Fake Vendor Invoice Fraud: What Small Businesses in Florida Should Do Now

A fake vendor invoice asks your business to pay for something it never ordered or received. It can also be a real-looking bill sent to a new bank account. For small businesses in Florida, the first hours matter most: stop the payment, keep every record, call the bank, and check with the real vendor. This guide covers those steps, then explains when a civil claim may apply. It was written by the business contract and vendor dispute team at KEW Legal. Kristina E. Wilson, a KEW Legal lawyer in Coral Gables, is responsible for this page.

What a Fake Vendor Invoice Looks Like

A fake vendor invoice is a bill for goods or services that were never ordered, never delivered, or never owed. Vendor fraud is the wider problem. It means money is sent to someone who isn’t really the vendor.

Some fraud is a made-up invoice from a company that never worked for you. Another common version is a spoofed vendor email. The sender copies a real vendor’s name, logo, or email thread. Then the sender changes the remittance or bank details. The message looks routine, so it’s easy to pay.

Watch for these red flags:

• A bank account or payment address that changed without a signed notice
• A request to pay today, often with urgent wording
• An invoice that doesn’t match a purchase order or delivery record
• A sender address that differs from the vendor’s real domain by a letter or two

Read the sender’s address character by character. A lookalike domain can pass a quick glance.

Why Small Businesses Are Often Targeted

Small businesses are often targeted because a small office may have fewer checks between an invoice and a payment. When one person receives invoices, matches them, and releases payments, a single convincing message can move money without a second look.

Fraudsters also use public information. Vendor names, staff titles, and current projects can often be found online. A request that mentions a real job looks routine. Some of these payments go out through a normal accounts-payable process, not through a hacked computer system. The person paying may honestly believe the request is legitimate. The fix is a process that checks each request, not only a sharper eye.

Step 1: Stop Payment and Preserve the Evidence

Your first step is to stop any payment tied to the suspicious invoice. Keep every record exactly as it is.

Hold the invoice and any related payment. Don’t reply to the sender, and don’t click links or open attachments again. A reply can tell a scammer that your address is active.

Save the original email with its full headers, the invoice file, all attachments, payment confirmations, and any phone logs. Save them in their original form. Don’t edit, rename, or re-save them.

Write down who received, approved, and released the payment. Add dates and times. Then keep a running timeline of what you found and when.

Timing matters if a dispute reaches court. Your timeline shows when your business learned the facts.

Step 2: Notify Your Bank Right Away

Call your bank’s fraud or treasury team as soon as you suspect a payment went to a fraudulent account. Speed is the main reason to call first.

Ask whether the transfer can be recalled or stopped. Whether that’s possible depends on how quickly the payment is reported and where the money went. The bank may not be able to recover the funds, so don’t wait to ask.

Ask for a reference number. Then confirm the call in writing and keep a copy. A written record shows what you reported and when. Ask the bank to review the receiving account too.

Do this in parallel with the evidence steps, not after them. The bank call and the records should happen the same day.

Step 3: Verify With the Real Vendor, Using Known Contact Details

Contact the real vendor using a phone number or email from your existing records. Never use the contact details printed on the suspicious invoice. A scammer can control those details.

Ask the vendor three questions. Did it issue this invoice? Did its bank details change? Did it receive any payment?

Tell the vendor that its name or email may be used in fraud. That lets it warn its own staff and check its systems. It may also want to know about the exact message you received.

Florida’s Division of Corporations, known as Sunbiz, lists registration and status information for Florida business entities. Use it to confirm the vendor’s exact legal name and status. Florida Division of Corporations (Sunbiz) Keep copies of every confirmation you receive.

Step 4: Tighten Payment Controls Going Forward

A second check before any vendor’s bank details change helps stop these payments before they go out.

Require a second person to approve any new vendor, new bank account, or change to remittance details. Confirm each change with a call-back to a number you already had on file. Never confirm a change by replying to the same email.

Match every invoice to a purchase order and a receiving record before you pay. An invoice with no match gets questioned, not paid.

Limit who can change vendor records. Review access logs on a set schedule so unusual changes get noticed.

Train staff to treat an urgent payment request as a reason to pause and verify. Especially watch email requests. Make pausing a normal, expected step so no one feels blamed for asking.

When a Contract or Civil Claim May Apply

Whether a claim applies turns on one question. Was the vendor truly owed money, or did the payment go to a fraudster? The two paths are different, and so are the deadlines.

If a real vendor was owed money, the claim may look like an unpaid account. In Bushnell v. Portfolio Recovery Associates, LLC, a Florida appeals court stated that a claim for account stated requires proof “that there was ‘an agreement between persons who have had previous transactions, fixing the amount due in respect of such transactions, and promising payment.’” Bushnell v. Portfolio Recovery Associates

If money went to a fraudster, Florida’s civil theft and exploitation statute may apply. It allows a person injured by a violation of Florida’s theft statutes (ss. 812.012-812.037) or s. 825.103(1) to claim threefold actual damages, minimum damages of $200, and reasonable attorney’s fees and court costs, but before filing suit the injured person must make a written demand for $200 or the treble damage amount on the person liable. The injured person must prove the claim by clear and convincing evidence.

Before filing under that statute, the injured person must make a written demand for $200 or the treble damage amount. A person who complies within 30 days gets a written release from further civil liability for that act. Punitive damages may not be awarded under this statute.

Under section 95.03 of the Florida Statutes, any provision in a contract fixing the period of time within which an action arising out of the contract may be begun at a time less than that provided by the applicable statute of limitations is void. Fla. Stat. § 95.03

If your business accepted goods from a real vendor and they don’t match the order, notice rules apply.

No outcome, including recovery of the funds, can be promised. Insurers, auditors, or lenders may also ask questions after a loss. The notices and records from the steps above help with those conversations. For vendor and contract disputes more broadly, see our business contract and vendor disputes page.

Questions Business Owners Ask About Vendor Fraud

Three questions come up after a suspected vendor fraud.

Talk With KEW Legal About a Suspected Vendor Fraud

If an invoice doesn’t match your records, or a payment went to a bank account your vendor never gave you, you don’t have to sort out the legal side alone. Gather the invoice, the emails, the payment records, and the bank reference number before you talk with us. That file gives us the facts we need to review your options.

KEW Legal has offices in Coral Gables and Sunny Isles Beach. We work with business owners across Miami-Dade, Broward, and South Florida. Call 305-990-2300 or send a message through our contact page. The first consultation is free, confidential, and carries no obligation to continue (Spanish: consulta inicial gratuita, confidencial y sin compromiso).