Invoice fraud costs businesses and individuals billions every year — and the mechanics are straightforward. A forger creates a supplier that doesn't exist, swaps a legitimate vendor's IBAN for their own, or raises a real invoice's total before passing it on. By the time the payment clears, the money is gone.
The good news is that altered invoices leave traces — in the PDF's metadata, in the maths, in the fonts and in the supplier's public records. Work through the checks below before you pay or book any invoice you did not generate yourself.
Common invoice-fraud patterns
Most fake or altered invoices fall into one of four categories: a wholly invented supplier (non-existent company, plausible name); an IBAN swap on a real supplier's invoice, redirecting payment to a mule account; an amount or line-item edit on a genuine document; or a duplicate invoice submitted twice for the same work. The last two rely on the document having passed through an editor after the legitimate issuer created it — which leaves the most detectable traces.
1. Verify the supplier and tax ID
Every legitimate business invoicing you must have a registered tax identity. In the EU and UK that means a VAT number (or equivalent tax ID). Check the number against the relevant public register — VIES for EU cross-border VAT, HMRC's VAT checker for UK numbers. For Polish suppliers verify the NIP at the official CEIDG or KRS register; make sure the company name, address and NIP on the invoice all match the register entry exactly. A mismatch — even one transposed digit in the NIP — means the invoice is either wrong or fraudulent. Cross-check the physical address: invented suppliers often use residential addresses or non-existent streets.
2. Check the bank account and IBAN for swaps
Invoice-redirection fraud — where an attacker intercepts a genuine invoice and changes only the IBAN — is one of the most profitable forms of payment fraud because everything else looks legitimate. Never rely on an IBAN printed on a PDF you received by email. Call the supplier on a number you sourced independently (not from the same email thread) and confirm the account before any payment above a low threshold. If the IBAN country code or bank prefix has changed since the last invoice, that is a hard stop — ring and confirm before proceeding. See our guide on verifying a payment confirmation for related checks once the transfer is made.
3. Read the PDF metadata
Open the file properties (Adobe Reader: File → Properties) and look at the Producer, Creator and Author fields. A genuine invoice generated by accounting software will usually name that software — e.g. a specific invoicing platform, ERP or billing system. If the Producer shows Adobe Acrobat, LibreOffice, Microsoft Word or an image editor, the document was opened and re-saved after it left the issuer. Next check the modification date: it should match the invoice date. A file last modified days or weeks after the stated issue date is a strong indicator of tampering. Forensic analysis goes deeper — reading embedded edit layers and incremental-update history that a viewer never shows you.
4. Recompute net, VAT and gross
Line totals must add up. VAT must be calculated at the stated rate. Net + VAT must equal gross. Forgers who alter a single line item or the grand total often forget to recalculate the tax or the column subtotals. Do the arithmetic yourself — multiply quantities by unit prices, apply the VAT rate, sum the lines. If anything does not reconcile, the invoice has been altered. This is the fastest single check and catches the majority of careless edits. For context on how the same check applies to bank documents, see the bank statement guide.
5. Watch for duplicates and recycled templates
Duplicate invoices — the same work billed twice under slightly different invoice numbers or dates — are a common internal fraud in larger organisations. Keep a register of invoice numbers per supplier and flag any number that falls out of sequence or reuses a prefix. Also watch for template recycling: a forger who makes multiple fake invoices from the same document often leaves consistent formatting artefacts — identical spacing, the same placeholder text fragments, or a suspiciously round sequential numbering that does not match a real business's billing cadence.
6. Fonts, alignment and visual tells
Zoom to 400% and scan the invoice line by line. Accounting software renders every figure in a consistent font, size and baseline. An altered amount is typically pasted from a different source and sits fractionally off — wrong weight, slightly different character spacing, or a baseline that does not align with the rest of the row. A logo with soft edges or colour banding was taken from a screenshot rather than the original asset file. These tells are subtle at normal zoom and obvious when you enlarge.
When to run a forensic check
Manual checks catch careless alterations. A methodical forger — or a generative-AI tool — can produce an invoice that passes the naked-eye tests while still carrying editing traces in its internal structure. When the amount is significant, when the supplier is new, or when something simply feels off, verify the document forensically. See our guide on AI document fraud for how AI-generated fakes behave differently. Forensic verification analyses the object tree, font fingerprints and edit-history layers that no viewer exposes, and checks whether the file is internally consistent with the software it claims to come from.
What forensic verification adds
Forensic analysis does not rely on a forger being careless. It reads the parts of the PDF that humans never open: the cross-reference table, incremental-save history, embedded font descriptors and metadata streams. Together these reveal whether the document was produced in one unbroken session by the stated software, or whether it was opened and modified after the fact. The method is universal — it reads the file itself rather than matching it against a catalogue of issuers — and every result is scored with a confidence rating. All files are handled under strict security and GDPR protocols and deleted after review. Browse all our verification guides for the full picture of what document fraud looks like in practice.
Frequently asked questions.
What are the most common signs of a fake invoice?
A changed bank account or IBAN, a supplier or tax ID that does not check out in the business register, metadata showing the PDF was made in an editor rather than accounting software, and VAT or totals that do not recompute.
How does invoice fraud usually work?
Most often a criminal intercepts or imitates a genuine supplier's invoice and swaps only the bank account, so your payment lands in their account. Everything else looks normal — which is why the account number deserves the closest check.
How can I verify an invoice before paying it?
Confirm the supplier and tax ID in the official register, compare the bank account with previous invoices, recompute net, VAT and gross, and check the PDF metadata for edit traces. For large amounts, confirm any change of bank details by phone using a number you already have on file.
Checking these documents inside your product?
The same check runs as a REST API for software that receives documents from its users:
