When people think of invoice fraud, they picture a fake invoice from a company that doesn't exist. Those exist. But in our data they are rare, and they are not where most of the money goes.

We looked at three months of purchase invoices that Cashfeed processed for hundreds of companies. Here is what actually stood between those invoices and a wrong payment, and what you can check yourself, with or without software.

1. The same invoice, twice

The most common wrong payment isn't fraud at all. It is paying a real invoice twice.

Invoices arrive more than once all the time: the original and a reminder, a Peppol invoice and its e-mailed PDF, a copy a colleague forwards "just in case". About one in six files that reached Cashfeed was a copy of an invoice it already had: the exact same file, or the same invoice number from the same supplier. Those were set aside without anyone having to look. About one in forty invoices looked like a copy without being identical. Nearly nine in ten of those were indeed removed as duplicates.

What to check: supplier, invoice number and amount together. Not the file name, not the channel. A duplicate check that only works within one mailbox misses the Peppol invoice and its PDF copy, which we wrote about in Ten months of mandatory Peppol.

And every duplicate check is only as good as the data it compares. A total misread on a scan turns a copy into a "new" invoice. Be suspicious of two invoices with the same number and a slightly different amount.

2. The right supplier, the wrong bank account

The fraud that costs companies the most is usually not a fake invoice. It is a real invoice with a different account number. A hacked mailbox at the supplier, an e-mail announcing that "our bank details have changed", a PDF edited on its way to you.

About one in two hundred invoices in Cashfeed carried a new bank account for a supplier that already had another account on file. Most were genuine: suppliers switch banks, open a second account, or move to a payment provider. One printed "NEW BANK DETAILS!" in capitals on a large prepayment, with an account at a foreign fintech. It was genuine. Another came from a company, payable to an account in the name of a private person. You cannot tell from the document alone, and that is exactly the point.

What to check:

• Never confirm a new account through the contact details on the invoice, or in the e-mail that announced the change. Call the supplier on a number you already had.

• Check that the account is in the supplier's name. Since October 2025, banks in the euro area check whether the name you enter matches the account holder before a transfer goes out. Don't click past a mismatch warning. Cashfeed does the same: when you pay from Cashfeed, it checks the name against the account holder for every invoice and shows you the result before anything goes out.

• Check that the country makes sense. A Belgian supplier paid into an account abroad is not necessarily fraud, but it is worth a phone call.

In Cashfeed, a new account for a supplier that already has one is marked as unverified. An invoice on that account can't be paid from Cashfeed until an admin has verified it.

3. The right supplier, a different sender

A variation on the same theme: the invoice looks real and comes from a supplier you know, but from an e-mail address that supplier never used before. A lookalike domain, a free mail account, one letter off.

At nearly one in five companies, at least one invoice like this was held until someone had looked at it. Nearly a quarter of those invoices were deleted.

What to check: compare the sender with the address on previous invoices from that supplier. Read the domain letter by letter.

In Cashfeed, an invoice from a known supplier that arrives from an unknown address is held, with the reason on screen. An admin can add the address to the supplier's list with one click.

4. The invoice nobody ordered

Then the fake invoices in the strict sense. They come in a few recognisable shapes:

• A letter that looks official. A "company register", a trademark office, a VAT registration service. The real bodies don't invoice like this, and certainly not to an account in a country that has nothing to do with them.

• "This is not an invoice" in the fine print of a document that looks exactly like one. It is an offer dressed up as a bill.

• A subscription you never signed, with automatic renewal.

• A real company, selling a real service, that nobody ordered. This autumn, a foreign company sent invoices of €400 to €750 for "business data monitoring" to several Belgian companies within two weeks, followed by reminders. Warning lists in three countries name it. The invoices themselves looked perfectly ordinary.

For that last kind, the document alone gives nothing away. That is why Cashfeed checks every supplier a company receives an invoice from for the first time against public warning lists and scam reports on the web, before the invoice moves on. A supplier named in a warning is held, with links to the sources. And because the result is shared across Cashfeed, a supplier flagged at one company is recognised at the next.

And there is a grey zone: memberships, sponsorship requests and directory listings that are entirely legitimate, but that nobody asked for, sent with a pre-filled transfer.

What to check: did someone here order this? That one question beats any document check. An invoice that looks perfectly normal gets through every automated check there is. It does not get past the colleague who knows nobody ordered it. That is why an approval step with the person who placed the order is worth more than any red flag.

Cashfeed reads PDF invoices for the signs above: an official body being imitated, a disclaimer in the fine print, an account that doesn't fit the claimed identity, pressure to pay fast. A suspicious document is held with an explanation, and unsolicited offers get their own label. The check is deliberately cautious. Fewer than 1 in 1,000 PDF invoices gets flagged, and many of those turn out to be genuine but unusual documents, like a tax notice or a notary's provision request. A minute to dismiss one is cheaper than a payment you can't reverse.

A checklist before you pay

Cashfeed asks all of these questions for you, on every invoice. Paying outside Cashfeed? Then ask them yourself.

• Did we order this, and did we receive it? Cashfeed sends every invoice through your approval flow and, where you have them, matches it against the purchase order and the goods receipt.

• Is this invoice number new for this supplier? Cashfeed compares every invoice with the ones it already has.

• Have we paid this supplier before, to this exact account? A new account is marked as unverified and can't be paid from Cashfeed until an admin has verified it.

• Did it come from the address this supplier always uses? An invoice from an address the supplier never used before is held.

• Is the account in the supplier's name, in a country that makes sense? Cashfeed flags an account that doesn't fit the supplier, and checks the name against the account holder when you pay.

• Does the "official" letter really come from that authority? Cashfeed recognises documents that imitate an official body, and disclaimers in the fine print.

• Is the company new to you? Cashfeed checks it against public warning lists and scam reports.

• Is anyone pushing you to pay today? Pressure to pay fast is one of the signals Cashfeed reads in every PDF invoice.

Where Cashfeed fits

All of these checks run before an invoice reaches the payment queue, not after the money is gone. That includes the warning-list check on every new supplier. A held invoice shows why it was held. And when you pay from Cashfeed, it can't be paid until someone has looked at it.