The Fake Invoice Scam
The invoice arrives looking official: a renewal notice, a past-due bill, an invoice for software the parent never bought. It is the quietest scam of all, because it asks the parent to pay money they think they owe. This page is recognition, the two-minute check, and the recovery path if the bill was paid.
a bill for something not ordered is a scam until verified
The fake invoice check
A realistic-looking bill for a product or renewal the parent never ordered is the scam. The two-minute check verifies through the company's official channel, never through the bill's own contact info.
- RecognizeOne minute, three tellsA bill for something nobody ordered, urgency with a threat ("pay now or collections"), and a payment link or QR code in the email instead of a bill mailed to the address on file.
- The checkNever use the contact info on the billSearch the company's official site and call its published number, or check the parent's account history directly. Then ask the parent: did they actually sign up for this?
- If it is realCancel through the official channelA renewal the parent did not want gets cancelled through the real account and the charge disputed if one appears, never paid from the email.
- If it was paidFirst-hour recoveryContact the payment method used through an official number, preserve the invoice email and payment confirmation, report at reportfraud.ftc.gov, and update any stored card, because the scammer now has the details.
The rule, in one sentence: a bill for something the parent did not order is a scam until verified through the company's official channel, never through the bill's own contact info.
How it works
The fake invoice scam sends a realistic-looking bill for a product, service, subscription, or renewal the parent never ordered: an antivirus renewal, a domain registration, a magazine subscription, a "past due" invoice with a threat of collections. The payment link goes to the scammer. It works on the assumption that the parent will pay a familiar-looking bill without checking, and that the amount is small enough to go unnoticed.
Recognition in one minute
- A bill for something nobody ordered, especially for a service the parent cannot remember buying.
- Urgency and a threat: "pay now or collections," "your service will be cancelled."
- A payment link or QR code in the email, rather than a bill mailed to the address on file.
- Slight inaccuracies: the wrong company name, a weird email domain, or a phone number that does not match the company's site.
The two-minute check
- Do not use the contact info on the bill.
- Search the company's official site and call its published number, or check the parent's account history directly.
- Ask the parent: did they actually sign up for this? Most victims find they did not.
- If it is a renewal the parent did not want, cancel through the official channel and dispute the charge if one appears.
If a fake bill was already paid
Contact the payment method used (card issuer, bank, or payment app) through an official number and report the charge, exactly like the first-hour recovery plan. Preserve the invoice email and the payment confirmation, and report it to the FTC at reportfraud.ftc.gov. If the parent used a card that was stored online, consider updating it, because the scammer now has the details.
The prevention habit
Teach the parent one rule: "If a bill shows up for something I did not order, I do not pay it and I do not call the number on it; I tell my family." The same one-line rule as the suspicious message playbook covers the invoice version too.
Related guides
- The fake renewal scam: the subscription cousin of this one
- The fake check scam: the overpayment version of an unexpected payment request
- First-hour scam recovery
- Managing the parents' bills
Sources & verification
This page is checked against the standards in our editorial policy, preferring government sources for scam patterns. Reviewed August 2026:
- FTC: How To Avoid a Scam (retrieved August 2026)
- FTC: What To Do If You Were Scammed (retrieved August 2026)
Found an error? Report it: we log and correct material mistakes publicly.
Found an error? Report it.