Spotting fictitious invoices in a fraud

A payment order arrives on a Tuesday. The invoice behind it looks real – vendor name, reference number, plausible service description. By Friday the funds have cleared into an account you have never seen before, and the vendor does not exist. That is the opening move of invoice fraud, and it plays out in businesses of every size and sector.

Fictitious invoices are one of the most common instruments of internal fraud and external scheme alike. Spotting them requires a structured forensic approach: comparing vendor master data against payment flows, testing the commercial logic of each transaction, and following the money when something does not reconcile. Incomplete records do not end the trail – they redirect it.

This analysis covers the markers that distinguish a fictitious invoice from a legitimate one, the forensic methods used to reconstruct payment trails when documentation is missing, and the legal instruments available to compel disclosure and freeze assets before they dissipate further.

What Makes an Invoice Fictitious?

A fictitious invoice is a payment instruction dressed as a commercial document. It records a transaction that did not occur – or one that occurred at a fraction of the stated value. The distinction matters because the forensic approach differs depending on which variant you are dealing with.

The three main categories are: entirely fabricated transactions, inflated-value invoices for genuine services, and split invoices designed to avoid approval thresholds. Each leaves a different pattern in the payment record and the vendor file. Identifying which type you are looking at shapes everything that follows.

In our experience, the most persistent variant is the inflated-value invoice. A genuine vendor relationship is exploited: an approved supplier submits invoices at two or three times the agreed rate, often over a period of months, with a contact inside the business approving each one. The vendor exists; the relationship is real; the overcharge is the fraud. That combination makes early detection harder and forensic reconstruction more important.

Entirely fabricated vendors are, paradoxically, easier to identify once you know where to look. The vendor master file will contain irregularities – registration dates that do not match onboarding dates, bank accounts opened shortly before the first payment, addresses that resolve to residential properties or mail-forwarding services. The commercial substance is simply absent.

Split invoicing – breaking a single transaction into multiple smaller payments – is designed to defeat approval controls. A business with a two-signatory requirement above a certain value will find that each individual invoice falls just below the threshold. The pattern becomes visible only when payments to the same payee are aggregated across a reporting period, which standard transaction-by-transaction review will miss.

The Six Red Flags That Appear Most Often

Fictitious invoices do not always announce themselves, but they consistently produce a small number of observable anomalies. Knowing which signals carry the most diagnostic weight narrows the review considerably.

First: vendor bank accounts that change immediately before a payment run. Legitimate vendors occasionally update their banking details, but they do so through a documented process with prior notice. A bank-detail change that arrives by email shortly before a large payment, without a written confirmation process, is a strong indicator that the change was inserted fraudulently – either by an external attacker or an inside contact.

Second: invoice numbers that do not follow a plausible sequence. Real businesses generate invoices in roughly chronological order. An invoice numbered 0001 from a vendor who has supposedly been trading for three years, or a sequence that jumps from 45 to 7000 between payments, suggests the documents were created for this transaction specifically.

Third: service descriptions that cannot be evidenced. "Consultancy services", "strategic advisory", "logistics support" – these categories are legitimate, but they are also the most commonly abused because they do not produce a tangible deliverable. When a forensic review asks for the deliverable, the work order, the meeting record, or any evidence of performance, and nothing exists, the invoice fails the commercial substance test.

Fourth: payment timing that concentrates at period-ends. Fraudulent payments disproportionately cluster at month-end, quarter-end, or financial year-end. This pattern reflects the perpetrator's calculation that period-close activity is reviewed less carefully, and that auditors are focused on accruals and provisioning rather than individual payment approvals.

Fifth: vendors with addresses, phone numbers, or email domains shared with other vendors in the master file. Related-party fraud often involves a small number of individuals controlling multiple entities. A vendor contact email on a shared domain, or a phone number that also appears in another vendor record, points to common control.

Sixth: approvals that consistently originate from a single individual, particularly for one vendor. Legitimate payables processes involve segregation of duties. When one person approves every invoice for a specific vendor – especially a person with a financial or personal relationship to the vendor – the internal control environment has broken down in a targeted way.

How Do Forensic Investigators Follow the Money from a Fictitious Invoice?

Identifying a fictitious invoice is the beginning, not the end. The forensic question that matters is: where did the value go? Following the money from a fraudulent payment requires reconstructing a chain that the perpetrator has often deliberately obscured.

The reconstruction typically begins with the receiving account. We obtain the full payment instruction and trace the beneficiary bank details against available commercial registers, sanctions databases, and correspondent-banking records. In our experience, the first receiving account is rarely where the value rests – it is a transit point, chosen because it accepts the incoming payment and passes it on quickly.

From the first transit account, funds commonly move through one of three onward routes: into a second bank account in a different jurisdiction; into a cash-intensive business that can absorb the funds as apparent revenue; or into a virtual-asset purchase. Each route requires a different tracing methodology, but none is untraceable in the early stages. Speed matters: funds that have been stationary for 48 hours are far easier to reach with legal process than funds that have moved three times.

Where records are incomplete – and they often are – the forensic analyst works from what is available: partial bank statements, payment platform exports, email approvals, ERP system logs, and accounting entries. Missing records are themselves informative. A gap in sequential payment records, or an accounting entry with no supporting documentation, is a marker, not a dead end. It identifies where the next disclosure request should be directed.

The Financial Forensics cluster at Axiom Trace covers the full range of follow-the-money methodologies, from payment-trail reconstruction to dissipation analysis and offshore-structure unwinding.

Does Cross-Border Routing Make Fictitious Invoices Harder to Trace?

Cross-border payment routing is the most common method used to slow a forensic investigation – and it works, to a degree, by introducing jurisdictional friction. But it does not make the trail invisible.

The jurisdictional friction is real. A payment that moves from the victim's bank in one jurisdiction, through a correspondent bank in a second, into a receiving account in a third, sits across three different legal regimes. Obtaining records from each requires either voluntary disclosure or legal process – and legal process in each jurisdiction operates on its own timetable and procedural logic. That is where professional coordination is essential.

What cross-border routing cannot do is erase the payment record. Every SWIFT transfer generates a chain of records: originating bank, correspondent, beneficiary bank, timestamp, amount, reference. Those records exist even when the account has been closed. A Norwich Pharmal order directed at a bank compels disclosure of the account information needed to continue the trace. A Bankers Trust order compels a bank to disclose information about a customer's account, including the onward payment instructions, in a tracing context.

In practice, the more jurisdictions a fraudster uses, the more records they generate. A payment routed through four banks to obscure its origin has left four times as many disclosure targets. The question is whether those targets are within reach of courts that can compel disclosure on an urgent basis.

We regularly advise on matters where funds have moved through two or three jurisdictions before reaching a holding point. The holding point – the account or asset where value has settled, at least temporarily – is almost always identifiable. Whether it is reachable within the relevant timeframe depends on which forum has jurisdiction and how quickly the application is made. For a confidential read on whether a cross-border invoice fraud matter is recoverable, contact info@axiomtracel.com.

What Legal Instruments Are Available Once a Fictitious Invoice Is Identified?

Identification alone does not recover assets. The forensic finding has to connect to a legal mechanism capable of freezing the funds and, eventually, compelling their return.

The most immediate tool is an application for a worldwide freezing order. This is sought without notice to the defendant – a without-notice application is standard in invoice fraud because alerting the perpetrator defeats its purpose – and, if granted, prevents the defendant from dissipating or further transferring the frozen assets. The application must be supported by evidence of the fraud and, typically, evidence of a real risk of dissipation: the very pattern that a forensic reconstruction of fictitious invoices provides.

Alongside or following the freezing order, a disclosure order directed at the receiving bank compels the bank to produce account records and onward payment details. This is the tool that turns a frozen account into a mapped money trail. Where the perpetrator is initially unknown – a common situation in external invoice fraud – a proprietary injunction against "persons unknown" allows the process to begin before identities are confirmed.

For funds that have moved across borders, a worldwide freezing order granted in one jurisdiction can, in principle, reach assets held elsewhere. Enforcement against foreign assets typically requires recognition proceedings in the relevant jurisdiction, supported by local counsel. Where assets have been moved into a shell company or trust structure to obscure ownership, piercing the corporate veil or conducting a sham-trust analysis may be necessary to reach the underlying value.

Where the fraud has produced a judgment or arbitral award, enforcement under the New York Convention provides a route to recognition in most jurisdictions. That route is slower, but it is relevant when the initial urgent process has been completed and the matter moves into formal recovery.

Our asset tracing service sets out the full process from initial forensic review through to the legal instruments used to freeze and recover identified assets.

Contrasting Positions: Can Records Be Reconstructed When They Are Missing?

This is the question we hear most often from clients and referring lawyers: if the records are gone, is the investigation over? The answer is no – but the reasoning deserves examination rather than assertion, because the gap between "possible" and "straightforward" is significant.

One position holds that missing records create an evidential gap that is fatal to the claim. Courts require evidence; if the underlying documentation was destroyed or never existed, the claim cannot be established to the required standard. This position has practical force. A forensic report built on inference alone, without supporting documentation, will be challenged. And in some jurisdictions, courts impose strict limits on what can be established circumstantially.

The contrasting position – and the one that reflects our experience in practice – is that missing records redirect, rather than end, the investigation. Primary records are rarely the only records. Bank statements can be obtained from financial institutions directly, often through court order. ERP system logs retain entries even when supporting documents are deleted. Email archives capture approval chains. Third-party data – from other parties to the same transaction – frequently survives even when the perpetrator has destroyed their own records.

A Norwich Pharmal order is particularly useful here: it compels a third party who is not themselves a wrongdoer to disclose information that enables the identity of the wrongdoer to be established. Where the perpetrator has used a bank, a corporate services provider, or an accountant, those intermediaries hold records that can be compelled on appropriate application.

The honest answer is that the value of a partial-records investigation depends heavily on which records are missing, which are available, and which intermediaries hold information that can be reached by legal process. We reconstruct payment trails from partial records and identify where value has settled – but the architecture of each case varies, and a realistic assessment of what can be recovered evidentially requires early engagement.

A matter in South-East Asia in early 2025 illustrates the point. A commercial enterprise identified a series of fictitious invoices in the mid-six figures – plausible descriptions, a vendor that existed on paper, but no deliverables and a bank account opened in the weeks before the first payment. Internal accounting records were partially deleted. Working from surviving ERP logs, email trails, and third-party payment-platform data, we reconstructed the payment chain across two jurisdictions. The funds had moved into a holding structure, but the trail was intact to within days of the current position. Freezing relief was obtained in the receiving jurisdiction within weeks of instruction.

The Myth That Incomplete Records End the Trail

The idea that "no records, no case" persists in part because it serves the fraudster's interests to encourage it. A perpetrator who has removed documentation from the company's systems may believe the trail is cold. They are often wrong.

Invoice fraud perpetrators rarely destroy every record. They destroy the records they control. What they cannot control is the mirror image of the transaction that exists in the systems of the receiving bank, the correspondent bank, the payment platform, the counterparty's accounting system, or the corporate registry of the jurisdiction where the beneficiary entity was registered. Each of those holds a record. Each of those records is potentially reachable.

This is why early engagement matters as much as it does. The further in time an investigation begins from the original transaction, the more likely it is that third-party records have been overwritten in routine data cycles, that accounts have been closed, and that the people who held information have moved on. Urgency is not a sales point. It is a practical reality of how evidence preservation works.

We have traced funds through layered accounts using nothing more than the original payment instruction and a sequence of disclosure orders directed at successive financial institutions. The chain was built link by link. That process is slower than starting with complete records – but it is not impossible, and in our experience it is more often viable than clients initially believe.

What kills an investigation, in reality, is not missing records. It is delay that allows assets to move beyond the reach of available legal process, or conflating "difficult" with "impossible" in a way that leads to no action being taken. Both are recoverable positions – but both are harder to address the longer they go on.

For referring lawyers and insolvency practitioners assessing the viability of a matter, the right question is not "are records complete?" but "what records exist, and what can be compelled?" A confidential case review at Axiom Trace addresses exactly that question – contact info@axiomtracel.com to begin.

Practical Checklist: What to Preserve and What to Do First

If your business has identified a potential fictitious invoice or a series of suspicious payments, the first 48 to 72 hours determine what remains reachable. The actions below are not a substitute for specialist advice, but they set the investigation up to succeed.

Preserve all electronic records immediately. This means email approvals, ERP system exports, bank statements, vendor master data, and any payment-platform logs. Do not delete, overwrite, or "clean up" any data pending investigation. Forensic imaging of relevant systems may be necessary if internal access to records is likely to be compromised.

Do not contact the suspect vendor. Alerting the recipient of a fictitious invoice payment gives them time to move the funds. All investigative steps in the first phase should be conducted without notice to the payee.

Obtain the payment instruction in full. The beneficiary account details, the bank's SWIFT/BIC code, the payment reference, and the exact amount are the starting points for a tracing engagement. Even a single SWIFT message is a disclosure target in its own right.

Identify the approval chain. Who requested the payment? Who approved it? Was the approval process followed? Were any internal controls bypassed? This is the internal fraud question, and it runs in parallel to the money-tracing question.

Consider whether to involve law enforcement. In many jurisdictions, a contemporaneous report to the relevant financial intelligence unit or fraud authority preserves options that would otherwise close. It does not prevent civil proceedings running at the same time – the two tracks are complementary, not mutually exclusive.

A realistic assessment of whether the funds can be reached – through forensic tracing, legal process, or both – is the first output of any engagement. Our analysis of wire transfers routed through layered jurisdictions illustrates how that process works in a more complex routing scenario.

Related Topics in Financial Forensics

• Financial Forensics: follow-the-money methodologies for complex fraud – an overview of payment-trail reconstruction, dissipation analysis, and offshore tracing.
• Asset tracing service – how Axiom Trace conducts forensic tracing from initial identification through to freezing and recovery coordination.
• Tracing wire transfers routed via Malta – a worked example of cross-jurisdictional payment tracing using disclosure orders and correspondent-bank records.

Frequently Asked Questions

Q: Can a money trail be reconstructed from incomplete records?

A: Yes – incomplete records redirect the investigation rather than ending it. When a company's own documentation has been destroyed or altered, forensic analysts work from third-party sources: bank statements obtained through disclosure orders, payment-platform exports, ERP system logs, and corporate registry data. A Norwich Pharmal order compels third parties to disclose information that identifies the wrongdoer or traces the payment chain. The viability of reconstruction depends on which records survive and which intermediaries can be reached by legal process – an early assessment is essential.

Q: How do you trace funds routed through several jurisdictions?

A: Each jurisdiction the funds pass through generates its own payment record – at the originating bank, the correspondent bank, and the beneficiary bank. A Bankers Trust order compels a bank to disclose account information in a tracing context; this is applied sequentially at each link in the chain. Cross-border coordination with local counsel in each relevant jurisdiction is necessary where legal process must be issued locally. The more jurisdictions used, the more disclosure targets exist – but time sensitivity increases with each hop, because accounts close and data cycles overwrite records.

Q: What information do you need from me to start tracing?

A: The minimum to begin is the original payment instruction: the beneficiary account number, the receiving bank's identifier, the payment date, and the amount. A copy of the invoice and the approval chain – however incomplete – is helpful but not a prerequisite. Many engagements begin with only the payment reference and a description of the suspected scheme. From that starting point, a preliminary assessment identifies what can be compelled through disclosure, which forums have jurisdiction, and whether urgent freezing relief is viable. The more promptly that information reaches us, the more options remain open.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed.

We reconstruct payment trails from partial records and identify where value has settled – including in matters where invoice fraud has been layered through multiple jurisdictions and corporate structures. Our forensic work supports urgent interim relief applications and longer-term enforcement strategy. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.