Fake invoices to small businesses: the toner you never ordered, the directory that doesn't exist

The invoice doesn’t look like a scam. It looks like Tuesday. A bill for toner cartridges, an “annual listing renewal” for a business directory, a domain expiration notice, a trademark fee with an official-looking seal — modest amounts, professional layout, a due date. It lands in front of the person whose job is to pay bills quickly, at a company small enough that the same person receives, approves, and pays. That’s the entire design of the small-business fake invoice scam: no hacking, no malware, just paperwork engineered to ride your own accounts-payable routine straight to payment.

Here’s the first move, before the variants: no invoice gets paid unless someone can match it to an order you actually placed or a vendor you actually use. Every real bill survives that check. None of these do.

The con targets your process, not your judgment

The FTC’s small-business guide describes the mechanism plainly: “Scammers create phony invoices that look like you ordered products or services for your business. They hope the person who pays your bills will assume the invoices are real and make the payment.” Note what’s being exploited — not gullibility, but efficiency. Paying invoices promptly is a virtue in a bookkeeper, and the amounts are deliberately small enough to sit below anyone’s mental alarm threshold. This is a different animal from business email compromise, where criminals hijack a real supplier’s email mid-conversation to redirect a payment you genuinely owe. Here there is no relationship at all: a stranger invents one and bills you for it. BEC forges the “where to pay”; the fake invoice forges the “whether you owe.” Both die to the same habit — verifying outside the message — but they enter through different doors, and a business needs to recognize both.

The toner trick: unordered supplies

The oldest version starts with a phone call, not a package. Per the FTC, “a scammer might call, claiming they want to ‘confirm’ an existing order, ‘verify’ an address, or offer a ‘free’ catalog or sample. If you say yes to any of those, unordered merchandise will arrive at your doorstep — followed by high-pressure demands to pay for it.” The shipment is the trap’s second jaw: once boxes are physically in your storeroom, paying feels more natural than arguing.

The law is entirely on your side, and the FTC states it without hedging: “if you receive merchandise you didn’t order, you have a legal right to keep it and use it for free.” Don’t pay, and don’t ship it back at your own expense. The follow-up calls may quote details from that first conversation — that’s the point of the call — but a recorded “yes, that’s our address” is not an order.

The phantom directory listing

The second variant sells nothing at all. “Scammers try to fool you into paying for nonexistent advertising or a listing in a phony business directory,” the FTC warns, and the setup mirrors the toner call: a request for your contact details for a “free” listing, or a call “simply to ‘confirm’ your information.” Then the bill arrives — and, in the FTC’s words, “the scammer may use details — or even a recording — of the earlier call to pressure you to pay.” Some crews add a collections voice, threatening your business credit. A directory you’ve never heard of, billing for a listing no one authorized, is not a debt. It’s a script.

The domain renewal that isn’t

Every business with a website gets these: an urgent notice that your domain is about to expire, sometimes dressed in the branding of ICANN, the organization that coordinates the domain name system. ICANN’s own guidance dismantles this one cleanly. “Phishing emails may claim that your domain name registration needs to be renewed and that you must pay some sort of fee to get it back,” it warns — but ICANN “will never send registrants a WHOIS Data Reminder Policy (WDRP) notice, registration data verification request, domain name expiration reminder, or domain name renewal request message,” and it never collects fees from registrants directly. Your renewal relationship exists with exactly one party: the registrar you pay. So whatever the costume — email or paper letter, ICANN logo or generic “Domain Services” letterhead — the check is the same: log in to your registrar account yourself, and if a notice claims to be from ICANN, ask your registrar whether it’s genuine. The FTC’s business guide flags the aggressive version too: scammers “calling from a tech company, threatening that your business will lose its website URL if you don’t pay immediately.” The consumer-side version of this bill — fake antivirus and subscription renewals — runs on the identical reflex; see the fake subscription renewal invoice.

The official-looking trademark fee

If you’ve registered a trademark, your name and deadlines sit in a public database — and an entire cottage industry mines it. The USPTO warns that solicitation notices “frequently appear to be an invoice and typically specify fees ‘due’ that are higher than the official USPTO required fees,” sent by companies with names built from words like “United States,” “Trademark,” “Office,” or “Agency.” The fine print admitting the sender isn’t a federal agency is usually there — in the smallest type on the page. The FTC lists the harder-edged version among its impersonation scams: letters warning you’ll lose your trademark if you don’t pay a fee immediately. The USPTO gives you two clean checks: real USPTO email ends in @uspto.gov, and official communications — including anything requesting payment — are uploaded to your file in the TSDR database. Not in TSDR, not official. Maintenance fees are paid directly to the USPTO, no middleman required.

The fix is a rule, not a sharper eye

These four scams share one weakness: none of them can survive a match against your own records. So take the decision away from instinct and give it to process — this is Two-Channel Verification applied to accounts payable. The FTC’s guidance for businesses is to “make sure procedures are clear for approving purchases and invoices and ask your staff to check all invoices closely.” In practice: keep a list of vendors you actually use, match every invoice to an order or that list before payment, and verify anything unmatched through a channel you find yourself — never the phone number printed on the suspicious invoice. Payment method is a tell of its own; the FTC is blunt that a demand for wire transfer, cryptocurrency, or gift cards means a scam. For the rest of the small-business threat landscape — payroll diversion, CEO fraud, phishing — see the owner’s playbook.

If you already paid

Dispute a card charge with your issuer, ask your bank about recalling a transfer or stopping a check, and work through getting your money back by payment method. Report to the FTC at ReportFraud.ftc.gov and your state attorney general; forward trademark solicitations to TMScams@uspto.gov. Then close the gap that let it through, because paying once puts you on a list of businesses that pay.

Train the eye that opens the mail: run your team through the 60-second quiz, and keep the full set of defense moves where accounts payable can see it.