You spent weeks on the project. The client was happy with the delivery. You sent your invoice and waited for payment. Then your client calls — confused — saying they already paid three days ago.
They paid. Just not to you.
Someone intercepted your payment conversation, swapped your account details for theirs, and collected money your client genuinely sent. Your client lost money they cannot recover. You lost payment for work you genuinely completed. And the relationship between you and your client is now strained through no fault of either party.
This is invoice fraud. It is growing rapidly among Nigerian freelancers, creative agencies, web developers, content creators, and any service business that sends invoices through email or messaging apps.
How Invoice Fraud Works
The scam operates through three main entry points — compromised email, compromised client email, and social engineering.
1. Your Email Is Compromised
A fraudster gains access to your email account — through a phishing attack, a weak password, or a data breach. They monitor your conversations silently, watching for invoicing activity. When you send an invoice to a client, they intercept it before it arrives, alter the account details to their own, and forward the modified invoice to your client.
Your client receives what appears to be your invoice, pays the account on it, and believes the transaction is complete. You receive nothing.
2. Your Client's Email Is Compromised
The same process but from the other direction. The fraudster monitors your client's inbox. When your real invoice arrives, they delete it before your client sees it and send a modified version with different payment details. Your client pays the fraudulent account believing they are paying you.
3. The Social Engineering Approach
No email hacking required. A fraudster contacts your client directly — pretending to be you or a member of your team — and informs them that your payment details have changed. "Our bank account has been updated, please use these new details for the invoice payment." Clients who do not have a verification process in place often comply without questioning.
Why Nigerian Freelancers Are Particularly Vulnerable
Invoice fraud disproportionately affects Nigerian freelancers and agencies for specific reasons.
Most freelance payment communication happens through Gmail, WhatsApp, or Instagram DM — platforms where account security is often weak and where clients are accustomed to receiving payment details through messages rather than formal systems.
Nigerian freelancers frequently work with clients they have never met in person, making voice verification feel awkward or unnecessary. And the invoice amounts involved — website projects ranging from ₦150,000 to ₦2,000,000, brand identity packages, content retainers — make the fraud financially devastating.
The Warning Signs
Your client says they paid but you received nothing. This is the most obvious signal — investigate immediately rather than assuming a bank delay.
A client asks you to confirm new payment details you never sent. Someone is impersonating you to your own client.
Your client mentions receiving an email from you that you never sent. Your email or their email has been compromised.
A "team member" contacts your client about payment without your instruction. Your business identity is being used by someone else.
What Sir Brown AD Recommends
Secure your email account completely.
Enable two-factor authentication on your email immediately. Use a strong, unique password. Check your account's active sessions and log out any unrecognized devices. Review your email forwarding rules — fraudsters sometimes set up silent forwarding rules that copy your emails to their address without your knowledge.
Use a payment link instead of sharing account numbers in conversation.
Generate a Paystack or Flutterwave payment link for every invoice. Send the link through your invoice document rather than pasting account numbers in a message. A payment link goes directly to your verified merchant account — it cannot be intercepted and altered the way a typed account number can.
Establish a verbal confirmation policy for large invoices.
For any invoice above a threshold you set — perhaps ₦100,000 — call your client directly to confirm your payment details before they transfer. One phone call eliminates the entire fraud.
Watermark your invoice documents with your face or logo.
A modified invoice that has been altered loses your branding integrity. Use a professional invoice template with your logo, your face, and your contact details embedded in a way that is immediately obvious if tampered with.
Tell clients upfront that you never change payment details by message.
Include a statement on every invoice: "Payment details on this invoice are final. We will never request a change to payment details through email or messaging. If you receive any such request, call us directly to verify." This one sentence has prevented significant losses for businesses that use it.
What to Do If Invoice Fraud Has Occurred
Contact your client immediately and clarify what happened. Confirm the account they paid into and obtain the transaction reference.
Report to your bank and your client's bank with the fraudulent account details. Banks can sometimes freeze accounts that have received fraudulent payments if reported quickly enough.
File a report with the Nigeria Police Force Cybercrime Unit. Provide all evidence — the fraudulent invoice, conversation screenshots, and transaction details.
Change all your passwords immediately and audit your email for unauthorized access or forwarding rules.
Conclusion
Invoice fraud targets the space between completing excellent work and receiving fair payment for it. Sir Brown AD finds this particularly cruel — it victimizes the most professional, hardworking Nigerian entrepreneurs at the moment they deserve to be paid.
Secure your email. Use payment links. Verify large payments by phone. And tell every client upfront that your payment details never change by message.
Your work has value. Protect the payment process with the same quality you bring to the work itself.
Get new Security & Fraud alerts
One email when a new security & fraud article like this one goes live. No spam, unsubscribe anytime.
