The $14,000 Email: Inside the Invoice Scam Draining Filipino-American Storefronts

The email landed at 7:42 on a Tuesday morning, which is exactly when the produce order usually arrives. Same logo. Same signature. Same cheerful closing line about the weather in Salinas. The only difference was a short paragraph: the supplier had switched banks, effective immediately, and would the owner please route this week's payment to the new account?

She wired $6,800. Three days later, the real invoice showed up. So did the real supplier, calling about a payment that never came.

The details above are a composite of the pattern that shows up again and again in Filipino-American retail — carinderias, bakeries, hardware stores, small groceries, salons. The amounts vary. The ending rarely does.

How the Scam Actually Works

This is not a hacker in a basement guessing passwords one letter at a time. It is usually one of two things.

Spoofing. The attacker registers a domain that looks nearly identical to your supplier's — one letter swapped, a hyphen added, a .co where .com should be — and sends from an address that reads perfectly at a glance on a phone screen.

Account takeover. Worse, they get into the supplier's real mailbox. They read weeks of correspondence, learn your order cadence, your contact name, the way your supplier writes. Then they reply to an actual thread. Everything checks out because everything is real, except the bank details.

Either way, the timing is deliberate. Attackers send banking-change notices right before a scheduled payment, when you are already in motion and not inclined to slow down.

Why Neighborhood Shops Get Picked

Small, trust-driven businesses are close to the ideal target. Four reasons stand out.

You are busy and you are the whole IT department. There is no accounts payable clerk to catch a discrepancy. There is you, a phone, and a stack of deliveries.

Your vendor relationships are predictable. Same supplier, same week, same amount. Predictability is a gift to someone reading your email.

Your relationships are built on trust, and trust resists verification. Many owners were raised to find it rude — nakakahiya — to call a long-time supplier and ask, essentially, "are you really you?" That reflex is decent and human and it is exactly what the scam counts on.

Your vendor list is semi-public. Distributor relationships get mentioned on social media, printed on invoices left on the counter, discussed in group chats.

Four Things That Should Make You Slow Down

1. A bank change and urgency in the same message. Legitimate suppliers announce banking changes on letterhead, weeks in advance, with a callback number. They do not usually pair it with "please process today."
2. A reply-to address that doesn't match the sender. Tap the sender name on your phone and look at the actual address. [email protected] is not [email protected].
3. A shift in voice. Slightly more formal, or missing the inside joke, or suddenly using your first name when they always used your last. Trust your ear.
4. A push to a private channel. "Please confirm via text to this number" or "reply only to this address." Legitimate businesses generally do not need to route around your own records.

The Ten-Minute Callback Rule

This is the whole defense, and it costs about ten minutes a month.

Any request to change payment details gets a phone call — to a number you already had. Not the number in the new email. The one on last month's invoice, the one in your phone's contacts, the one on the supplier's website that you navigate to yourself.

Then ask one question the real vendor would answer and an impersonator could not. Not a security question — something operational. "Did the Thursday truck include the extra case of calamansi?" "Is Marco still driving the Tuesday route?" You are not being paranoid. You are confirming a delivery, which is a completely normal thing to do.

Two supporting habits that cost nothing:

• Set a threshold. Any outgoing transfer over a set amount — $2,000, $5,000, whatever fits — requires a second human to look at it. If it's just you, it requires a 24-hour pause. Nearly every wire fraud succeeds because it had to happen now.
• Keep one channel boring. A shared note, a spreadsheet, a text thread with your top three vendors' real numbers. When something feels off, you have somewhere to look besides your memory.

If You Already Sent the Money

Move fast, and in this order.

Call your bank and ask specifically for a wire recall. If the transfer hasn't been collected, there is a real chance of recovery — the first 24 hours matter enormously. File a complaint with the FBI's Internet Crime Complaint Center (IC3). Tell the real supplier so they can warn other customers. Then change your email password, turn on two-factor authentication, and — this is the step people miss — check your mailbox settings for auto-forwarding rules, which attackers add so they keep reading your mail after you lock the door.

Recovery is not guaranteed. Prevention is cheap.

Make Boring the Default

Write the protocol on one page. Print it. Tape it inside the register drawer or next to the monitor where the person who pays bills will see it. It should say, in plain language: Any change to how we pay someone gets a phone call to a number we already know. Every time. No exceptions, including for people we love.

Then say it out loud to your staff, your bookkeeper, and the family member who helps with the books on weekends. The scam works once per business, usually. A ten-minute phone call is a strange thing to lose fourteen thousand dollars over — but that is precisely the trade being offered.