Key Insights
When First Brands collapsed in September 2025, lenders discovered that roughly $2.3 billion in receivables backing their advances had been pledged more than once, sold to multiple factors, or invented outright. The bankruptcy became one of the largest suspected factoring frauds in recent memory and a reminder that receivables finance can hide losses for years before anyone notices.
Invoice factoring fraud occurs when a scheme induces a factor to advance funds against a receivable that does not exist, was already sold, or will never be collected. It works because a factor pays a business for an unpaid invoice weeks or months before the account debtor actually settles it, advancing cash against the invoice, purchase order, and sometimes a confirmation call, while proof that the receivable was genuine only surfaces later, if at all. The risk extends to lenders holding the same receivable as collateral, to businesses that depend on factoring for working capital, and to debtors who can be tricked into paying the wrong account.
The guide below explains how fraud enters at each stage of the receivables lifecycle, catalogs the schemes factors encounter most often, and lays out the controls that catch them before losses compound. Weak verification at any single point can cascade into millions in unrecoverable advances, tangled competing claims, and criminal exposure that reaches well beyond the original funding decision.
Key Takeaways
A receivable moves through onboarding, submission, verification, funding, collection, and reserve release, each stage resting on a control some scheme targets.
Most schemes invent a receivable that never existed, alter one that did, sell the same one twice, or divert the debtor's payment.
Warning signs read best at the decision point where they surface; no single anomaly proves fraud alone.
Effective prevention pairs independent evidence before funding with monitoring after it, and extends verification across organizations.
What Is Invoice Factoring Fraud?
Invoice factoring fraud is any deception that induces a factor to advance funds against a receivable that does not exist, is not what it claims to be, the seller has already sold, or will never reach the factor.
In legitimate factoring, a seller assigns receivables to a factor, which advances part of face value and holds the balance as a reserve. The seller or factor notifies the account debtor, the seller's customer, to pay the factor; on payment, the factor releases the reserve minus fees.
Fraud differs from ordinary nonpayment, which is a credit loss the agreement already allocates. Under recourse factoring, the seller repurchases unpaid receivables. In contrast, under non-recourse factoring the factor assumes specified credit losses, usually debtor insolvency, but not fraud, documentation, or performance risk.
Factoring agreements commonly require repurchase at full face amount when the seller breaches the warranty that each account is bona fide, represents delivered goods, and is free of setoffs. A seller who fabricated the invoice usually cannot pay. When business email compromise (BEC) or other electronic communications carry the deception, the conduct may also support federal wire fraud charges.
How Fraud Exploits the Receivables Lifecycle
Every major scheme enters at a specific stage and defeats the control that stage depends on. Mapping fraud to the lifecycle, from onboarding and submission through funding, collection, and settlement, shows where a single missing check turns an isolated weakness into a funded loss.
False Evidence Defeats Onboarding and Invoice Verification
At onboarding, forged incorporation and tax papers can carry a paper-only business through know-your-customer and beneficial-ownership checks, while a related party can pass as an arm's-length debtor. Independently sourced ownership records, physical premises, and trade references test whether the client and debtor operate as separate businesses. Risk rises when the factor relies only on records the applicant supplied.
At submission, conflicting documents can make an incomplete transaction appear ready for funding. A delivery note, bill of lading, or signed acceptance may look complete even when its quantity, date, or counterparty conflicts with the invoice. The factor must distinguish a completed document from evidence that the transaction occurred as described.
Verification also depends on the debtor contact's independence. A colluding debtor can confirm a fabricated invoice, while a planted contact can make the response appear genuine. The factor can test the contact through the debtor's switchboard or published directory and supplement confirmation with field audits. No single confirmation, document, or contact should control the decision.
These checks compare the invoice amount, debtor identity, dates, quantities, delivery status, and payee details against evidence that the applicant did not control.
Collateral and Payment Gaps Sustain Fraud After Funding
At funding, the factor may verify that a receivable exists but fail to check whether the seller previously sold or pledged it. Separate collateral records can hide competing claims until public Uniform Commercial Code (UCC) financing statements or the debtor's notices of assignment reveal them.
After funding, payment diversion sends the debtor's remittance to the client or an attacker instead of the factor. A criminal may use BEC payment diversion or email domain spoofing to send new instructions, while lapping hides the diversion behind later collections. The fraud persists when the client remains in the payment path or the factor fails to match remittance data to the invoice it settles.
At settlement, a credit note, return, or dispute can reduce what the debtor owes after the advance. The factor may unintentionally conceal the shortfall by releasing the reserve against the original invoice amount instead of the balance the debtor recognizes as payable. Aging reconciliation against advance-rate assumptions connects the amount funded with the amount still collectible.
These later controls verify ownership and payment routing. They also test whether the collectible balance still supports the original advance.
Major Types of Factoring Fraud
Schemes split into two families: fabricating or altering the receivable, and duplicating, diverting, or collusively confirming a genuine one.
Fabricated Receivables Misstate the Underlying Sale
Each scheme starts with a wholly or partly uncollectible receivable, altered in its date, amount, identity, or evidence to secure an advance. The most common variants include:
Fictitious or Fresh-Air Invoices: The client, sometimes with a malicious insider threat who suppresses verification, invoices for goods the client never supplied. No payment ever arrives.
Pre-Invoicing: The trading relationship is real, but the client invoices before shipping and disguises the discrepancy as a timing error.
Inflated Invoices: The client bills a genuine sale above the agreed amount, and the gap later surfaces as a credit note or dispute.
Shell-Company Debtors: The client uses an affiliated entity as the debtor, so confirmation calls succeed because the client controls whoever answers.
Synthetic Identities: An external actor impersonates a creditworthy business at onboarding with a blend of real and fabricated data, submits invoices, takes the advances, and disappears.
The common weakness is dependence on evidence that the client or a related party controls. Independently sourced ownership records can expose shell debtors, while purchase orders and delivery records can test whether the sale occurred at the stated amount and time. In each case, independent transaction, business, or debtor records would not support the funded claim in full.
Duplicated Receivables Manipulate Ownership or Payment
A genuine sale can still involve manipulated ownership, confirmation, payment direction, or apparent performance. These schemes are harder to catch because the underlying transaction checks out, and the fraud lives in what happens around it. Examples include:
Double Financing: The client sells the same invoice to several factors; the debtor pays once, so only one factor receives repayment. Syndication differs because lenders knowingly share exposure under agreed terms.
Seller-Debtor Collusion: Seller and buyer raise fictitious or circular invoices between themselves, split the advance, and the debtor confirms whatever the factor asks.
Payment Diversion and BEC: The client or an external criminal redirects the debtor's payment away from the factor.
Concealed Dilution: The client hides credit notes, returns, and disputes after assignment or edits invoice dates to restart the aging clock.
Ponzi-Style Recycling: Advances on new fictitious invoices move through client-controlled accounts and settle earlier factored invoices, so each factor sees timely payment while the fabricated pool grows. It collapses when new funding stops.
A factor must establish whether the sale occurred, who owns the receivable, who confirmed it, and where the debtor sent payment. A genuine sale does not prevent fraud when several parties claim the receivable or the payment never reaches the rightful factor.
Warning Signs of Factoring Fraud
Warning signs cluster by lifecycle stage, and each one carries more weight at the decision point where it appears. Grouping them by onboarding, submission, verification, and collections shows which schemes a given anomaly most likely signals and which control should catch it.
Client Onboarding: These point toward shell debtors, synthetic identities, and related-party schemes.
The client's business presence is thin or unverifiable.
The registered address is a mailbox or employee's home.
Related-party receivables appear as arm's-length trade.
Identification documents look altered or expired.
Invoice Submission: These point toward fictitious, inflated, or pre-dated invoices.
Invoice volume grows without explanation.
Amounts are round and unitemized.
Invoice numbers run sequentially or start low.
Service descriptions stay vague.
Trade documents disagree on quantities, dates, or ports.
Debtor Verification: These point toward collusion, planted contacts, and BEC payment diversion.
Debtor contact details come only from the client.
When the factor independently reaches the debtor, the debtor knows nothing of the invoice.
The debtor refuses routine confirmation.
The payee details the debtor holds have changed.
A payment message comes from a lookalike email domain.
Collections and Portfolio Monitoring: These point toward diversion, lapping, concealed credit notes, and double financing.
Payments arrive from the client, not the debtor.
Dilution is rising against advance-rate assumptions.
Receivables age rapidly or concentrate.
Remittances route through unrelated third parties.
The same documentation surfaces at another lender.
A single indicator proves little. But a cluster at one stage, read against the client's known business, proves more.
How to Prevent Invoice Factoring Fraud
Prevention works when independent evidence sits in front of every funding decision and every payment-instruction change.
Independent Evidence Blocks False Receivables Before Funding
Risk-based client and business verification comes first. Customer due diligence sets the reference point: the factor identifies and verifies beneficial owners and a person with significant management responsibility, then refreshes the information on a risk basis. Screening debtors as well as clients surfaces related-party and shell-debtor structures. This practice applies the Committee of Sponsoring Organizations (COSO) fraud risk assessment guidance to receivables.
Independent debtor confirmation follows. The factor contacts the debtor through a number it sourced and confirms that the invoice sits in the payables queue at the stated amount and carries the factor's correct payee details. The invoice, purchase order, and delivery document must agree before the factor releases the advance. Sending the notice of assignment directly to the debtor locks in the payment direction.
Segregation of Duties: No one person approves a client, verifies an invoice, releases funds, and reconciles collections, which applies COSO's control-activity guidance to the funding workflow.
Concentration Limits: Caps on exposure to one debtor bound the damage a fabricated or collusive debtor can do.
Duplicate-Collateral Searches: A UCC lien search before funding shows whether another party already claims the receivables.
These controls reduce the chance of funding a false receivable and limit the loss if one passes an individual check.
Collection Controls Expose Fraud After Funding
Several layers connect collections, portfolio monitoring, and investigation after the factor releases funds:
Cash Dominion: A lockbox or collection account the factor controls removes the client from the payment path.
Field Examinations: Reviews of the client's books, records, and collateral reporting test whether reported receivables match the underlying transactions.
Portfolio Reviews: Dilution and aging reviews catch concealed credit notes and refreshed invoice dates.
Behavioral Monitoring: Payment-pattern monitoring and audit trails expose changes to client, debtor, or payment data.
Reporting and Investigation: A whistleblower channel and documented investigation procedures add detection depth.
These controls connect each funded invoice to subsequent cash movements and records, including account changes.
BEC needs its own layer, and the scale of the threat justifies it: the Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3) recorded $3,046,598,558 in reported BEC losses for 2025. That layer maps to the NIST Cybersecurity Framework 2.0, which organizes payment-change controls across Govern, Protect, Detect, Respond, and Recover.
Under Govern, a factor treats any payment-instruction change as a defined risk and confirms it out of band on a number it already holds, never one supplied in the requesting message. Protect covers multi-factor authentication controls on email and funding systems plus published sender authentication records on the factor's domains. Detect adds alerts on bank-detail changes and lookalike email domains, while Respond and Recover identify who contacts the receiving bank and reports to the FBI IC3.
Shared Records Close Cross-Organization Verification Gaps
Internal controls cannot expose every fictitious or duplicated invoice because those schemes exploit gaps between organizations. India narrows the first gap through government-validated e-invoicing. Businesses register each business-to-business (B2B) invoice on the government invoice registration portal, which assigns a unique invoice reference number and leaves a government-held record of every valid invoice.
Italy uses a national exchange that clears invoices through a centralized system. Across the European Union, the value-added tax (VAT) in the Digital Age package extends mandatory e-invoicing throughout the region. These systems make it harder to present an invoice that does not appear in an independent record.
Receivables registries narrow the second gap. A searchable record of invoices that another lender already bought or accepted as collateral lets a second lender find a prior claim, and India's Trade Receivables Discounting System registers each invoice against double financing. Shared duplicate checks can also determine whether an invoice already exists among participating lenders without exposing either lender's client list.
Coverage remains uneven because no single registry spans every market, cross-border duplication is hard to detect, and lenders use different formats. Matching must account for incompatible records and the absence of a universal invoice identifier. E-invoicing and registries therefore complement existing controls rather than replacing them.
Real-World Cases of Invoice Factoring Fraud
Prosecuted cases show how fabricated transactions and duplicated ownership claims can survive repeated funding decisions. For example, in 2014, Karl Stehlin used the alias "Mark Sawyer" to create Sawyer Express Transportation, Inc., a shell company with no operations, and submitted fake invoices totaling $837,618.29 in a conspiracy that defrauded three factoring companies in New Jersey, California, and Nevada. He received a 51-month prison sentence and an order to pay $837,618.29 in restitution, according to the Department of Justice. The case shows how a paper-only debtor can support repeated advances until independent evidence exposes the lack of operations.
A more recent example comes from First Brands. On January 29, 2026, the US Attorney's Office for the Southern District of New York charged First Brands executives Patrick James and Edward James with using fake and falsely inflated invoices and double financing receivables with multiple lenders. The matter remained at the indictment stage without a reported conviction, but it illustrates how duplicated ownership claims can compound across several lenders before any of them detect the overlap.
In the United States, UCC Article 9 governs both security interests in accounts and outright sales of accounts. A factor perfects its interest by filing a financing statement, and competing perfected interests rank by time of filing or perfection. Under the UCC's notification rule, the account debtor's obligation shifts to the factor only after the debtor receives an authenticated notice of assignment. Beyond contractual repurchase obligations, fabricated receivables and BEC payment diversion can bring federal wire fraud charges, bank fraud and false-statement charges, and court-ordered restitution.
Both cases show that factoring fraud rarely fails on its first advance; it fails when independent evidence finally contradicts the paperwork. Factors that pair perfected security interests with continuous verification of the underlying receivable detect fraud earlier and recover more when it surfaces.
Stronger Verification Builds More Resilient Receivables Finance
Independent evidence before funds move defeats fabricated receivables; independent evidence before payment instructions change defeats diversion. Layered controls across the life of the receivable mean a fraudster must beat several checks instead of one. As government-validated e-invoicing spreads and registries connect more lenders, verification becomes shared infrastructure that widens access to receivables finance for honest businesses.
Frequently Asked Questions
How Do Recourse Terms Affect Losses After Confirmed Fraud?
Recourse terms commonly require the seller to repurchase a fraudulent receivable at full face amount because fabrication breaches the agreement's warranties. The factor can enforce that obligation, but the recovery still depends on the seller's ability to pay. If the seller spent the advance or lacks assets, recourse may establish liability without eliminating the factor's loss.
What Is the Difference Between Factoring Fraud and an Invoice Dispute?
An invoice dispute can arise from an ordinary disagreement over delivery, quality, quantity, or payment terms. Factoring fraud involves deception intended to secure an advance. A client may hide a known dispute or inflate the amount due. The client may also misrepresent whether the transaction occurred.
What Records Should a Business Preserve After Suspecting Factoring Fraud?
Invoices, purchase orders, proof of delivery, notices of assignment, debtor confirmations, credit notes, aging reports, bank records, payment instructions, relevant emails, and system audit trails all support reconciliation and investigation.