Before You Pay That Vendor Invoice, Make One Calm Check

The delivery is late, the lunch rush is starting, and an email arrives with an invoice attached. The sender's name looks familiar. The amount seems plausible. Paying it now would clear one more task from the list, so it is tempting to click the payment link and move on.

That is exactly when a small pause helps. A fake invoice can arrive by email looking like an ordinary bill from a supplier. The Federal Trade Commission warns that invoice emails can be phishing attempts aimed at a business's data or network. A clear approval routine gives staff a way to check the request without turning every bill into a detective story.

Make the normal process easy to remember

Write down how a real invoice gets from arrival to payment. Keep it short enough that someone can follow it during a busy shift. For example: save the invoice in the usual folder, match it to an order or delivery record, confirm the amount and payment details, then get approval from the person responsible for bills.

The exact steps depend on the shop. A repair business may compare a bill with the work order. A retailer may check it against a purchase order or delivery note. A solo owner may do the review personally, but can still use the same sequence each time. The point is to remove guesswork about who checks what.

Tell staff where approved invoices should arrive and who is allowed to approve a new vendor or a change in payment details. If your business uses a bookkeeping service, include its role in the written process. Keep the instructions somewhere the people who handle bills can find them, not buried in a manual no one opens.

Check more than the logo

A familiar company name or logo is easy to copy. Look at the sender address and the invoice details, but treat those as clues rather than proof. Compare the bill with what the business ordered: vendor name, goods or services, amount, due date, and payment instructions. If the bill refers to a purchase nobody recognizes, stop before paying. For recurring services, compare the billing period and amount with the agreement or last approved invoice. A change may be legitimate, but confirm it before updating the amount you expect to pay.

Pay special attention when an email asks you to use a new bank account, payment link, or contact address. A sudden change is a reason to verify the request through a channel you already trust. Use a phone number from a previous invoice, your vendor records, or the supplier's known website. Do not use the number or link in the message you are checking. If the person who usually handles the account is unavailable, wait for another authorized person rather than treating urgency as approval.

This check does not require assuming every supplier email is a scam. It separates two questions: does the business owe this amount, and is this the right place to send it? A real invoice can still contain an error, and a convincing message can still request the wrong payment destination.

Give unusual requests a second route

Choose one way to confirm a changed payment instruction, such as calling a known contact or asking an authorized manager to confirm it in person. Decide in advance who can approve that change. For a small team, this can be as simple as requiring the owner to confirm any new bank details before the first payment.

Use a number or address already saved in your vendor records. If a supplier says their details have changed, contact the supplier using that saved information and ask them to confirm the change. Avoid replying to the same email thread as your only confirmation. A compromised or lookalike mailbox can keep the conversation feeling familiar.

There is a practical balance here. You do not need two people to approve every ordinary bill if that would slow the shop to a crawl. Save the extra step for things that have changed or do not match, such as a new payment destination, a duplicate-looking invoice, an unfamiliar service, or pressure to pay outside the usual process.

Make a small checklist

A one-page checklist near the bookkeeping station can turn the routine into a habit. Keep the questions plain:

• Did we order or receive this product or service?
• Does the amount match the order, agreement, or delivery record?
• Is the vendor and payment destination already on file?
• Has an authorized person approved any change or exception?

If any answer is no or unclear, set the invoice aside and ask the right person. Mark it as waiting for confirmation so another shift does not pay it by mistake. A short note saying the vendor was called using the saved number is more useful than a vague reminder to check later. Do not put full account numbers or passwords in a shared note.

When a bill is confirmed, record who checked it and when, using the bookkeeping method your business already relies on. This gives the next person a simple answer if the same invoice arrives again. It also helps spot accidental duplicate payments without relying on someone's memory from a hectic Tuesday.

If you already paid a suspicious bill

Act quickly, but do not panic or delete the email. Contact your bank or payment provider using its official number and explain what happened. If the message appeared to come from a supplier, contact that supplier through a known channel too. Preserve the invoice and related messages, and follow your bank's instructions about what to secure or report.

If someone clicked a link or entered a password, tell the person who manages the business accounts and change affected credentials through the official website or app. Check whether the account offers multifactor authentication and turn it on where available. The CISA phishing guidance includes recommendations tailored for small and medium businesses, while the FTC's small-business invoice advice covers checking bills and setting clear approval procedures.

A few written steps cannot make every deceptive message obvious, and they do not need to. They give your team a sensible next move when a bill feels unusual: compare it, confirm it through a trusted route, and get the right approval before paying. That small pause is far easier to schedule than a scramble after the money is gone.