Common AI-generated fake invoice scams in Nigeria exposed

What this scam is

AI-generated fake invoice scams use generative AI to produce fraudulent billing documents, payment requests, or financial emails that perfectly mimic a real supplier, contractor, landlord, or utility company.

These scams are often built using genuine past correspondence or invoices that criminals steal through email hacking or public data leaks.

Earlier versions relied on generic templates that were easy to spot due to poor grammar or blurry logos. Still, modern AI tools allow scammers to seamlessly replicate a specific vendor’s exact font, layout, and tone of voice.

The scam heavily targets business accounts payable teams, small business owners, and individuals paying everyday expenses like rent or school fees.

The fraudulent document directs your money into a mule bank account controlled by the scammer rather than the actual payee.

This is frequently accompanied by a highly professional, AI-drafted email falsely explaining a “recent change of corporate banking details” due to an audit or a change in payment processors.

Because the visual appearance is nearly identical to that of a typical invoice, victims are far less likely to realise that anything is wrong.

How it works

• Scammers break into corporate email accounts to study real past invoices, upcoming milestones, and the specific communication styles used between vendors and clients.

• If direct email access is unavailable, fraudsters scrape company branding from websites and public portals and use AI document tools to generate a visually identical template.

• The criminal registers a lookalike web domain that differs from the real supplier’s email address by just a single character to escape casual observation.

• The fraudster uses AI text tools to draft a flawless cover email that perfectly references a genuine recent order, project deadline, or correct invoice sequence.

• The message instructs the client to pay into a new Nigerian bank account, claiming an ongoing tax audit or branch transition required the update.

• Busy finance departments process the request under routine operational pressure, unknowingly authorising a transfer straight to the fraud ring.

• The crime is usually uncovered weeks later, when the real supplier follows up on their outstanding balance, by which point the money has already been moved and laundered.

Why this scam works

Invoice processing is a high-volume, routine task that often occurs under tight organisational deadlines, leading employees to default to quick pattern matching.

If an invoice looks identical to the previous 50 bills processed by that vendor, it rarely receives scrutiny. AI removes the odd phrasings, formatting errors, and low-resolution logos that used to serve as the primary warning signs for accounts payable staff.

Furthermore, the scam exploits standard corporate hierarchies and regular administrative events. A change of banking provider is a completely plausible event that rarely sets off alarm bells unless a company has strict independent verification processes in place.

By presenting an expected document from a long-standing partner, the scammer completely bypasses the emotional scepticism a target would display toward an unfamiliar financial request.

Real-life Context in Nigeria

In Nigeria, this threat is particularly evident in supply chain logistics, real estate transactions, and contract services.

The Central Bank of Nigeria (CBN) and the Nigeria Deposit Insurance Corporation (NDIC) frequently warn corporate entities about the rise in Business Email Compromise (BEC) and invoice manipulation targeting domestic commerce.

Fraud rings systematically monitor transaction patterns in commercial hubs like Lagos and Abuja, deploying AI tools to quickly draft matching payment requests whenever a vendor completes a significant delivery or project milestone.

A typical pattern

An administrative officer at a firm in Port Harcourt receives an email from their regular diesel supplier containing an invoice for the month’s fuel delivery.

The attached document features the vendor’s correct logo, correct corporate address, and accurately lists the exact volume of fuel delivered.

The email body, written in a clear and professional tone, notes that the supplier is updating their banking records and requests that the payment be made to a newly opened account with a different commercial bank.

The officer forwards the document to finance, where it is approved and paid because the layout looks completely standard.

Two weeks later, the managing director of the fuel company calls to ask why the month’s bill is overdue.

A close inspection reveals that the sender’s email address had one hidden extra letter, and that the entire invoice text and the banking modification note were generated by an AI tool using intercepted shipping records.

Common red flags

• An unexpected invoice arrives with an explicit notice claiming a sudden change in bank account details.

• The sender’s email domain shows a slight character variation when compared directly with the vendor’s known genuine domain.

• The email creates undue pressure and demands immediate payment outside your normal corporate billing cycle to avoid artificial penalties.

• The invoice references real past transactions or valid project names but directs funds to a completely new financial institution.

• The text alignment, font choice, or border formatting differs subtly from that of the supplier’s previously verified invoices.

• The sender explicitly requests that you keep the bank details update confidential or asks you to bypass normal departmental verification steps.

• The support telephone numbers or office addresses listed on the invoice do not match the contact details stored in your official vendor registry.

Sanitised example messages

“Kindly find attached our outstanding invoice for this month’s supply. Please note that our group has changed commercial banks – kindly process all future transfers to our new account listed on page 1.”

“URGENT PAYMENT REQUIRED: Please settle invoice #7255 for ₦500,000 by close of business today to ensure your corporate service access is not disrupted.”

“Dear customer, we are currently undergoing our annual financial audit. For this reason, please route your current balance to our temporary clearing account details attached below.”

Common variations

• Business Email Compromise where hackers use a compromised internal account to send AI-generated fake invoices directly to existing clients.

• Fake landlord or property management notices sent to tenants, claiming that rent payments must now go to a new personal or corporate bank account.

• Freelancer or independent contractor impersonation scams that blast out automated bills to businesses for digital services that were never commissioned.

• Utility or telecommunications spoofing, in which targets receive realistic bills threatening immediate disconnection unless a payment is made via an embedded link.

• Follow-up billing corrections sent minutes after a legitimate invoice, claiming the first document contained an error and providing a fraudulent set of bank details.

How to verify before you act

• Treat every notification regarding changes to bank details as highly suspicious until manually verified.

• Confirm any banking changes by calling a known, trusted supplier number you have used successfully before.

• Never use the contact phone numbers, links, or email addresses provided within the suspicious invoice or modification email itself.

• Implement a mandatory corporate verification policy that requires two internal managers to sign off before changing a vendor’s payout details in your system.

• Compare new digital invoices, character by character, against older, verified PDF bills to look for changes in formatting, margins, or resolution.

Payment methods used

• Bank transfer

• Business banking wire transfer

Who is usually targeted

• Accounts payable teams

• Small business owners

• Freelancers and contractors

• Individuals paying rent or utility bills

What to do immediately

• Halt all active payment transfers immediately if you spot a red flag or find an unverified account change.

• Contact your financial institution’s fraud desk right away if you have already transferred money to a suspicious account.

• Call the real vendor using an independent, verified communication channel to inform them that their identity or invoice layout is being copied.

• Check your internal email infrastructure, account logs, and sent folders for any unauthorised login attempts or malicious forwarding rules.

• Report the cyber incident immediately to national cybersecurity and financial crime enforcement agencies.

• Review and tighten your company’s internal accounts-payable approval steps to make telephone callbacks mandatory for all financial updates.

• Alert your entire department and surrounding branches so that colleagues do not process similar fraudulent documents from the same sender.

How to prevent it

• Require an independent phone callback to a verified, pre-existing contact number before updating any vendor bank account info in your database.

• Check sender email headers and domain names character by character instead of relying blindly on the displayed sender name.

• Maintain an offline, verified master contact list for all regular suppliers, kept entirely separate from incoming email data.

• Set up a strict dual-authorisation workflow for corporate outbound transfers that exceed a specific monetary threshold.

• Train your administrative and finance teams specifically on generative AI document forgery and modern business email compromise tactics.

• Avoid publishing detailed vendor, contractor, or supply chain relationship information on your company’s public social media pages.

Evidence to preserve

• ☑ The complete original email message containing the fake invoice, including the unedited email headers and routing data.

• The actual fake invoice PDF or document file showing the fraudulent bank account name and number used.

• Copies of genuine past invoices from the real supplier to serve as comparative evidence for investigators.

• Full bank transfer confirmations, reference numbers, and time stamps showing exactly where and when the funds were sent.

• All subsequent message exchanges with the legitimate supplier verifying that the billing request was unauthorised.

Where to report it

• Nigeria Police Force National Cybercrime Centre (NPF-NCCC): Report corporate document forgery, email compromise, and AI invoice fraud through the official NPF-NCCC e-Reporting Portal.

• Economic and Financial Crimes Commission (EFCC): Report business email compromise, procurement scams, and corporate bank diversion networks directly to the EFCC Reporting Portal.

• Central Bank of Nigeria (CBN): For corporate banking escalations or tracing fraudulent fund diversions across financial institutions, contact the Consumer Protection Department at cpd@cbn.gov.ng.

• Your Bank’s Fraud Desk: Contact your commercial bank’s emergency corporate fraud line immediately using the secure numbers listed on their official website or in your commercial banking app to freeze any subsequent transfers.

Warning: Following a major business scam, corporate victims are frequently targeted by recovery scammers. These actors reach out privately or post online, claiming they can hack into the fraudster’s accounts, track the funds, or reverse bank wire transfers for an upfront consultation fee. Legitimate financial recovery and law enforcement investigations in Nigeria are handled solely through official regulatory channels and do not require upfront private fees via messaging apps.</

Frequently asked questions

How can I tell an AI-generated fake invoice from a real one? AI-generated invoices look pristine and perfectly mimic real corporate templates, meaning you cannot rely on visual checks alone. The only definitive way to spot them is by checking for altered banking details, mismatched email addresses, and unverified change requests.

What is the single most effective defence against this scam? The most effective defence is a strict, mandatory verbal verification policy. Never update a vendor’s bank account number in your payroll or accounting system without calling a known, trusted contact person on an independently sourced phone number to confirm the change.

Can this happen to individuals, not just businesses? Yes, individuals are frequently targeted with fake AI-generated invoices for everyday expenses like house rent, school tuition, or car repairs, especially if hackers have compromised a local service provider’s email account.

What should I do if I’ve already paid a fake invoice? Call your bank’s fraud or corporate security department immediately to report the transaction reference number and request a recall of funds. Time is critical, as scammers move diverted funds out of their initial deposit accounts very rapidly.

AIBase