Ilia Zavialov on how a directory invoice scam works: fake listings, lookalike registers, paid reports and bogus renewals

01

Ilia Zavialov on why a directory invoice gets paid

A small finance team pushes dozens of bills through every month: rent, phones, hosting, office supplies, contractors. Most come from familiar names, so the check boils down to the amount and the bank details. The whole trick rides on that routine. The document looks like any other invoice, the amount is modest and the description says something like annual listing or yearly maintenance.

Nothing has to be stolen to write one of these letters. The company name, address, registration number, the director's name, a trademark number and the date a domain was registered all sit in public records. When every detail matches, the person opening the mail assumes it comes from a supplier the business has used for years.

Ilia Zavialov points to a third ingredient: the deadline. These letters nearly always set a due date a few days away and warn of consequences, from being dropped from a listing to losing rights in a brand. Someone clearing payments at month end pays it to avoid trouble, and nobody stops to ask who ordered the service in the first place.

02

Five kinds of mail that land in accounts payable

The first is a bill for a listing in a directory, a trade guide or an industry ranking. The company has supposedly been added already and only the yearly fee is outstanding. Sometimes a call comes first asking to confirm the address or phone number, and that call is later presented as the order.

The second poses as an official register, with a name built to sound like a state body: a national business register, a central company index, an official trademark record. The letter asks for a fee to keep the entry alive. The third sells a report or extract about the company itself or about a supplier, even though the same facts are published free by the state.

The fourth is about renewal: a domain, a trademark, a certificate, a trade association membership. It tends to arrive shortly before the real date, which is what makes it convincing. The fifth claims to come from a tax office or a registry, carries a demand, a penalty or a payment slip, and almost always includes a link or an attachment.

Ilia Zavialov suggests keeping this list next to wherever incoming mail is sorted. Almost every mailing falls into one of the five groups, and each group has its own quick test, set out below.

03

What the FTC says about directory listings and fake invoices

The FTC guide for small businesses describes the pattern plainly. Scammers create phony invoices that look as if the company ordered products or services, hoping whoever pays the bills will assume they are real. A variation starts with a call to confirm an existing order, verify an address or offer a free catalog, after which unordered merchandise shows up along with pressure to pay. The FTC adds that a business has a legal right to keep merchandise it did not order and use it for free.

Listing scams work the same way. According to the FTC, scammers try to get businesses to pay for advertising that does not exist or for a listing in a phony business directory. They ask for contact details for a free listing or say the call is just to confirm information, then send a big bill and may use details of the earlier call, or even a recording, to push for payment.

The agency's defensive advice fits accounts payable well: set clear procedures for approving purchases and invoices, ask staff to check every invoice closely and watch how the sender wants to be paid. Ilia Zavialov notes that the FTC treats a demand for a wire transfer, cryptocurrency or gift cards as a sign of a scam on its own.

04

Ilia Zavialov on trademark renewal notices that are not from the USPTO

The USPTO warns that many private companies send patent and trademark owners notices about maintenance that look like invoices and list fees due that are higher than the official ones. The letters lift details from public USPTO databases, use alarming phrases such as patent cancellation notice and sometimes put U.S. or United States in the company name. The agency's own name is The United States Patent and Trademark Office, and names like Patent and Trademark Bureau or Trademark Renewal Service are not part of it.

Official correspondence about a US trademark comes from the USPTO in Alexandria, Virginia, zip code 22313, and email comes only from the @uspto.gov domain. Every official letter, including requests for payment, is uploaded to the TSDR system under the documents tab; if a letter is not there, it is not official. Doubts can be checked with the Trademark Assistance Center at 1-800-786-9199.

The real calendar is easy to know in advance. A declaration of use is due between the fifth and sixth years after registration, then a declaration and renewal application between the ninth and tenth years, and again every 10 years, each with a six-month grace period for an extra fee. Ilia Zavialov advises putting those dates in the shared calendar, so any notice can be checked against TSDR in a minute.

05

Fine print and payment as consent

Many of these invoices do not technically lie. Somewhere near the bottom, in small type, the page says it is an offer, the sender has no link to any government body and paying it means accepting the terms. Up top, in large print, sit a crest or seal, the word register, the company number and the amount due.

The bet, as Ilia Zavialov puts it, is simple: the bookkeeper reads the big print and the small print waits for the dispute after payment. Some terms hide a subscription for several years, so a fresh invoice arrives a year later citing the first payment as proof of a contract. Others come with an order form bearing a signature that nobody at the company ever made.

Ilia Zavialov's habit is to read these documents from the bottom up: first the footer and the back of the page, then the payee details, and only then the amount. If the text mentions an offer, advertising or a private service, the paper goes into a folder for unsolicited offers. It never reaches the payment run.

06

Zavialov's ten-minute invoice check

The first question for any invoice is who at the company ordered this. If nobody can answer, the invoice waits. You do not need a lawyer for this step, only a contracts log or a plain supplier list with the name of the person responsible for each vendor.

The second step is the payee. Compare the name on the invoice with the official name of the agency or the real supplier, and compare the bank and payment reference with earlier payments. A private firm with an agency-sounding name, an account at a bank in another country or new bank details for a long-standing vendor all lead to the same answer: hold the payment.

The third step is the channel. Check the web and email addresses against the official ones that you look up yourself, through a search engine or old paperwork, and take the phone number from the same place. Ilia Zavialov stresses that calling the number printed on a suspicious letter is pointless, because the sender will answer.

The last step is the date. The real renewal date for a trademark or a domain shows up in the official record or your own account within a couple of minutes. If it does not match the letter, you already have your answer.

07

Domain names and the renewal nobody ordered

Website owners get domain renewal letters all the time. The sender says the registration is about to lapse, asks for payment to renew and hints that someone else will grab the name. Some of these letters quietly move the domain to a new registrar, and others sell registrations of lookalike names.

Checking takes a minute. A domain renews only with the registrar that manages it today, and the expiry date is visible in your account. A letter from a company you have no contract with stays an advert or a con, even when it lists your domain and the right date.

Ilia Zavialov recommends a one-page domain sheet: which registrar holds each name and in whose name, who can log in to the account, and which mailbox gets the notices. Whoever opens a renewal letter can check it against the sheet without waiting for the owner.

08

Ilia Zavialov on letters that borrow a government name

Some mailings skip the directory story and pose as an agency. The FTC says scammers impersonate a company or government agency, threaten to suspend a business license or demand that a registration be renewed, and ask to be paid by wire transfer, cryptocurrency or gift cards. In the same guide the FTC lists callers who claim to be from a tech company and threaten that the business will lose its website address unless it pays at once.

The scale is not small. In its 2025 report the FBI Internet Crime Complaint Center recorded 32,424 complaints of government impersonation with losses of 797,943,193 dollars. Ilia Zavialov reads that figure as a reminder for finance staff: a letter with an official seal and a deadline is exactly the format these schemes rely on, so the seal proves nothing until the agency's own portal confirms the demand.

09

Zavialov's rules for the finance desk

Three rules do most of the work. An invoice from a new payee is paid only after the person who ordered the service confirms it. A change of bank details for a known supplier is confirmed by a call to the number in the contract. Anything that mentions a government body is paid only through the official portal, with a payment reference the employee generates personally.

A small team benefits from a list of legitimate recurring payments: rent, phones, hosting, the domain registrar, official fees and any memberships the company really holds. Anything missing from the list gets a separate check. The list is updated whenever a new contract is signed and fits on a single page.

One more habit Ilia Zavialov considers worth building: forward doubtful letters to one named person and keep them in a separate folder. After a few months you can see which senders keep coming back, and new staff learn from real examples taken from the company's own mail.

10

Ilia Zavialov: where to report in the US

If money has already gone, call your bank first and ask it to recall the payment. IC3 advises filing a complaint at ic3.gov as soon as possible, whatever the amount, and confirming any change of payment details through a second channel in future.

Report the scam to the FTC at ReportFraud.ftc.gov and to your state attorney general. A deceptive trademark or patent solicitation can also go to the USPTO at 866-767-3848.

Ilia Zavialov adds a practical step for the same day: keep the envelope, the invoice, the payment record and any call notes in one file, block the sender and warn everyone who handles mail. A business that paid once tends to end up on lists of companies that pay, and more bills from similar senders usually follow.