‍Trust, Betrayed: The Anatomy of a Fake Invoice

In 2025, businesses reported losing more than 3 billion dollars to a single kind of fraud. Almost none of it involved breaking in. It arrived as an invoice.

That is the figure the FBI puts on business email compromise for the year: just over 3 billion dollars, and business email compromise is, at its heart, fake-invoice and vendor-impersonation fraud. It is the second most costly category of cybercrime in the United States, and it almost never looks like crime. There is no broken door. There is a familiar vendor, an expected amount, and one detail quietly changed.

If money is trust in motion, then a fake invoice is the moment someone hijacks the motion. It is trust, betrayed.

How the Betrayal Works

Picture the most ordinary thing in your week. An invoice arrives from a supplier you already pay. The logo is right. The amount is roughly what you expected. The email reads exactly like the last one. The only difference, buried in the payment details, is the account number.

That is the entire attack. Not a sophisticated hack, but a familiar relationship, impersonated. Sometimes the criminal clones a vendor's domain, swapping one character no one reads closely. Sometimes they get into the supplier's real email account, so the message passes every security check because it genuinely came from there. Then comes the line that does the damage: a quiet note that the bank details have changed, please update your records.

It works because we have been trained to trust the routine. Nobody re-verifies the invoice they have paid fifty times. As the people who study this fraud put it, these are legitimate-looking payments, and that is exactly what makes them so hard to catch.

Why Manual Invoicing Leaves the Door Open

Here is the uncomfortable part. The reason this fraud succeeds so often is not that criminals are brilliant. It is that most invoicing is built on email and PDFs, and email and PDFs were never built for trust.

A PDF can be edited. An email address can be faked. A bank-detail change can be accepted by a single person, informally, with nothing logging who changed what or when. There is no validated record of who your vendor really is, and no audit trail to reconstruct afterward. So the altered invoice looks like every other attachment in the inbox, right up until the money is gone.

The same gap creates quieter losses too. By SAP Concur's own measure, the typical business sees a duplicate invoice rate of around 1.3 percent, with each duplicate worth roughly 2,000 dollars. That is not even a criminal. That is just a process with no structure, leaking money in the background.

Why This Hits Africa Hard

The exposure is sharpest where money is moving fastest. Across Africa, digital payments have scaled at extraordinary speed, often faster than the controls meant to protect them. Interpol now flags business email compromise as one of the continent's most significant and growing cyber threats, and names Nigeria among its main hubs, with cybercrime losses across Africa estimated in the billions over recent years.

This is also exactly why Nigeria's move to mandate structured, government-validated e-invoicing matters. A validated invoice with a unique reference number is far harder to fake than a PDF in an inbox. The defense is becoming the law.

How You Actually Stop It

The fix is not vigilance. Vigilance fails, because the whole point of the fraud is that it looks normal. The fix is structure.

When vendor records are locked and validated, a bank-detail change cannot be made by an inbound email. It takes an authenticated, logged action. When approvals are mandatory, no single person can both create and pay. When invoices are structured data with unique reference numbers, a duplicate becomes impossible to pay twice and an altered invoice stands out against the original. And when every action leaves an audit trail, the anomaly surfaces in real time, not at month-end when the money has already moved.

That is what settlement-native infrastructure does. It closes the loop between the invoice and the payment, and shrinks the space where a hijacked detail can slip through.

The Takeaway

Invoice fraud is not really a technology problem. It is a trust problem. It works by wearing the face of a relationship you already have, and changing one thing you were never going to check.

You cannot out-careful it. But you can make trust verifiable, so that an invoice has to prove it is what it claims to be before a single naira moves. That is the difference between hoping your team catches the fake one, and building a system where the fake one cannot get through.

Ready to make every invoice prove itself before you pay? See how Curacel Pay keeps your payments compliance-ready and traceable at curacel.co.
See how Pay AI works --> curacel.co/curacel-pay