How CPA Firms Can Stop Fake “Pay This Invoice” Emails

The email looks right. It comes from your managing partner, or a vendor you have paid for years, or a client you talk to every week. It asks for something ordinary: pay this invoice today, update our bank details, send the refund to a new account. Nothing about it feels like hacking.

That is exactly why it works. The FBI calls it business email compromise, and in 2025 it cost U.S. businesses just over $3 billion, according to the FBI’s 2025 Internet Crime Report. Among online fraud types, only investment scams cost victims more. Accounting firms are a favorite target because money moves through them every day, and the people moving it are busy.

How the scam works

There are three common versions, and most firms will see all of them eventually.

• The “boss” request. An email that looks like it is from a partner asks someone to wire money, pay a new vendor, or buy gift cards. It is urgent, and the sender is “in a meeting” or “traveling” and can’t talk.
• The vendor with new bank details. A supplier you already pay sends a polite note that their bank changed. The next invoice goes to the criminal’s account, and nobody notices until the real vendor asks where their money is.
• The hacked client. A client’s real mailbox gets taken over. The attacker reads old threads, then asks you to send a refund, a distribution or a payment to a different account. Because it comes from the client’s real address, it passes every gut check.

Payroll is the fourth version, and it peaks around tax season: an “employee” emails HR asking to change their direct deposit to a new account before the next payday.

The tells to look for

These emails are often well written now, since attackers use AI tools to clean up their spelling. So look at the request, not the grammar.

• Any change to where money goes: new bank, new account, new payment method.
• Urgency plus secrecy: “today,” “before the deadline,” “keep this between us.”
• A sender who can’t be reached by phone right now.
• An address that is close but not exact. Hover over the name or tap it on your phone to see the real address.
• A reply-to address that is different from the sender.
• Gift cards. No real partner or vendor pays bills with gift cards.

The one rule that stops it

Verify by phone, using a number you already have. Not the number in the email, not the number in the signature, and not the number in a new invoice. Use the one in your client file, your accounting system or your phone’s contacts.

That single call stops almost every version of this scam, because the attacker controls the email but not the phone on your partner’s desk or your vendor’s office line.

Your move

• Make the call-back rule a written policy, not a suggestion. Everyone who touches payments follows it, including the partners.
• Require two people to approve any wire or new payee above an amount you choose.
• Treat every bank detail change as suspicious until verified by phone, even when it comes from a real address.
• Handle direct deposit changes in person or through your payroll portal, never by email alone.
• Tell your team it is always OK to slow down and check. Nobody gets in trouble for verifying.

Technology that helps

Policy does most of the work, but a few settings make these emails harder to send and easier to spot.

• MFA on every email account. It stops most mailbox takeovers. A security key is the strongest option, and we explain why in Why a Security Key Beats Texted Codes.
• An “external sender” banner on mail from outside the firm, so a fake “partner” email stands out.
• SPF, DKIM and DMARC on your domain. These make it much harder for someone to send email that pretends to come from your firm.
• Alerts for new forwarding rules. Attackers who get into a mailbox often add a hidden rule that forwards or deletes messages so they can watch quietly.

For the wider set of daily habits, see our 2026 cyber hygiene guide.

If the money already went out

Speed matters more than anything else here. The sooner the banks know, the better the chance of stopping the transfer.

1. Call your bank right away and ask them to recall or freeze the wire. Use the phone, not email.
2. File a report at ic3.gov. The FBI works with banks to freeze fraudulent transfers, and it can only help if it knows.
3. Call your IT team. If a mailbox was taken over, the password needs to be reset, sessions signed out, and forwarding rules checked.
4. Warn the people involved. If a client’s or vendor’s email was hacked, let them know by phone so it doesn’t happen to their other contacts.

If the attack started with someone clicking a link, our 5-step emergency guide walks through the rest.

Not sure an email is real? Ask us first.

If a payment request feels even slightly off, forward it to us or give us a call before anyone sends money. Checking takes a few minutes. Getting a wire back can take months, if it comes back at all.

Want to see how your firm stacks up? Our IT Security Self-Assessment takes a few minutes and shows where the gaps are.

Call OmniTechPro at (410) 219-2695. It is never a bother.