Invoice scam emails: how an AI caught a fake $8,750 request.
Among ten ordinary customer emails, one asked a small travel agency to change its supplier's bank details and pay $8,750 the same day. The AI refused to reply and flagged it for the owner. Here are the signs it used, and how to put the same rule in your business.
Short answer: treat any email that asks you to change bank details or pay urgently as suspicious until you have checked it by phone, on a number you already had before the email arrived. That one rule stops most invoice scams, also called payment diversion fraud.
What the scam email looked like
It came from "Accounts Payable" at bluebird-travel-payments.co, a domain made to look like the agency's real one. It said the supplier had a new bank account, asked for the outstanding $8,750 to be paid there, and asked for it today. No attachment, no threats, nothing that looked dramatic. That is what makes these emails work: they look like admin.
The demo business and the email were made up for the episode, but the pattern is the one that small businesses report every week.
The red flags the AI spotted
- A lookalike domain. One extra word in the address, "-payments", on a .co instead of the usual domain.
- A change of bank details. Real suppliers rarely change accounts, and never only by email.
- Pressure to pay today. Urgency is there to stop you from checking.
Other common signs, not in our test email but worth adding to your own list: a reply-to address different from the sender, a new contact you have never dealt with, a request to keep it quiet, and small changes to an invoice you already received.
The rule we gave the AI
In the instruction page, one line did the work: any email that asks to change payment details or to pay urgently goes in the Suspicious box, gets no reply and is flagged for the owner. The AI's note to the owner said exactly what to do next: check the change by phone using a number already on file, and never use the contact details inside the email.
You can copy that rule today. It is part of the free inbox kit, and it works even if you never use AI for anything else: print it and stick it next to whoever pays the bills.
What to do if you already paid
Call your bank straight away and ask them to try to stop or recall the payment: speed matters. Then report it. In the US the FBI collects these reports at ic3.gov, in the UK it is Action Fraud, in Australia ReportCyber and Scamwatch. Tell the real supplier too, because their email may have been compromised. This is general information, not legal or financial advice.
Can AI detect scam emails on its own?
It helps a lot, because it reads every email with the same attention at 9am and at 6pm. It is not a guarantee: a careful scammer can write an email with none of the usual signs. Use the AI as a second pair of eyes and keep the phone check as the rule that never changes.
Want the whole picture of how the inbox test worked? Read how to use AI to answer emails.
Questions
What is payment diversion fraud?
It is when a criminal pretends to be a supplier or a colleague and asks you to send a payment to a new bank account that they control. It usually arrives as an ordinary looking email about an invoice.
How do I spot an invoice scam email?
Look for a sender domain that is almost right, a request to change bank details, pressure to pay quickly, and a reply-to address that differs from the sender. Check any change by phone on a number you already have.
Can AI stop invoice scams?
AI can flag the suspicious emails reliably when you give it a clear rule. The decision to pay should always stay with a person who has checked the request by phone.