Invoice fraud cases are prosecuted federally under the wire fraud and mail fraud statutes, which carry up to 20 years in prison per count, and victims can pursue parallel civil recovery through fraud claims, civil RICO with treble damages, or a False Claims Act suit when the defrauded party is the federal government. Which tools apply depends on who was targeted and how the fraud was carried out, and how much money the victim actually sees back depends largely on what happens in the first 48 hours after discovery.
The Three Patterns Behind Most Invoice Fraud
The method of attack shapes which statutes prosecutors reach for and how hard recovery will be.
Business email compromise is the dominant method. An attacker gains access to a legitimate corporate email account, watches the conversation for pending payments, and then sends a message that appears to come from a trusted vendor asking that future payments go to a new bank account. The email address looks authentic and the timing matches real transactions, so the wire goes through. Within hours, the money moves through intermediary accounts.
Shell company schemes rely on fake entities with names that closely resemble real suppliers. “Acme Industrial Supplies” becomes “Acme Industria1 Supplies” in the accounting system, and the fake entity submits invoices for goods never delivered. Recovery from shell companies is especially difficult because the entity exists only to receive and move stolen money.
Insider manipulation happens when an employee with access to accounting software reroutes payment information on real invoices or generates fabricated charges, sometimes splitting proceeds with an outside accomplice. These cases run longer before detection because the person committing the fraud also controls the records that would expose it.
Federal Criminal Charges Prosecutors Stack
Federal prosecutors rarely bring a single charge in an invoice fraud case. They stack overlapping statutes to increase sentencing leverage.
Wire Fraud and Mail Fraud
Wire fraud is the primary charge in nearly every modern invoice fraud prosecution. It covers any scheme to defraud that uses electronic communications, which captures virtually every fraudulent invoice sent by email or paid through online banking. A conviction carries up to 20 years per count. When the fraud affects a financial institution, the maximum rises to 30 years and the fine ceiling to $1,000,000.1Office of the Law Revision Counsel. 18 U.S. Code 1343 – Fraud by Wire, Radio, or Television
If a fraudulent invoice or check moves through the U.S. Postal Service or a private interstate carrier, mail fraud applies with identical penalties.2Office of the Law Revision Counsel. 18 USC 1341 – Frauds and Swindles
The standard felony fine for an individual is capped at $250,000, but a separate provision lets the court impose a fine equal to twice the gross gain to the defendant or twice the gross loss to the victim, whichever is greater. In a multimillion-dollar scheme, that alternative calculation dwarfs the standard cap.3Office of the Law Revision Counsel. 18 U.S. Code 3571 – Sentence of Fine
Computer Fraud and Abuse Act
When the attacker broke into a company’s email system or network to carry out the fraud, prosecutors add Computer Fraud and Abuse Act charges. Unauthorized access to a protected computer in furtherance of fraud carries up to five years for a first offense and up to ten for a repeat offender.4Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection with Computers
Aggravated Identity Theft
This is the charge that catches many defendants off guard. Using another person’s identity during a fraud felony adds a mandatory two-year sentence that must run consecutive to the sentence for the underlying fraud. The court cannot shorten the fraud sentence to offset it, and probation is not available. In BEC cases where the attacker impersonates a real vendor or employee, this charge stacks on top of everything else.5Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
Mandatory Restitution
Federal law requires restitution in fraud cases. When a defendant is convicted of an offense committed by fraud or deceit and an identifiable victim suffered financial loss, the court must order repayment equal to the value of what was lost.6Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes
The Supreme Court confirmed in January 2026 that restitution under the Mandatory Victims Restitution Act is criminal punishment rather than a civil debt. The government, not the victim, enforces the order, which means the defendant cannot quietly negotiate the amount down in a side deal with the victim.
A restitution order is only as good as the defendant’s ability to pay, though. When stolen funds have already moved offshore or been spent, collection can take years or prove impossible. That reality is the main reason civil remedies matter even after a successful prosecution.
Civil Remedies for Private Victims
A criminal case punishes the fraudster. It does not always make the victim whole. Companies defrauded through fake invoices have two main civil avenues.
Civil Fraud
A civil fraud claim requires proving that the defendant made a false statement of material fact, either knowing it was false or acting recklessly as to its truth, that the defendant intended the victim to rely on the statement, that the victim reasonably relied on it, and that the reliance caused actual financial harm.7Cornell Law Institute. Fraud
Reasonable reliance is where invoice fraud cases get contested. Defendants often argue the victim should have caught the fraud through better internal controls. Courts generally hold that a company is entitled to rely on invoices from what appears to be an established vendor relationship, but reliance becomes harder to justify when red flags were ignored. A sudden change in bank account information paired with urgent pressure to pay immediately is the classic example.
Civil RICO
When invoice fraud involves ongoing criminal activity rather than a one-off, victims can bring a civil claim under the Racketeer Influenced and Corrupt Organizations Act. A successful plaintiff recovers three times actual damages plus reasonable attorney’s fees. The predicate acts are typically the same wire and mail fraud offenses that drive the criminal case.8Office of the Law Revision Counsel. 18 USC 1964 – Civil Remedies
Civil RICO is not easy to win. The plaintiff must show a pattern of racketeering activity, meaning at least two related predicate acts and evidence of either ongoing conduct or a threat of continued activity. A single fraudulent invoice almost certainly will not qualify. A scheme that sent dozens of fake invoices over several months to multiple victims starts to look like exactly what RICO was built for, and the treble damages make the added complexity worth it when the facts support the claim.
When the Government Is the Victim: The False Claims Act
If the fraudulent invoices went to a federal agency rather than a private company, the False Claims Act takes over as the dominant tool. Anyone who knowingly submits a false claim for payment to the federal government faces civil penalties between $14,308 and $28,618 per false invoice, adjusted annually for inflation, plus three times the government’s actual losses.9Office of the Law Revision Counsel. 31 USC 3729 – False Claims10Federal Register. Civil Monetary Penalty Inflation Adjustment
Private citizens can enforce the statute. A whistleblower, called a relator, files a qui tam suit on behalf of the government under seal, giving federal investigators time to evaluate the case before anyone else knows about it. If the government intervenes and takes over, the relator receives 15 to 25 percent of any recovery. If the government declines and the relator proceeds alone, the share rises to 25 to 30 percent.11U.S. Department of Justice. The False Claims Act – A Primer
The False Claims Act does not reach fraud between private parties. If the fake invoices never touched a federal program or contract, this route is closed.
Deadlines That Can End a Case Before It Starts
The standard federal statute of limitations for wire fraud and mail fraud is five years from the commission of the offense. When the fraud affects a financial institution, the window extends to ten years.12Office of the Law Revision Counsel. 18 USC 3293 – Financial Institution Offenses
Civil fraud deadlines vary by state and typically run two to six years, often from the date the fraud was discovered rather than committed. Civil RICO claims must be filed within four years. False Claims Act suits run six years from the violation, or three years from when the government knew or should have known, with an absolute ten-year cap. Missing any of these windows ends the claim regardless of how strong the evidence is.
The First 48 Hours Matter More Than Anything Else
Speed is the single biggest factor in actually getting stolen money back.
Call the originating bank immediately and request a recall or reversal of the wire. Ask for a Hold Harmless Letter or Letter of Indemnity, which the bank needs in order to coordinate with the receiving institution.13Federal Bureau of Investigation. BEC – Internet Crime Complaint Center
File a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov with full banking details. The FBI’s Recovery Asset Team uses IC3 complaints to contact receiving banks and request account freezes. In 2021, the team helped freeze more than $328 million out of $443 million in reported losses, a 74 percent success rate that depends entirely on victims reporting quickly and including complete account information.
Preserve the evidence. Do not delete emails, alter records, or try to clean up compromised systems before forensic investigators can look at them. Forward suspicious emails as attachments rather than inline so the full header information survives. Write down the timeline while it is still fresh.
Notify any cyber liability or crime insurance carrier right away. Many policies have strict reporting deadlines, and late notice can void coverage. Some policies also pay for forensic investigation, which can run from $250 to $500 per hour.
Money sitting in the first receiving account can often be frozen. Money that has already moved through two or three intermediaries is exponentially harder to reach. Waiting a few days is often the difference between recovery and a restitution order the defendant will never be able to pay.