Invoice fraud

Invoice fraud redirects a payment the victim was already going to make. Rather than inventing an instruction, the attacker alters the destination: forging a vendor’s bank-change request, sending a fake invoice from a real-looking address, or inserting themselves into an existing payment thread.

This library records 7 cases. The concentration in public-sector bodies and school districts is striking, and reflects large, predictable construction and supplier payments combined with lean finance teams.

How the attack runs

1. Identify a real payment relationship, often visible in public procurement records or board minutes.
2. Gain visibility, either by compromising a mailbox in the chain or by researching the contract publicly.
3. Wait for the genuine invoice cycle so the fraudulent request arrives when a payment is expected.
4. Submit the change, typically new bank details or a switch to ACH, framed as administrative housekeeping.
5. Absorb the payment and move it onward through mule accounts before reconciliation.

Documented cases

• New Haven Public Schools lost about $6M (2023). Attackers hijacked the chief operating officer’s email, watched a genuine $5.9M bus-contract thread, then redirected it.
• Dickinson Public Schools lost $4.92M (2026) across two building-fund payments.
• Johnson County Schools lost $3.36M (2024) to fraudsters impersonating the textbook supplier Pearson from a look-alike domain.
• Pine Bluff School District lost $3.2M (2025) when a real invoice thread between the district, its contractor and its architect was hijacked.
• PRIDCO lost $2.6M (2020) to a forged “change your remittance account” email.
• Cabarrus County lost $1.7M (2019) to a forged bank-account-change request from a school construction contractor.
• The School District of Philadelphia lost nearly $700,000 (2024) after impersonators switched two vendors to ACH.
• A Wheeling economic development body lost $30,750 (2024) on a redirected solar-panel installation payment.

How it differs from related techniques

CEO fraud fabricates authority from above; invoice fraud impersonates a counterparty sideways. Business email compromise is the umbrella term for both. Supply-chain social engineering targets the vendor to reach the customer, rather than merely imitating the vendor.

The control that would have stopped it

• Bank-detail changes must never be actioned from an inbound message. Treat them as a controlled process with verification against records held before the request arrived.
• Callback on a stored number, not one supplied in the email or invoice.
• Check the sending domain character by character on any payment-related change. Johnson County turned on a look-alike domain.
• Reconcile large scheduled payments against the contract rather than the invoice.
• Watch for thread anomalies. In New Haven and Pine Bluff the attacker was inside a real conversation, so tone and history looked correct; the tell was the change itself, not the writing.