Don't reply to the email or call any number in it. A scammer will happily confirm their own fake request.
2. Use a contact you already have. Look up the vendor's number on their official website, a previous legitimate invoice, or your own records.
3. Ask a specific question. "Did you send an invoice dated [date] for [amount] and change your bank details?" A vague "is this you?" is easy to bluff past.
4. Confirm bank details verbally for any new or changed account, ideally with someone you've spoken to before.
5. If you can't reach anyone, wait. A legitimate invoice can survive a delay; a fraudulent payment usually can't be reversed.

When to use a detection tool vs. manual checks

Manual checks work well when volume is low and you know your vendors. They get harder when you handle many invoices and payments daily — which is exactly the situation freelancers, small businesses, and finance-adjacent roles tend to be in.

Use manual checks when:

• You receive few external invoices
• You recognize every sender
• You have time to hover links and inspect headers

Use an in-inbox detection tool when:

• You process invoices and payment requests regularly
• You deal with many unfamiliar senders
• You want a consistent first-pass verdict before you spend time investigating

AI Email Genie is a Chrome extension that adds a one-click "Assistant" to Gmail, Outlook Web, and Yahoo Mail. According to its site, it shows a risk badge, key suspicious signals, and — on Pro — a plain-English explanation of what's suspicious and a recommended next step. It runs analysis only when you click, rather than scanning in the background, and the site states it doesn't sell your data. The free plan includes core signals (Sender Trust, Link Safety, Content Safety, Auth Score), risk badges, and 3 AI deep scans per day on 1 device. Pro adds unlimited AI deep analysis, detailed threat breakdowns, recommended next steps, and priority support, priced at $9.99/month, $79.99/year (3 devices), or $129 lifetime (5 devices), with checkout via Stripe and activation details sent by email.

A tool like this is best treated as a fast triage layer. It can flag a look-alike domain or a payment-change request you might skim past, but the verification step — confirming with the sender through a known channel — still belongs to you.

What to do when you've spotted a scam

1. Don't click, don't pay, don't reply.
2. Report the message using your mail provider's phishing/report button so it's filtered for others.
3. Warn the person or team being impersonated if a real vendor or colleague's name was used.
4. If you already clicked or paid: contact your bank immediately, change any credentials you entered, and report the incident to your IT or security contact.
5. Keep the email as evidence until the issue is resolved.

Quick checklist before you pay any invoice

• [ ] Sender domain matches the real vendor exactly
• [ ] The invoice was expected (order, contract, or recurring cycle)
• [ ] No bank details have changed — or any change was verified by phone
• [ ] Links point to the real domain, not a look-alike
• [ ] No pressure to act "today" or "before close of business"
• [ ] You confirmed through a contact you looked up yourself

If every box is checked, you're in safe territory. If any box fails, verify before you act — that single habit prevents the large majority of invoice and payment fraud.