Week 5 · Wednesday
Fake invoices, impersonation, and AI voice scams
Use purchase records, a known contact number, and a clear approval process to check invoices, payment changes, and urgent calls.
Imagine a contractor is preparing to pay a familiar supplier. An email arrives with the right company name, a believable invoice, and one change: use these new bank details.
A few minutes later, someone calls and says the payment needs to go through today.
The invoice and the call seem to support each other. But if both came from the same scammer, neither independently confirms the request.
For a small business, the practical protection is a payment process that still works when the message looks convincing or the caller sounds familiar.
Separate a bill from proof that you owe it
An invoice is a request for payment. Before paying, connect it to work, goods, or a service your business actually authorized.
A familiar amount or an official-looking layout does not answer those questions.
The FTC warns that businesses receive fake invoices for services they never ordered, including technology support and website-related services. Some arrive with a past-due claim to add pressure. FTC: Small business invoice scams.
Start with your own records. Who approved the purchase? What was supplied? Does the amount match the agreement? Has it already been paid?
If you cannot find the purchase, put the invoice on hold and investigate through a known contact. Do not let “past due” substitute for an explanation of what you bought.
For example, an unfamiliar website renewal notice should send you back to your technology inventory and existing provider records. It should not automatically send you to the payment button in the notice.
A real supplier can still be impersonated
Impersonation means pretending to be another person or organization. A scammer might copy a supplier's name, use a similar email address, or exploit a compromised account.
A compromised account is one someone has gained unauthorized access to. This matters because the risk is not limited to messages from obviously strange addresses.
The FBI describes business email compromise as fraud using messages that appear to come from a known source. Its guidance specifically calls for verification when account numbers or payment procedures change. FBI: Business email compromise.
Treat a new payment destination as a separate decision from approving the original bill. The work may be legitimate while the replacement payment instructions are not.
That distinction applies whether you run a shop in Swansboro, arrange jobs around Jacksonville, or handle payments from home.
Use an independent callback
A useful callback means ending the unexpected conversation and contacting the person through a number you already know to be correct.
Use a contact saved before the request arrived, such as the supplier's number in your established business records. Do not use a replacement number supplied in the same email.
Ask about the specific request, including the claimed change. “Did you send me an email?” is less useful than confirming what the person asked you to change and why.
If you cannot reach the right person, keep the payment change on hold. An unanswered call is not confirmation.
A simple phrase can make the check easier:
“We verify payment changes through the contact details already in our records. I will call back through our usual number.”
Use the same process for familiar suppliers and people with impressive job titles. A verification rule is easier for staff to follow when the owner follows it too.
A familiar voice is not enough
AI can be used to generate audio that imitates a person's voice. This is often called voice cloning.
The FTC describes scams in which a caller uses a familiar-sounding voice to support an urgent request for money. It recommends checking through a number already known to be correct. FTC: Voice cloning and fake emergencies.
The business lesson is to verify the action being requested rather than rely on how the caller sounds.
Imagine an employee receives a call that sounds like the owner, asking for an unusual purchase while saying, “I cannot talk. Keep this between us.” The employee needs permission to pause and use the established callback process.
They do not need to prove that AI was involved. A real person using an invented story can create the same pressure. Listening for a robotic voice is not a dependable approval process.
A shared private phrase may be an additional check in a process your team agrees on, but it should not replace independent contact and the normal payment approval.
Keep verification and approval distinct
Confirming who asked for something does not mean the purchase is approved. A genuine supplier can send an incorrect invoice, and a genuine employee can request a purchase outside their authority.
A practical checklist separates the decisions:
| Decision | Evidence to check |
|---|---|
| Did we authorize this purchase? | The order, agreement, or approval record |
| Does this bill match the work? | The goods or service received and the agreed amount |
| Is the payment destination correct? | Existing records and independent confirmation of any change |
| Who may approve payment? | Your business's normal approval rule |
| Has this already been paid? | The payment record |
Where staffing allows, have a second authorized person review unusual payments or destination changes. The second person should check the supporting records, not simply approve because someone else has already looked.
If you work alone, keep the independent callback and written record. Being the only approver does not make the requester your verification source.
Make the pause an ordinary part of work
Tell staff which changes require a check and where to record the result. Include who was contacted, which established contact route was used, what was confirmed, and who approved the payment.
Keep sensitive payment details in the appropriate business system. The verification note does not need to become another unprotected copy of account information.
If someone suspects a payment has already gone to a scammer, contact the bank or payment provider promptly through a trusted route. Do not wait for the next accounts review. Friday's article covers the response.
A fifteen-minute exercise for your business
Choose one recurring supplier and review the process without changing any real payment details.
- Find the record of what you buy and who approves it.
- Locate the supplier's established contact number.
- Agree who checks a request to change payment details.
- Decide what happens if that contact cannot be reached.
- Rehearse a fictional urgent call asking someone to bypass those steps.
Write a short rule your team can actually use: “We hold payment changes until the request is independently confirmed and approved.”
Your takeaway: Verify the purchase, the requester, and the destination before approving a payment. A convincing invoice, familiar voice, or urgent deadline does not replace those checks.
On Friday, we will work through what to do if someone has already clicked, shared information, or acted on a suspicious request. Follow the Small Business Learning Series.