RILLA Shield← All answers

How to spot a fake invoice

Check the sender domain character by character, compare the bank details against what you paid last time, confirm the ABN on the invoice matches the business you actually deal with, and be suspicious of any invoice that adds urgency. Most fake invoices are copies of real ones with only the payment details changed, so the document itself will look correct.

Why fake invoices look real

The modern version of this scam is not a badly written PDF. Attackers get into a mailbox, read months of genuine correspondence, take a real invoice, change the bank details, and send it from a domain that is one character different from the real one.

That is why 'it looked legitimate' is not a failure of attention. The document is legitimate. Only the destination changed.

The red flags

Any one of these should stop the payment until it is checked.

  • The sender domain is subtly wrong — rn instead of m, an extra letter, .net instead of .com.au.
  • The reply-to address differs from the from address.
  • Bank details differ from the last invoice you paid this supplier.
  • The account name does not match the trading or legal name.
  • Urgency or secrecy language: pay today, do not call, the boss is in a meeting.
  • The ABN is missing, inactive, or belongs to a different entity.
  • GST is charged but the ABN is not registered for GST.
  • The invoice number breaks the supplier's usual numbering pattern.
  • The amount is oddly round, or just under an internal approval threshold.
  • The invoice arrives from a personal email address.
  • Formatting, logo quality, or wording differs from previous invoices.
  • You were not expecting an invoice from this supplier at all.

The two checks that actually catch it

Eyeballing an invoice catches the crude ones. These two catch the good ones:

  • Compare payee details against the last successful payment to that supplier — a change is the signal, regardless of how the invoice looks.
  • Confirm by phone on a number you already had, never a number printed on the invoice.

Automate the comparison

RILLA Shield scans incoming invoices automatically, compares payee and bank details against the supplier's verified history, checks the ABN, and raises an alert before the payment is released rather than after.

Common questions

What is the most common sign of a fake invoice?

Changed bank details on an otherwise normal-looking invoice from a supplier you already deal with. The document is usually a genuine one that has been intercepted and altered.

Can a fake invoice come from a real supplier's real email address?

Yes. If the supplier's mailbox has been compromised, the invoice genuinely comes from their address. This is why bank-detail comparison matters more than checking who sent it.

Is checking the ABN enough?

No. An ABN check is useful but attackers often reuse the real supplier's real ABN. Always pair it with a bank-detail comparison and a phone confirmation.

Make the check automatic

RILLA Shield scans invoices and payee details before payment, flags supplier bank changes, and can hold a pay run automatically when something looks wrong.

See how it works

Read next

How do I verify a supplier's bank details?What is invoice fraud?

Last updated 22 August 2026. General information only, not legal or financial advice.