How to Verify Invoice Authenticity: A Step-by-Step Process
Knowing the red flags to look for is only half the job — the other half is having a consistent process you actually run on every invoice, not just the ones that look suspicious. This guide lays out a repeatable, step-by-step verification process you can apply to any supplier invoice before it's approved for payment.
Why a Checklist Beats "Looking Suspicious"
Most invoice fraud isn't caught because someone found it "suspicious" — trained fraudsters design invoices specifically to not look suspicious. It's caught because someone ran the same handful of checks on every invoice, regardless of how legitimate it appeared, and one of those checks turned up a mismatch.
The process below is built around that idea: a small number of steps, applied consistently, rather than relying on instinct alone.
The 6-Step Verification Process
Before anything else, confirm the invoice corresponds to a PO, signed contract, or a specific person at your company who can vouch that the goods or services were actually requested and delivered. An invoice that can't be matched to anything shouldn't move forward.
This is the single highest-value check in the entire process. Invoice redirect fraud only changes the banking details — everything else on the invoice is genuinely correct, because it's frequently a real invoice that's been intercepted and altered.
Typosquatted domains are built to be missed at a glance — an added hyphen, a transposed letter, a swapped top-level domain. Compare the sending domain against a prior, trusted invoice from the same vendor, not from memory.
If the routing number, remittance address, or contact details are different from what's on file, this is the step that actually resolves it — not email, not the number listed on the invoice itself.
Vague descriptions ("consulting services," "IT support") with no hours, deliverables, or reference number make an invoice hard to verify against anything real. Round amounts for complex work, or amounts just under a $10,000 reporting threshold, are also worth a second look.
A tool that automatically checks routing number validity, domain patterns, and known scam language catches things manual review sometimes misses on a busy day — and creates a documented record that the check was done.
Which Steps PaySentinel Automates
The process above has both pattern-based checks (fast to automate) and one relationship-based check (a phone call) that should always stay manual.
| Step | PaySentinel detects? | How |
|---|---|---|
| PO / contract match | Manual step | Requires access to your internal PO system — do this before running a check |
| Routing number vs. vendor file | ✓ Yes | Compares against your vendor history in local memory and flags any change from prior analyses |
| Typosquat email domain | ✓ Yes | Checks the email domain against known typosquat patterns |
| ABA routing number validity | ✓ Yes | Runs ABA checksum validation on every routing number submitted |
| Amount plausibility / structuring | ✓ Yes | Flags round amounts and amounts just under the $10,000 reporting threshold |
| Phone verification with a known contact | Manual step | This should always stay a human step — no tool can confirm you're actually speaking to the real vendor |
Open the Invoice tab in the app. Paste in the vendor name, their email address, the routing number, the invoice amount, and any notes about how the invoice arrived. PaySentinel returns a risk score with specific flags and recommended next steps — free, no account required.
Verify an invoice now
Paste in the vendor name, routing number, amount, and email — PaySentinel checks it against known fraud signals and gives you a risk score in under a minute. Free for small businesses.
Check an invoice free →Frequently Asked Questions
For a routine invoice from a known vendor with no changed details, under two minutes — mostly a quick comparison against your vendor file. Verification only takes longer when something doesn't match, such as a changed routing number or a new vendor, which is exactly when the extra time is warranted.
Confirm the routing and account number against your own vendor records, not the invoice. This one check catches the highest-value fraud pattern — invoice redirect fraud — where everything else on the invoice is genuinely correct except the banking details.
Yes, at minimum a routing number and email domain check every time. Established vendor relationships are actually the primary target for invoice redirect fraud, because a long payment history means less scrutiny is typically applied — which is exactly what fraudsters count on.
Parts of it. Three-way matching against a PO is often built into accounting software. Pattern-based checks — routing number validity, domain typosquatting, urgency language — are what a tool like PaySentinel automates.
Confirming a change by phone with a known contact is the one step that should stay manual — no automated tool can confirm you're actually speaking to the real vendor.