International freelancer payments
Freelance Invoice Payment Fraud: Spot and Stop It
Invoice payment fraud usually works through one changed detail: a new bank account, payment link or refund address sent from a real or lookalike email. Treat every change of payment details as unconfirmed until you or your client check it by phone or portal through a contact you already had. If money has already gone to the wrong account, the payer should call its bank at once.
By DmytroUpdated 10 min read
Short answer
- Confirm any new bank account, payment link, amount or currency through a contact you had before the request: a known phone number or the client’s portal. The FBI recommends this check.
- A small test payment proves only that money reaches the new account, not that the account belongs to the right person.
- Never refund an overpayment to a different account. The FTC warns that a fake check can take weeks to be discovered, and you then owe the bank the money.
- If money already went to the wrong account, the payer contacts its bank immediately. In the UK, scam payments by Faster Payments or CHAPS can be reimbursed up to GBP 85,000.
How invoice payment fraud works
Fraudsters borrow a real relationship and change the one detail that moves the money.
Someone imitates the client’s finance team and asks you to use a new payment portal; someone imitates you and asks the client to pay a new account; or a hacked mailbox forwards a real invoice with one changed line. The message can carry the right logo, project name and invoice number. That is why you check the detail that moves money, not how the email looks.
Set a simple rule with every client: a change to the bank account, recipient name, payment link, currency, amount, due date or refund address is confirmed through a contact you already have before anyone pays. The rule is about the process, not about the person, so it is easy to explain.
| Changed detail | Why it matters | What to do |
|---|---|---|
| Bank account or recipient | Redirects a real payment | Call a known number and compare the exact new details |
| Payment link or provider | Can collect money or log-in details | Open the provider through its own website, not the link |
| Amount, currency or due date | Creates overpayment, loss or a dispute | Check against the contract and the last approved invoice |
| Refund address | Turns a correction into a second loss | Find the original payment and refund only to its source |
| Email address or chat account | May be a lookalike or hacked account | Reply through the contact details already on file |
Keep one approved payment record and version every invoice
A clear record makes a real change easy to prove and a fake one easy to spot.
When you start with a client, note the facts you have already checked: the client’s legal name, the project and finance contacts, the email domains they normally use, how invoices are approved, the agreed currency and the payment route. Keep this note where only you can change it.
Give each invoice one number. If a real correction is needed, issue a new version such as INV-104-R1, say what changed, keep the original and send it through the usual channel. Never quietly replace a PDF that was already sent. Follow the invoicing rules of your country for corrections; some require a credit note instead.
Checklist
- Client legal name and a named finance contact from a checked source.
- A unique number, issue date, due date, amount and currency on every invoice.
- Your recipient name and payment details exactly as your account shows them.
- Corrections issued as a new version with the reason stated.
- Earlier versions, approvals and the original email kept.
- No passwords, codes, card security numbers or ID scans on any invoice.
How to verify a change of bank details
Use a contact that existed before the request, never one given in it.
Example: invoice INV-77 for EUR 800 arrives again as a familiar PDF with a different IBAN, and the sender suggests “a EUR 1 test first.” Stop both the test and the EUR 799 balance. A test that arrives proves only that the new account receives money.
Call the client’s finance contact on the number you already had, or check in its usual portal. Read the new beneficiary name, account number, invoice version, amount and currency aloud and compare them exactly. “Yes, we changed banks” is not enough: the contact has to confirm the exact account shown in the PDF.
Write down who confirmed, when and on which channel. If the contact denies the change, warn the real client and stop the instruction. Nobody legitimate needs your password, a one-time code or remote access to your computer to confirm an invoice.
Step by step
- Pause the changed instruction.
- Call or message the contact through a channel you had before the request.
- Compare the full new details, invoice version, amount and currency.
- Record the confirmation and issue a dated corrected invoice if needed.
- Pay or accept payment only when the confirmed details match.
Five warning signs in emails and payment links
One sign is a reason to check; several together are a reason to stop.
Read the full sender address, not just the display name: a domain with one changed letter, a different ending or a new reply-to address. Notice pressure to pay before you can check, a switch from the client portal to a file-sharing link, a request to use a personal account, or any request for passwords, codes or remote access.
Reply in neutral words that work whether the change is real or not: “These payment details differ from the ones on file, so I will confirm them with your finance team by phone before we go ahead.” Send evidence only to the real client contact you found yourself.
| Sign | Possible innocent reason | What to do |
|---|---|---|
| New sender domain | Rebrand, merger or new staff | Confirm through a phone number or portal you already had |
| New bank details close to the due date | A real change of bank | Confirm the exact details outside the email thread |
| Urgency or a request for secrecy | A rushed internal process | Pause and ask for normal written approval |
| Different payment link | A new billing tool | Open the provider’s site yourself and check the client record |
| Request for passwords or codes | None: no payment needs them | Do not share them; contact the provider through its official site |
Confirm payment in your account, not from a screenshot
Sent, pending, returned and credited are different states.
If the client says it paid, ask for the date, amount, currency, method and reference, and look for the credit in your own account. A screenshot can be old, edited or show a payment that was only started.
If an unexpected payment arrives, refund it only to the account it came from, through your bank or provider, after checking the original transaction. Never send money to a new account named in an email.
Overpayment scam: a “client” sends a check or payment for 1,500 against a 1,000 invoice and asks you to send the 500 difference to someone else. The FTC warns that it can take weeks for a bank to find out a check is fake, and by then you have to pay the money back to the bank. Do not send the difference; ask your bank or provider to look at the payment.
| Record | What it shows | What it does not show |
|---|---|---|
| Approved invoice version | What the client agreed to pay | That the client sent anything |
| Client’s payment confirmation | What the client believes it sent | That the money reached your account |
| Your account statement | What was credited, when and from whom | Why a fee or delay happened |
| Transaction reference | Which payment the bank can trace | Whether the money can be recovered |
If money went to the wrong account
Call the bank first, secure your accounts second, keep the evidence throughout.
The payer should contact its own bank or payment provider at once, using a phone number or app it finds itself. Speed matters: the sooner the bank acts, the more options it has. Do not ask the client for a second payment until the first one is resolved.
In the UK, people, microenterprises and charities who paid a scammer by Faster Payments or CHAPS can claim reimbursement of up to GBP 85,000 within 13 months of the payment; firms may apply an optional GBP 100 excess, and the refund is due within 5 business days of the claim (Payment Systems Regulator, rules in force since 7 Oct 2024). Other countries have their own rules.
If your own email or account may be compromised, change passwords on the real sites, sign out other sessions, check recovery options and turn on two-factor authentication. Keep the evidence before you delete anything.
Checklist
- Original email, headers if available, attachments and every invoice version saved.
- Dates, times, channels and the people you spoke to written down.
- Bank and provider case numbers kept with the invoice.
- Passwords changed and other sessions signed out on the real sites.
- Evidence shared only with the real client contact, your bank or provider and official reporting services.
- No second payment until the first one is resolved.
FAQ
How do I verify a client’s request to change bank details?
Call the client’s finance contact on a number you already had, or check in its usual portal, and compare the exact new account details, amount, currency and invoice version. Do not use the phone number or link in the change request.
Is a strange sender address proof of fraud?
It is a reason to stop and check. Companies change domains and staff, so confirm the request through a contact you already have and write neutrally: the details differ from the ones on file and need confirming.
What should be on a freelance invoice to reduce fraud risk?
A unique number, issue date, amount and currency, the work description, your recipient name and payment details, and a version label if anything changes. A short line can say that changes of bank details are valid only after confirmation by phone.
The client paid a fraudster’s account. Should it pay me again?
First the client should contact its bank at once and keep the evidence. A second payment before the first is resolved can make tracing harder. Agree how the invoice will be settled once the bank has explained the options.
Can I get money back after paying a fake invoice?
It depends on the payment and the country. In the UK, scam payments by Faster Payments or CHAPS can be reimbursed up to GBP 85,000 if you claim within 13 months. Elsewhere, contact your bank at once and ask about a recall.
Sources
- Business Email Compromise — FBI
- Fake check and overpayment scams — Federal Trade Commission
- UK APP fraud reimbursement protections — Payment Systems Regulator
Fees and terms change, so check the provider’s current price page before you sign up. How we compare