Customers Are Getting Fake Invoices From My Company: What to Do First

Start with the money, not the email

If a customer has already paid a fake invoice, the email problem is second. The money is first.

Recovering a fraudulent transfer is a race. The FBI's Internet Crime Complaint Center runs a process called the Financial Fraud Kill Chain, in which its Recovery Asset Team asks receiving banks to freeze funds. In 2025 that team initiated 3,900 actions against $1,163,919,846 in attempted theft and froze $679,013,183. A 58 percent success rate. That is a real chance, and it decays by the hour.

Do these at the same time, not one after the other. Hand each job to a different person.

• The customer calls their own bank's fraud line and requests a recall of the funds. IC3's guidance is blunt: contact the financial institution immediately and ask for a recall plus any indemnification documents the bank requires. Banks differ on what they will do, so ask what their process is.
• File at ic3.gov. The form is at complaint.ic3.gov. File regardless of the amount. Include full transaction detail: dates, amounts, sending and receiving account and routing numbers, and the receiving bank's name. If several customers paid, each one should file their own.
• Report to the FTC at reportfraud.ftc.gov. The FTC's own guidance for spoofed businesses tells you to report to local law enforcement, IC3, and ReportFraud.ftc.gov.
• Preserve evidence. Do not delete anything. Ask a customer to forward you a complete original message with full headers, not a screenshot.

Tell your customers how to verify, on a number they already have

Your next job is to stop the next payment. Send one short notice to your customer list and keep it operational rather than apologetic.

Tell them this: we never change bank details by email. If you get an invoice from us with new payment details, or any invoice you were not expecting, call us on the number on our website before you pay. Then print the number.

The word that matters is call. Not reply. Not use the number in the email. IC3's standing advice is to verify any change to account details through a second channel. Someone who controls the email thread also controls the phone number printed inside it.

Put the same notice on your website. If you invoice through a marketplace or a customer portal, post it there too. Plenty of people will never open the email.

Work out which of three things is actually happening

A fake invoice reaches your customer in one of three ways. They need different fixes, and only one of them is an authentication problem.

1. Your real domain, spoofed. The From address is exactly yours. Nothing was hacked. The sender simply wrote your address in the From field, the way anyone can write any return address on an envelope.

2. A lookalike domain. The address is close but not identical: an extra word, a swapped letter, a different ending. The attacker owns that domain and can authenticate it perfectly.

3. A compromised mailbox. Someone is logged into a real mailbox, at your company or at your customer's, and sending from it. The mail is genuine, which is why it passes every check.

You can tell these apart in about two minutes. Ask a customer to send you the original message including headers. In Gmail that is Show original in the three-dot menu. In Outlook, open the message and use File then Properties.

Read the From address character by character against your own. Then find the Authentication-Results header and read what spf=, dkim= and dmarc= say. If dmarc=pass and the domain is exactly yours, you are almost certainly in case three.

If a mailbox is compromised, this is the whole job

This is the case where email authentication does nothing at all for you. The attacker is sending real mail from a real account. SPF passes. DKIM signs it. DMARC passes. Every protection you could buy this week correctly reports the message as legitimate, because it is.

The priority is eviction. Microsoft and Google both publish the procedure, and both are worth following literally, because the steps people skip are the ones that matter.

For Microsoft 365, the article is Respond to a compromised email account in Microsoft 365 on Microsoft Learn. The order is: disable the account, revoke active sessions, review registered MFA devices, review consented applications, review assigned admin roles, then review mail forwarders. A password reset alone is not enough. Existing refresh tokens stay valid until you revoke sessions, and app passwords are not revoked by a password change.

For Google Workspace, the page is Identify and secure compromised accounts. Suspend the account, investigate the log events, reset the password, revoke OAuth 2.0 tokens, delete any app passwords the user created, then restore access with 2-Step Verification enforced.

On both platforms, hunt for the forwarding rule. It is the standard way an attacker keeps reading your invoice threads after you lock them out. Microsoft's guidance tells you to run Get-InboxRule with -IncludeHidden, because rules can be hidden from the Outlook interface entirely.

If it is a lookalike domain

Authentication on your own domain will not touch this. The attacker owns their domain and can pass SPF, DKIM and DMARC on it without any trouble.

What you can do is report it and try to get it suspended. Find the registrar with a WHOIS lookup, then send an abuse report to that registrar's published abuse contact. Since April 2024, ICANN's global amendment to the Registrar Accreditation Agreement requires accredited registrars to maintain an abuse contact, acknowledge receipt of abuse reports, and, where they have actionable evidence of DNS abuse including phishing, promptly take mitigation action. Your report carries weight it did not carry a few years ago.

Send evidence, not outrage. Include the full message with headers, the fake invoice, your real domain, your trademark registration number if you have one, and a plain statement that the domain is being used to defraud your customers.

Be realistic about it. The registrar decides, not you. Reports do fail. And a determined attacker registers another domain the same afternoon for the price of a coffee. A suspension is a win when it comes. It is not a fix.

If it is your real domain, this is the DMARC case

If mail carrying your exact domain in the From address is reaching inboxes, you have no enforced DMARC policy. This is the only one of the three cases where a technical change on your side ends the attack.

In plain terms: SPF lists which servers may send mail for your domain. DKIM adds a signature proving a message was not altered and came from an authorised sender. DMARC is the policy that ties those to the From address your customer actually sees, and tells receiving servers what to do when neither passes. DMARC became an IETF Standards Track specification in May 2026 as RFC 9989, a Proposed Standard replacing the informational specification from 2015.

The policy that matters is p=reject. Anything softer is monitoring. With p=reject published, and every legitimate sending service authenticated first, mail claiming to be from your exact domain is refused before your customer sees it.

Do not jump straight there. Publish p=none with a reporting address, read the aggregate reports, and find every service that sends as you: invoicing software, CRM, help desk, shipping platform, your accountant's practice tool. Miss one and you will block your own invoices. Then move to quarantine, then reject.

One honest caveat on those reports. They only show what participating receivers choose to send back. Gmail, Microsoft, Yahoo and Apple report reliably. Plenty of smaller mail hosts never do. Treat the reports as a strong sample, not a complete ledger.

What this does not do

We would rather you spend nothing than buy the wrong thing, so here is the limit stated clearly.

Getting DMARC to enforcement stops criminals sending mail with your exact domain in the From address. That is the whole of it, and it is genuinely worth having.

It does not stop anyone registering a domain that looks like yours. It does not stop display name spoofing, where the sender name reads as your company and the address underneath is a free webmail account. It does not remove a fake page or a fake profile. It does not recover money. And it does nothing at all if the mail is coming from a real mailbox someone else is logged into.

What it does is narrow the ground. Once your exact domain is off the table, the attacker has to use something a careful person can spot and something you can report.

If you want help with it

We ran this stack on our own business before we sold it to anyone. Bench Clearers is a hockey apparel store we own. It has DMARC at enforcement, a Verified Mark Certificate issued by GlobalSign, BIMI live in Gmail, and Meta Verified on a 52,000 follower Instagram account. All of it went through the platforms' own official channels, which is the only way we work. We never take passwords, ID documents or card numbers. If we look at your situation and do not believe we can get you a result, we will say so and decline rather than take the fee. And if money is moving right now, call the bank and file at ic3.gov before you contact us or anybody else.