How do you detect a fraudulent invoice?

First and above all: any change to payment details. Legitimate suppliers change banks rarely; fraudsters change them always. Second: pressure — urgency, threats of supply disruption, or requests for confidentiality that discourage verification. Third: sender anomalies — look-alike domains (supplier-inc.com vs supplierinc.com), replies that drop or add recipients, or a new "accounts manager" you have never dealt with. Fourth: payment anomalies — a first-time bank, a personal-account format, a different country, or amounts just under an approval threshold. Any one flag warrants verification; two or more warrant stopping the payment run.

Call the supplier on a number you already had — never one printed on the suspicious invoice or email — and confirm the change with a person you know. Require dual approval for any detail change, enforced in the ERP rather than by convention. Then automate the discipline: manual call-backs decay under AP workload, which is why platforms like Trustmi verify vendor identity and monitor detail changes continuously, flagging the anomalous payment before execution instead of relying on every clerk having a suspicious day.