An agency paid a fake invoice: the next steps
What an estate agency should do in the hours and days after paying a fake invoice: the bank, the evidence, the books and the gap it came through.
By Achekam · · 5 min read · For Real estate businesses in South Africa, Nigeria, Kenya
It usually surfaces by accident. The real photographer phones to ask why the agency has not paid for last month's listing shoots, or the portal provider sends a reminder for an invoice the bookkeeper is sure was settled. Then someone opens the payment and sees that the money went to an account nobody recognises, against an invoice that looked exactly like the real thing.
The first reaction in most agencies is embarrassment, and the second is to tidy up quietly. Both waste the time that matters most. What happens in the first few hours decides whether there is any chance of getting the money back, and what happens in the following days decides whether the same trick works twice.
The first hour: the bank and the principal
ICAEW's advice is blunt: once a payment on a fake invoice has gone out, tell management and the bank immediately, because that is what gives the business a chance of recovering the money. Every hour the funds sit in the receiving account is an hour in which they can be moved on.
In practice that means:
- Phone the agency's bank on its fraud line, not by e-mail, and ask for the payment to be recalled or the receiving account flagged. Have the date, the amount as it appears on the statement and the beneficiary details in front of you.
- Tell the principal or managing director straight away, even if the amount looks small. They decide who else is told and they need to know before the bank calls back.
- Stop any other payment to that supplier. ICAEW also advises pausing processing whenever an invoice raises concerns. If more invoices from the same "supplier" are waiting in the approval queue, hold them all.
- Check the real supplier by a known route. ICAEW recommends verifying a supplier using contact details already on record, not the ones printed on the invoice. Ring the photographer or the portal provider on the number you have always used and confirm what they actually billed.
Take advice on reporting the matter to the police in your country as well; the bank may ask whether a case has been opened.
Keeping the evidence as it was
The e-mail that carried the invoice, the invoice itself, any "change of banking details" letter and the proof of payment are now evidence. Treat them that way. ACCA explains that forensic investigators must keep a clear chain of custody over evidence, because gaps in that chain or inconclusive evidence may lead to it being challenged in court or becoming inadmissible.
For an agency, a sensible chain of custody looks like this:
- Do not forward the suspicious e-mail around the office, and do not delete it from the mailbox where it arrived.
- Save the e-mail with its attachments and headers as a file, together with the bank statement line and the payment confirmation.
- Write a short dated note of who found the problem, when, and what was done in the first hour.
- Keep all of it in one place that only the principal and the person investigating can change.
In Achekam, those files can go into Document Centre, a folder-based store where the agency uploads files or whole folders, tags and searches them, and where a new version keeps the earlier ones rather than replacing them. Every stored file gets a SHA-256 fingerprint, executable files are refused by default, and every upload passes a malware check. That last point matters here, because a fraudulent e-mail can carry more than a fake PDF.
Correcting the books without erasing what happened
The tempting fix is to delete the entry that recorded the fake invoice. Do not. The books should show that the agency booked a cost, paid it, and then found it was false. An auditor, an insurer or an investigator will want to see that sequence.
In Achekam, a business can post manual journals, an unbalanced journal or one dated in a closed month is refused, and a posted journal is corrected only by a reversal. So the correction leaves both entries visible:
- reverse the entry that recorded the fake invoice as a genuine expense;
- record the money that left the bank somewhere honest, such as an amount claimed back from the bank while a recall is pending, or a loss from fraud once recovery looks unlikely.
Agree the exact accounts and wording with your accountant, and write the reason in the journal narration so that anyone reading the ledger next year understands it. If the fake invoice fell in a month that has already been closed, the correction goes in the current month rather than reopening the old one. For more on why reversals beat edits, see correcting a posted journal.
If the money paid out came from a trust account rather than the agency's business account, the matter is more serious and the agency should take advice on its trust account duties before anything else.
Looking for other invoices from the same source
A fraudster who succeeded once has often tried more than once. The general ledger in Achekam lists every posted line, so the agency can work through the accounts the fake invoice touched, usually an expense account and the creditor, and read every entry against them for the past few months.
Look for:
- other invoices with the same layout, wording or bank details;
- invoices from a known supplier that arrived from a slightly different e-mail address;
- payments to a supplier whose banking details changed recently;
- round amounts, or amounts just under the level at which a second approval would be needed.
The trial balance shows each account for all time, for a period or at a date, and whether debits equal credits. Comparing an expense account month by month can reveal a cost that has quietly crept up.
Closing the gap it came through
Once the immediate damage is contained, ask the uncomfortable question: which control should have stopped this, and why did it not? ICAEW recommends tightening supplier onboarding and verification, separating who sets up suppliers from who approves invoices and who makes payments, independently checking every bank detail change, and using three-way matching, duplicate invoice checks and limits on manual overrides. Its guide on how to identify and deal with fake invoices sets out the warning signs, such as mismatches with purchase orders and delivery notes, alongside those preventive controls.
In a small agency the same person often captures suppliers, approves and pays. Even splitting one of those three duties between two people closes a large part of the gap. A wider set of checks for paying suppliers is in purchase-to-pay checks against fake invoices, and law firms facing the same threat on client payments will find client payment fraud and bank details useful.
Before the week is out, sit down with whoever approves payments, walk through exactly how the fake invoice reached the bank, and write down the one change that would have stopped it at each step.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
