Pause Before You Pay: How to Spot Fake Invoices and Payment Requests

One of the most common cyber-safety problems in small businesses is not a dramatic hack. It is a normal-looking email that asks someone to pay an invoice, change bank details, or send money quickly.

That is what makes fake invoice and payment-request scams so effective. They look routine. They often appear to come from a supplier, a client, a director, a coworker, or a company the business already knows. The message may use familiar wording, copy a real logo, include a believable invoice number, or refer to a real project or account.

The aim is simple: make the person reading the message act before they slow down and check.

The FTC warns that scammers create phony invoices that look like normal business purchases, impersonate trusted companies or government agencies, and use urgency or pressure to push businesses into paying or sharing sensitive information. The NCSC describes the same pattern as business payment fraud, also known as Business Email Compromise. In those cases, criminals may impersonate a legitimate contact and ask for payment into a different bank account.

For businesses in Trinidad and Tobago, this is worth taking seriously. A payment scam can affect cash flow, vendor relationships, accounting records, and customer trust. The good news is that a simple pause-and-verify habit can stop many of these incidents before money leaves the account.

What to watch for

Be careful with any message that:

• asks for urgent payment or says the matter is confidential
• changes bank account details for a supplier or contractor
• says an invoice is overdue when your records do not match
• comes from an email address that is close to, but not exactly, the real one
• includes unexpected links, attachments, QR codes, or file downloads
• pressures staff to bypass normal approval steps
• asks for sensitive business information, passwords, MFA codes, or account access

One warning sign by itself does not always prove fraud, but it should trigger verification.

What staff should do

Before paying a new invoice or changing payment details:

1. Check the request against your accounting records.
2. Confirm the supplier, invoice number, amount, and purchase history.
3. Use a trusted phone number or known contact method already on file — not the number or link in the email.
4. Get approval through the normal internal process, especially for urgent or high-value payments.
5. Treat bank-detail changes as high risk until verified independently.

If the request came by email, do not simply reply to the same email thread to confirm. If the mailbox or conversation has been compromised, the scammer may be the person replying.

What not to do

Do not:

• pay just because the email looks familiar
• trust caller ID, email display names, or logos by themselves
• click invoice links from unexpected emails without checking
• open attachments from unusual payment requests
• approve payment because someone says it is urgent or confidential
• send passwords, MFA codes, banking tokens, or remote-access codes by email or chat

A real supplier or manager can tolerate a short verification delay. A scammer usually cannot.

What to do if you are unsure

If something feels wrong, stop and escalate it.

Forward the message to your manager, accounts lead, or IT support contact using your normal internal process. If the request involves payment, call the supplier using the number already stored in your records. If anyone has clicked a link, opened a suspicious attachment, entered a password, approved an MFA prompt, or made a payment, report it immediately so the damage can be limited.

Do not delete the message. It may be useful for investigation.

The business habit that helps most

The strongest control is not just a security tool. It is a business rule: no new bank details, unusual invoices, or urgent payment changes should be accepted without independent verification.

This protects the accounts team, protects management, and protects the business from being rushed into a mistake.

At Blue Chip, we recommend treating invoice and payment verification as part of normal cyber hygiene, alongside email security, MFA, endpoint protection, patching, backups, and user awareness. The goal is not to make staff afraid of every email. The goal is to make it easy for them to pause, check, and ask before money or data leaves the business.

Source: FTC — Scams and Your Small Business: A Guide for Business; FTC — Cybersecurity for small business: Phishing; NCSC — Business payment fraud.