How to Trace a Fake-Invoice Scammer

A fake-invoice scam is a request for payment that looks legitimate but routes your money to a criminal instead of to whoever you actually owe. It is one of the most profitable forms of business email compromise precisely because it does not trip the usual scam alarms. There is no broken English screaming “you won a prize.” There is a clean PDF, a familiar logo, an amount that looks plausible, and a tone that says this is just another Tuesday in accounts payable. The whole design is to slip through a busy team that processes dozens of bills a week and trusts the names it recognizes.

The most damaging versions hijack a real relationship. A scammer who has compromised or spoofed a vendor’s email watches a genuine billing thread, then sends a follow-up that changes only one thing: the bank account and routing number for payment. Everything else, the project name, the prior amounts, the signature block, is real, because it was copied from correspondence the victim already trusted. Other versions never involve a real vendor at all: a shell “directory listing,” a phony “domain renewal,” or a subscription you never ordered, betting that someone will pay a small, routine-looking amount without checking. Whichever shape it takes, the goal is the same, and the lawful research that helps people identify a person who scammed them applies here just as it does to any other fraud.

If the payment already went out, the clock matters more than anything else. A domestic wire or transfer can sometimes be frozen or pulled back if the bank acts before the money is withdrawn on the other end, so call your bank’s fraud line first, not your vendor. Then report the wire fraud to the FBI Internet Crime Complaint Center, which runs a dedicated recovery process for business email compromise and works with banks to try to halt fraudulent transfers. Do these at the same time, because each hour reduces the odds.

The money trail. The receiving bank account is the anchor. When you report fast through IC3 and your bank, law enforcement can ask the receiving institution to freeze the balance and, with proper legal process, identify the account holder. Banks verify customer identity to open accounts, so even an account opened by a money mule is tied to a real name, address, and onboarding record. This is the part the FBI and the receiving bank do, which is exactly why reporting quickly and in detail is the highest-leverage thing a victim can do.

The human trail. This is the lane almost no guidance covers, and it is where People Locator Skip Tracing fits. Behind the anonymous-looking invoice are real footprints: the registrant or hosting details behind a lookalike domain, the business filing and registered agent behind a shell “company,” the person who opened or controls the bank account that received your wire, and the individual tied to the phone number, email, or address printed on the bill. Those identifiers can be researched lawfully through public records and skip-tracing techniques to surface a real name, current address, and associates, the same work behind our guidance on finding someone behind an email address and on identifying a scammer by phone number. A named, located individual or entity changes everything: it strengthens your IC3 report, gives a prosecutor or an attorney something concrete, and opens the door to a civil claim that an anonymous invoice alone never could.

Invoice fraud runs on the same rails as other scams, so the people behind it surface through the same lawful research that powers full-spectrum skip tracing. Send us what you have, even if it feels like nothing: a receiving account number, a lookalike domain, a sender email, a phone number, a business name on the invoice, or the address it printed. We work strictly for lawful, permissible purposes, we never promise a recovery we cannot control, and we tell you honestly what the records can and cannot show. For a legitimate matter, an initial locate typically comes back within 24 hours.