An Invoice You Don’t Remember: A Year-End Check for Small Offices
Year-end bills for directory listings, domain renewals, SEO or supplies nobody ordered. Three questions before paying, and what federal law says about it.
The bill says “past due,” names your business correctly and asks for a few hundred dollars to renew a listing. Nobody remembers ordering it. Before anyone pays to make it go away, ask three questions.
Fake invoices are an old scheme that keeps working because small offices pay many small bills, often to vendors one person set up years ago. In a May 14, 2026 alert, the Federal Trade Commission said scammers “send fake invoices to businesses for products or services they never ordered,” naming “tech support, domain registration, or search engine optimization services” as examples. Some carry “past due” notices, some borrow the name of a known brand, and some arrive by email as phishing.
Question 1: Did we order it?
Look for a purchase order, a signed agreement, an order confirmation or a previous payment to the same company. Search your email and accounting software for the vendor name, not the amount. A real renewal usually has a history; a fake one usually does not.
Federal law is on your side for physical goods. Under 39 U.S.C. § 3009, merchandise mailed without your prior request or consent “may be treated as a gift by the recipient,” and the sender may not send a bill or “dunning communications” for it. The FTC’s page on being billed for things you never got puts it simply: you are “legally entitled to keep it as a free gift.” Its small business scams guide says the same for businesses.
Question 2: Who approved it?
The FTC’s guide advises: “Make sure procedures are clear for approving purchases and invoices and ask your staff to check all invoices closely.” In a small office, that can be one rule: every invoice has a named person who confirms the goods or service arrived. An FTC business blog post about office supply billing schemes adds a second: have one person handle all supply inquiries, and “don’t pay a penny unless you know the bill is for items you or your staff actually authorized.”
Question 3: Does it match what we already have?
A fake invoice may use a real vendor’s name with a new payment address or bank account. Compare the invoice against your vendor records, not against the invoice’s own contact details. If anything differs, call the vendor on the number you already had. The FBI’s guidance on business email compromise says to verify changes in account information through a secondary channel; our article on the layered fake-CEO and fake-vendor invoice lure shows why.
The usual suspects
| Invoice for | What it often looks like | Check |
|---|---|---|
| Directory or “yellow pages” listing | A renewal notice after a call asking you to “verify” or “update” your details | Find a signed order. The FTC has sued directory schemes that used exactly this approach |
| Domain name renewal | A notice from a company that is not your registrar, sometimes priced higher | Log in to your actual registrar’s account by typing its address |
| SEO, web hosting or “tech support” | A “past due” invoice, sometimes in a well-known brand’s name | Check whether you have an account with that company at all |
| Office or maintenance supplies | A box arrives, then a bill; or a bill for supplies never delivered | Unordered goods may be kept as a gift under § 3009 |
| A government fee or permit | A bill referencing a real permit or filing | Contact the agency directly; see our article on fake city permit invoices |
What the FTC’s cases show
These schemes are not hypothetical. In December 2014 the FTC and Florida closed two business directory cases against operations that used “unsolicited telemarketing calls and bogus invoices with the walking fingers image.” Calls asked businesses to “verify” or “update” their information, and the defendants were banned from the directory business. In December 2018 the FTC obtained a court order against a US-Canadian operation that called businesses about “past-due” invoices for directory listings, search optimization or web hosting they never ordered, and threatened collections.
The common thread is a phone call that creates a record you never meant to make. A safe habit for whoever answers the office phone: never “confirm” business details for a caller you did not contact, and say that all purchases go through one named person.
Domain renewals deserve their own note
ICANN, which coordinates the domain name system, says in a 2020 blog post that it will never send a domain name expiration reminder or renewal request, and that phishing emails “may claim that your domain name registration needs to be renewed.” ICANN’s suggestion is to ask your registrar to apply a “registrar lock,” which can help prevent changes. Write down who your registrar is, and when your domains expire, in the same place you keep other vendor records.
A 30-minute year-end vendor check
- Export the list of everyone you paid this year.
- Mark each vendor with the person who owns that relationship.
- Flag anyone you cannot match to a person or a contract.
- Note renewal dates for domains, listings and subscriptions you do want.
- Agree the rule for January: an invoice without an owner and a history is not paid until someone confirms it.
Pressure tactics such as a “final notice” or a call to the owner’s mobile phone are designed to skip that rule. Our guide to building a pause into the workday covers how to hold the line politely.
If you already paid
Contact your bank or card issuer the same day to ask about stopping or disputing the payment; the FTC notes that card disputes go in writing within 60 days. Report the invoice to the FTC at ReportFraud.ftc.gov and to your state attorney general. Keep the invoice and envelope or email. Paying a convincing bill during a busy month is a process gap, and the fix is the approval rule above.
Sources
- FTC: Run a small business? Pay your bills, not scammers (May 14, 2026)
- FTC: Scams and your small business
- FTC: Billed for things you never got, or unordered products
- 39 U.S.C. § 3009 (Cornell LII)
- FTC Business Blog: Billed for office supplies you didn’t order? (July 11, 2017)
- FTC press release, December 22, 2014
- FTC press release, December 18, 2018
- ICANN blog: Do you have a domain name? (April 30, 2020)