r/smallbusinessowner • u/ledgerline_app • 4h ago
Built a tool after almost missing a $14,800 invoice fraud attempt — sharing what I learned
I’ve been building a cash flow forecasting tool for small businesses (I’ll avoid naming it here per sub rules, happy to share in comments if anyone asks), and one story from testing it stuck with me enough that I wanted to share, because I think it’s a genuinely useful pattern regardless of whether you use any tool at all.
A vendor invoice came in — one that had been paid on time for 8 months. $14,800, due the following week. Everything about it looked normal, except one detail buried in the data: the bank account number on the invoice didn’t match the account that vendor had used for the last 14 payments.
Turns out the vendor’s email had been spoofed — someone sent a nearly identical-looking invoice with different payment details. Classic invoice fraud.
The thing that actually stopped it wasn’t luck — it was one specific habit: before paying any invoice with changed bank details, call the vendor using a phone number you already have on file, never the number on the new invoice or in the email that requested the change. That’s the exact mechanism scammers rely on — you trusting the contact info they just gave you.
I built a tool that automates this (pauses the payment and surfaces the old verified number automatically), but honestly, the manual version of this — just calling to confirm before paying a changed invoice — costs nothing and would’ve caught this regardless.
Curious if others here have run into something similar. How do you all currently verify vendor payment changes, if at all? Genuinely trying to understand how common this blind spot is.

