Verifiying an Invoice Before Payment

How to Verify an Invoice Before Payment: A Practical Guide

Before you pay an invoice, confirm four things. The sender is who they claim to be. The invoice matches something you actually ordered. The bank details belong to the supplier, confirmed through a channel the invoice itself didn’t supply. And the document in front of you is the same one the supplier issued. Most invoice fraud gets through because one of these was assumed instead of checked, and the bank details are the usual weak spot.

The rest of this guide goes through each check in order. It also covers where a cryptographic file fingerprint, the kind Certelo creates, helps with the last one and where it does nothing at all.

Why this is worth ten extra minutes

Invoice fraud isn’t exotic. In the FBI’s 2025 Internet Crime Report, business email compromise produced about $3.05 billion in reported US losses from 24,768 complaints. Those are only the cases someone reported. The typical scheme isn’t clever. Someone sends a believable invoice, or a “please use our new account” email, and a person in finance pays it because everything looked normal.

Looking normal is the whole problem. A forged invoice can use the right logo, the right invoice numbering style and the right tone. Visual inspection catches clumsy fakes. It won’t catch a careful one.

Start with the question of who actually sent it

Check the sender before you open the attachment. Look at the full email address, not the display name. A lookalike domain (one swapped letter, or a hyphen added) is the oldest trick and it still works.

A correct sender address doesn’t settle it either. If the supplier’s real mailbox has been compromised, the email is genuine in every technical sense and the content is still fraudulent. So treat the email as a claim to be checked, not as proof.

Match it to something you asked for

An invoice should trace back to an order, a contract, a signed quote or a delivery. If you can’t connect it to any of those, stop there.

Where you have the process for it, a three-way match is the classic control. Compare the purchase order, the goods receipt or confirmation of service, and the invoice, and pay only when quantities, prices and terms agree. Small teams rarely run a formal version, but the habit scales down. Ask whether you ordered this, whether it arrived and whether the amount is what you agreed.

Watch for the quiet variants too. A real supplier’s real invoice with one line item inflated. A duplicate of last month’s invoice with a new number. A “final reminder” for something you already paid.

Bank details are where the money actually moves

Attackers care about one field above the others. The logo, the layout and the line items exist to get you to trust the account number at the bottom.

Compare the bank details against what you already have on file for that supplier. If they differ, don’t pay yet. Contact the supplier using a phone number or email you already held from before this invoice, such as an earlier contract, your own records or the website you’ve used for years. Don’t use the contact details printed on the new invoice, and don’t reply to the email that asked for the change. Replying to the message that raised the question tells you nothing, because you’re talking to the same person who raised it.

Then update your vendor record only after that confirmation, and ideally have a second person approve the change. Changing bank details should be slower than paying an invoice. That friction is deliberate.

The PDF problem nobody talks about

Here’s a gap in most invoice checklists. Everything above verifies the people and the process. Almost nothing verifies the file.

A PDF is easy to edit. An invoice can be intercepted in transit, altered and forwarded, or edited by someone with access to a mailbox or shared folder. Sometimes the change is a single digit in an account number. The result looks identical to the original unless you have the original to compare against, and in practice you usually don’t.

This is where a cryptographic hash is genuinely useful, and it’s worth understanding before deciding whether it fits your workflow.

A hash function such as SHA-256 (specified by NIST in FIPS 180-4) turns any file into a fixed-length string of characters. Change the file by even one character and the string changes completely. If two files produce the same hash, they are, for all practical purposes, the same file. If they don’t, they aren’t.

So the question “is this the invoice the supplier issued?” becomes checkable. It needs one extra condition: someone has to have recorded the original’s hash at the time it was issued, in a place the attacker can’t quietly rewrite.

Where a timestamp fits in

Certelo records exactly that. It calculates the SHA-256 hash of a file locally on the user’s device, so the invoice itself doesn’t have to be uploaded just to create the record. The hash is then anchored to the Electra Protocol blockchain. That gives a public, independently verifiable record that this particular fingerprint existed at or before the recorded blockchain time.

There are two practical ways this can be used around invoices.

On the supplier side:

A supplier who anchors each invoice at the moment it is issued creates a record that the payer can check against. When the invoice arrives, the payer hashes the received file and compares. A match means the file you hold is the one that was anchored. A mismatch means something about it changed, and that is the moment to call the supplier.

On the payer side:

Even when the supplier does nothing, you can anchor the invoice at the point you approve it for payment. That records which version you approved, bank details included. If someone later alters the file in a shared folder, or a dispute arises over what was approved, you can show the approved version’s fingerprint against whatever is now in the folder. For teams that care about audit trails, this is often the more realistic use.

What the fingerprint cannot tell you

This part matters, because overselling it would make your payment process worse, not better.

A Certelo record is evidence that a specific digital fingerprint existed at a point in time. It does not establish that the invoice is genuine in a business sense. It doesn’t show who created the file, whether the supplier is real, whether the goods were delivered, or whether the bank account belongs to the supplier. A fraudster can hash and timestamp a fake invoice just as easily as a legitimate supplier can hash a real one. The record would be perfectly valid and the invoice still fraudulent.

Two consequences follow. First, the timestamp is only as trustworthy as the channel through which you learned of it. If certificate details arrive in the same compromised email thread as the invoice, they prove nothing. Get them from a channel you already trust, or from the supplier’s own system. Second, none of this replaces the callback on bank details. It narrows one specific risk, which is a file altered after issue, and leaves the other checks where they were.

Legal weight is a separate question again. Whether a blockchain timestamp is accepted as evidence depends on the jurisdiction and the dispute, and it isn’t a substitute for advice from a lawyer.

A realistic run-through

Take a hypothetical case. A design studio, which we’ll call Northfield Studio, is a regular supplier to a small agency. In month five, an email arrives from the studio’s usual address with a normal invoice, except the bank details have changed.

The agency’s bookkeeper does what the process says. She compares the details to the vendor record and sees they differ. She doesn’t reply to the email. She phones the number she has from the original contract and reaches the studio’s owner, who knows nothing about a new account. Payment is stopped.

If Northfield had anchored its invoices, she would have had a second signal. The PDF she received would hash to something different from the anchored original, so the file had been changed. She’d still have made the phone call. The hash would simply have told her why.

That is the honest shape of the benefit. It’s a second line of evidence, not a first line of defence.

Checking a file against a Certelo record

When a record exists, verification is short. Open Certelo’s verification page and provide the original file, the hash, or the certificate information. The file is hashed locally, and the result is compared with the hash anchored on the blockchain. If they’re identical, the file is unchanged since it was anchored. If they differ, it isn’t the same file, and you shouldn’t treat the discrepancy as minor.

Because the blockchain record is public, the check doesn’t depend on trusting Certelo’s word alone. Anyone with the hash can look the entry up independently.

A short list to keep next to the payment screen

* Check the full sender address, not just the display name.

* Trace the invoice to an order, contract or delivery you recognise.

* Compare amounts and line items against what was agreed.

* Compare bank details with your existing vendor record.

* If anything about the account changed, confirm by phone using details you held beforehand.

* Have a second person approve any change to supplier bank details.

* Where possible, fingerprint the approved version so later edits are detectable.

* Keep the confirmation, whether a call note or a verification record, with the invoice.

Questions people ask

Can a PDF invoice be altered after it’s sent?

Yes. A PDF can be edited, re-exported or rebuilt to look identical to the original. Without a record of the original’s hash, or the original file itself, a quiet change is very hard to spot by eye.

Does a blockchain timestamp prove an invoice is real?

No. It shows that a specific file fingerprint existed at or before a particular time. It says nothing on its own about who created the file, whether the supplier is legitimate or whether the amount is owed.

Does Certelo upload my invoice?

No. The SHA-256 hash is calculated locally on your device, and the original file doesn’t need to be uploaded just to create the record.

What if the supplier doesn’t use any timestamping?

You can still anchor the invoice yourself when you approve it. That won’t prove it was unchanged before it reached you, but it will record the version you approved.

How do I verify changed bank details?

Contact the supplier through contact details you held before the request, never through the invoice or the email that asked for the change. Update your records only after that confirmation.

What should I do if I’ve already paid a fraudulent invoice?

Contact your bank immediately and ask about a recall. Then report the incident. In the US that means filing a complaint with the FBI’s IC3. Speed matters, so don’t wait to investigate internally first.