A cleaning-supply bill for $387. A domain-renewal notice for $199. A “past due” invoice for an SEO package nobody remembers buying. Small businesses across the country are pulling these out of their mailboxes, and the senders are banking on one thing: that someone in accounts payable will assume a coworker placed the order and cut the check without a second thought.
The Federal Trade Commission warned in May 2026 that fake-invoice mailings targeting small firms are still circulating widely. The letters look like routine bills, complete with due dates, account numbers, and “remit to” addresses designed to mimic real vendors. Once a payment leaves the building, the money is almost always gone for good.
How the scam works
Scammers send paper invoices for products or services the business never ordered. The documents are formatted to look nearly identical to legitimate bills, and they often reference vague services like “annual web directory listing” or “office maintenance supplies” that could plausibly exist in any company’s expense stream.
The U.S. Postal Inspection Service says the fraud succeeds because employees assume someone else in the office authorized the purchase. Busy staff under pressure to keep payables current are the ideal targets. By the time anyone realizes the invoice was bogus, the funds have typically been routed through multiple accounts or moved overseas, making recovery extremely unlikely.
Federal law is supposed to prevent this kind of confusion. Under 39 U.S.C. § 3001, any mailing that could be mistaken for a bill but is actually a solicitation must carry a clear disclaimer: “This is a solicitation and not a bill, invoice, or statement of account due.” Scammers ignore the requirement entirely, which is exactly why the mailings look so convincing and why recipients feel pressure to pay.
Enforcement actions show the scale
Federal cases against fake-invoice operators are rare enough that the ones on record are worth examining closely, even when they are several years old. They remain the clearest public window into how these schemes operate and how difficult they are to unwind.
In December 2018, the FTC obtained a court order against U.S. and Canadian defendants who sent invoices implying an existing business relationship for internet directory listings, SEO packages, and website services. The court-ordered judgment exceeded $4.6 million, though the actual amount recovered for victims was never publicly disclosed.
On the physical-supplies side, two Maryland-based operations were permanently banned from telemarketing office supplies in 2017 after the FTC accused them of billing small businesses and nonprofits for overpriced cleaning products and light bulbs that were never ordered. One of those operations, Lighting X-Change Company, LLC, went through a lengthy enforcement process that eventually produced a refund distribution to victims, but only after years of litigation.
The pattern across these cases is consistent: regulators can and do act, but investigations take years, and victims rarely recover the full amount they lost. That gap between enforcement and recovery is exactly why prevention matters more than any after-the-fact remedy.
The defensive playbook that actually works
The FTC’s small-business scam guide lays out a set of internal controls that, taken together, make fake invoices far less likely to slip through:
- Require purchase-order matching. No invoice gets paid unless it ties back to a documented, approved purchase order. This single step eliminates most fake-invoice fraud because the scammer cannot produce a PO number that exists in your system.
- Centralize purchasing authority. Designate one person or a small team to approve all orders. When everyone knows who is authorized to buy, an invoice for something “nobody remembers ordering” immediately raises a flag.
- Train staff to question unexpected bills. Employees who process payables should treat any unfamiliar invoice as suspicious by default, not as something that probably just slipped through.
- Verify the vendor independently. If an invoice lists a phone number or website, do not use it to confirm the charge. Instead, look up the vendor through your own records or a verified directory. Scammers staff their own “customer service” lines to reassure callers that the bill is legitimate.
- Treat urgency as a red flag. Scammers add “past due” stamps and short deadlines to pressure fast payment. A legitimate vendor will not threaten collections over a bill you have never seen before.
- Keep written records of every order. Contracts, email confirmations, and delivery receipts create a paper trail that makes verification fast and definitive.
If you already paid
Businesses that realize they have paid a fraudulent invoice should move fast. Contact your bank or payment processor immediately to attempt a reversal or stop payment. For checks, a stop-payment order is typically possible only if the check has not yet cleared, so hours matter.
File a complaint with the FTC at ReportFraud.ftc.gov, and if the invoice arrived by mail, report it to the U.S. Postal Inspection Service. Your state attorney general’s office may also accept complaints about deceptive business practices and can be a faster point of contact for local enforcement. Document everything: the invoice itself, the envelope it arrived in, any payment records, and the contact information listed on the bill. These reports help federal and state investigators build cases, even if individual recovery is difficult.
Why this scam keeps working
No publicly available federal data tracks how many small businesses fall for mailed fake invoices each year or how much total money is lost nationally. The FTC’s Consumer Sentinel Network, which aggregates fraud complaints from multiple sources, does not break out fake-invoice mailings as a standalone category. The enforcement cases from 2017 and 2018 provide specific judgment amounts, but updated complaint volumes and refund outcomes from those actions have not been published as of June 2026.
It is also unclear how much of this fraud has shifted from paper mail to digital channels. Similar tactics appear in email, often with PDF attachments that mimic legitimate invoices, but federal alerts and enforcement documents do not separate complaint numbers by delivery method. And while the postal disclaimer statute is clear on paper, there is limited public information on how consistently it is enforced against violators before they get caught in a larger fraud investigation.
What is clear is that the scam persists because the underlying trick still works: a piece of paper that looks official, addressed to a real business, referencing a service that sounds plausible. Internal controls, not external enforcement, remain the most reliable defense. A business that matches every invoice to a verified purchase order before releasing payment has already neutralized the core mechanic these scammers depend on.
David M. Keller is a finance writer based in Columbus, Ohio, covering personal finance and consumer-focused economic topics. He earned his degree in journalism from Ohio University and began his career reporting on local business and economic trends for a regional media outlet. Since then, he has contributed to a variety of online publications, focusing on clear, practical coverage of topics such as cost of living, debt, and everyday financial decision-making.
