Invoice fraud is the most expensive document fraud there is, because the document's whole job is to move money. The dangerous version is not a fake company — it is a real invoice from a real supplier with the bank details changed, sent from an address that is one character off the one you know.
Most invoice fraud is one of these. They differ in who sends the invoice and what was changed, which is why a single check never covers them all.
Bank-detail changes are the single highest-value thing to check, and the one most often waved through because the rest of the invoice is genuine.
Compare the remittance details against what you hold for that supplier. If anything differs, confirm by voice on a number you already have — never one printed on the invoice or in the email that carried it. This single control stops most business email compromise losses, and skipping it is how nearly all of them succeed.
Compare the sending domain against the supplier's real one, character by character — lookalike domains swap an l for a 1 or add a hyphen. Then read the headers: a reply-to pointing somewhere else is the tell. Our free email header analyzer does this without an account.
Check the number, amount and date against what you have already processed. Duplicate submission works precisely because the two copies land with different people weeks apart. Docurensic links related documents into a case, so a re-submitted invoice surfaces against the one you already paid rather than being reviewed in isolation.
An invoice altered after issue carries the evidence in the file: an account number or total set in a different font from the rest of the document, an appended revision holding the original value, or metadata naming a PDF editor rather than the supplier's accounting software.
A constructed example — not a real customer file — showing the kind of finding Docurensic surfaces.
The IBAN is set in a different embedded font from the surrounding block and sits in its own appended revision. The recovered earlier revision carries a different account number in the same position.
Forensics · font + revision · strongThe covering message came from a domain registered eleven days ago that differs from the supplier's by one character.
External lookups · domain age · strongAn approval workflow asks whether the invoice is authorised, matches a purchase order, and falls within budget. A fraudulent invoice from a compromised supplier mailbox passes all three, because the goods were genuinely ordered and genuinely delivered. The only thing wrong is the account the money goes to, and no one is asked to check that against anything.
The fraud is designed around that gap. It arrives in an existing email thread, references a real PO, and quotes the correct amount. Docurensic examines the document itself — whether the remittance block was edited after the invoice was created, whether an earlier revision survives, whether the sending domain and the supplier are actually the same entity — and links it to the other documents in the case.
Five layers, one verdict. Every document runs through security, forensics, reasoning, validation, and external lookups — see how the engine works.
A change of bank details, in any form and with any explanation attached. Legitimate suppliers do change banks, so the answer is never to refuse — it is to confirm by voice on a number you already hold, before the payment run, every time.
Frequently, yes. If the figure was typed into an existing PDF it usually carries a different font or sits off the surrounding baseline, and if the file was saved incrementally the earlier revision is still inside it and can be recovered, which shows the original total directly.
Yes — cross-document intelligence links related documents into a case, so a re-submitted invoice is surfaced against the one already processed rather than being assessed on its own. That is the only way duplicate submission gets caught, since each copy is individually valid.
Yes. Invoices can be scanned through the API or pulled from a connected folder, and workflow rules can route anything that fails a check to a human queue, tag it, or alert a channel — so clean invoices flow through and only exceptions cost anyone time.
Other document types
Bank statements · Pay stubs & payslips · Utility bills · All document fraud detection
Free to start. No install, no sales call.