Invoice Scam Detection: Verify Before You Pay

DEV Community

The invoice scam that changes one line: why "it looks right" is not verification

A supplier sends you an invoice. Same logo, same layout, same amount, same reference. You pay it. Two weeks later the supplier calls: they never got the money. Somewhere between their outbox and your accounts team, one line changed: the IBAN. This is one of the most common business payment scams, and it works for a boring reason: nobody checks the bank details, because everything else looks right. How it usually happens A compromised mailbox. The attacker reads real conversations and waits for an invoice to be sent, then forwards an "updated" copy. A lookalike domain. supplier-invoices.com instead of supplier.com. The email says "we changed banks, please use the attached invoice". An edited PDF. Changing a few characters in a PDF takes seconds, and with AI tools the result is visually perfect: fonts, spacing, everything. The amount is the same, so nothing feels off. That is the whole trick. Why the usual checks fail Looking carefully doesn't work when the edit is pixel-perfect. The file name and date prove nothing: they're trivially copied. "It came from their email" only means it came from an email that looks like theirs. The real question isn't "does this invoice look genuine?" but "is this exactly the file the supplier issued?" And that question has a mathematical answer. Verification with a fingerprint A cryptographic hash (SHA-256) turns any file into a 64-character fingerprint. Change one character of the IBAN and the fingerprint changes completely. So the flow becomes: The supplier seals the invoice when they issue it: its fingerprint is registered. The invoice travels with a verification link. Before paying, you open the link or drop the PDF on the verify page. Your browser recomputes the fingerprint and checks it against the register. Match: it's byte-for-byte the invoice they issued. No match: someone changed something, even if you can't see what. This is what we built TRAMPTO to do. Sealing runs in the browser, so the invoice is never uploaded, and verifying is free and needs no account. What it doesn't replace To be clear about the limits: It proves the file hasn't changed since it was sealed. If the attacker controls the supplier's own system before sealing, the seal won't catch that. It doesn't replace good habits: confirm any bank-detail change by phone, using a number you already had, never one from the email. But for the most common version of the scam, an edited PDF in transit, a fingerprint check turns "it looks right" into "it is right". Your turn Has your company (or a client) ever received an invoice with changed bank details? How did you catch it, or how did it slip through? I'd love to hear the stories.

Powered by Readybot.io