By David Wright

Fraud prevention does not require a large security department. It requires a short process that is easier to follow than the scammer’s pressure is to obey.

Why fake invoices work

Small-business owners are trained to keep bills moving. Scammers exploit that habit. In May 2026, the Federal Trade Commission warned that businesses are receiving fake invoices for products or services they never ordered. The documents may imitate familiar companies, use urgent “past due” language, or arrive by email as part of a phishing attempt.

The scam succeeds when urgency replaces verification. A rushed owner or employee sees a plausible bill, recognizes a category such as tech support, domain registration, or search-engine optimization, and pays before confirming whether the company actually ordered anything.

Use a five-minute approval routine

Step 1: Pause on anything unexpected. An unfamiliar vendor, altered payment instructions, a duplicate-looking bill, or sudden urgency is a reason to stop.

Step 2: Match the invoice to an internal record—a purchase order, contract, email trail, or known recurring service. If there is no record, treat the invoice as unverified.

Step 3: Verify the vendor through a contact method you already trust. Do not rely on the phone number, email address, or link printed on the suspicious invoice.

Step 4: Separate verification from payment. If your business has more than one person, use a second approval for new vendors or changed banking instructions. If you are a solo owner, create a deliberate second-channel check before paying.

Step 5: If the message is phishing or fraudulent, preserve enough information to report it and then remove it from the normal payment workflow. The FTC directs businesses to ReportFraud.ftc.gov and recommends forwarding phishing emails to the Anti-Phishing Working Group.

Cybersecurity for the very small business

NIST’s 2026 draft guidance, Small Business Cybersecurity: Non-Employer Firms, is aimed specifically at businesses with no paid employees and minimal IT complexity. That matters because the SBA estimates cited by NIST show that 81.9% of U.S. small businesses are non-employer firms.

The practical lesson is that cybersecurity cannot be designed only for large organizations. A freelancer, single-member LLC, or family business still needs a way to identify important accounts, protect credentials, recognize suspicious activity, respond to incidents, and recover from disruption.

Key takeaway: Unexpected invoices deserve verification, not urgency. Use known vendor records—not the invoice itself—to verify contact information.

Build controls that fit your size

Start with a few controls that are easy to repeat: use multi-factor authentication on email and financial accounts; use unique passwords stored in a reputable password manager; keep reliable backups; maintain a simple vendor list; document who can approve payments; and use a separate verification step for changes to payment instructions.

These controls do not make fraud impossible. They make an attacker work harder and give you more opportunities to notice that something is wrong.

Train for pressure, not just technology

Many invoice scams are social-engineering problems before they are technical problems. The scammer wants speed, secrecy, and habit. Your defense is a routine that slows high-risk transactions down.

A five-minute check can feel inconvenient when the inbox is full. That is exactly why the process should be written down. The point is to make verification the default instead of something you remember only after a loss.

Questions Readers Often Ask

What should I do with an invoice from a company I do not recognize?
FTC recommends checking the company carefully and searching its name with terms such as “review,” “scam,” or “complaint.” Before paying, verify whether your business actually ordered the product or service.

Should I call the phone number printed on the suspicious invoice?
Use contact information from a trusted internal record, prior legitimate invoice, or the vendor’s independently verified website—not contact information supplied only by the suspicious message.

What if the invoice arrived by email?
Treat unexpected attachments and links cautiously. FTC notes that fake invoice emails may be phishing attempts intended to gain access to business data or networks.

Related Practice Resources

• About the Atlanta Small Business Incubator
• Request an Appointment
• Related: SBA Size-Standard Comment Period
• Related: AI for Small Business—Start With the Bottleneck

Sources & Further Reading

• Federal Trade Commission — Run a small business? Pay your bills, not scammers (May 14, 2026)
• NIST — Small Business Cybersecurity: Non-Employer Firms (April 14, 2026)
• FTC — Scams and Your Small Business

Next step: ASBI helps entrepreneurs turn good ideas into repeatable business systems. If your company needs stronger operational routines, planning, or small-business strategy, explore ASBI resources and request an appointment.

Educational business information only. This article is not legal, accounting, cybersecurity, or financial advice. Business owners should consult appropriate professionals for needs specific to their systems, contracts, banking arrangements, and regulatory obligations.