Fake invoice, fake IBAN: how a supplier ‘changes bank account’ and steals your payment

The scenario in brief

Example, made up for illustration. A fictional dental practice receives an email from its usual equipment supplier. Same logo, same signature, same tone as always: ‘Following a change of bank, please use the new account number shown on the attached invoice from now on.’ The PDF invoice looks exactly like the previous ones. Only the IBAN has changed.

The person who handles payments updates the supplier record and pays €8,400. Three weeks later, the real supplier sends a reminder: it has received nothing. The money has gone to a fraudster's account, and the practice still has to pay its invoice. The amount and details of this example are made up; the mechanism, however, is exactly as Belgian banks describe it.

How the fraudster does it

Febelfin, the federation of Belgian banks, describes this fraud in its brochure on payment fraud and businesses: fraudsters intercept a genuine invoice, replace the supplier's bank details with their own, then send on the altered invoice. To get hold of the invoice, they have several ways in:

• Paper post: invoices stolen from bpost's red post boxes, from sorting centres or from the company's own letterbox.
• The supplier's mailbox: fraudsters break into its IT system, read its invoicing emails and change the account number in them.
• Editing: the original invoice is scanned, then the account number, and sometimes the phone number, are changed with software.
• The covering letter: a letter, or even a sticker saying ‘Attention: change in account number’ on the envelope or the invoice.
• The made-up invoice: an invoice for a service that was never ordered.

The most treacherous case is the hacked mailbox. The email then comes from the supplier's real address, sometimes in a conversation that has been going on for months. So checking the sender's address is no longer enough. Febelfin also points out, in the context of CEO fraud, addresses that differ from the real one by a single letter; the same trick is used for fake invoices.

Electronic invoices offer no immunity. Since 1 January 2026, invoices between Belgian businesses must go through Peppol, the European network for exchanging electronic invoices; Febelfin states that its recommendations still apply to these invoices too.

The signs that should make you stop

Any one of these signs is reason enough to pause. No serious supplier will hold it against you for calling to confirm its new account.

The banks' safety net: verification of the payee's name

Since 9 October 2025, every bank in the euro area must check, before each transfer, whether the payee name you entered matches the account holder. Febelfin explains it here: the check is free and requires nothing from you. Your bank shows you one of these results:

It is real progress, with two limits. First, as Febelfin points out, you remain responsible for the transfers you make; the warning is only an aid. If you ignore it, that is your decision. Second, the check only compares the name and the account: it cannot tell whether you actually owe this payee any money. If you pay suppliers in batches from accounting software, ask your bank how the check applies to those batches and who sees the warnings.

The golden rule: a change of account is checked through another channel

All the official recommendations boil down to one simple idea: a request to change an account number is never confirmed through the channel that brought it. If it arrives by email, you check by phone, on the number you already had. Here are the steps to put in place first thing on Monday:

1. Put the rule in writing: no supplier bank details are changed on the strength of an email, letter or phone call alone.
2. Call back on the number you already had: the one in your supplier record, an old contract or its official website, never the one on the invoice or in the email, which may be fake too.
3. Compare the IBAN with the one on the purchase order, in your previous payments or on the supplier's official website.
4. Separate the roles: the person who edits a supplier record is not the one who approves the payment. Febelfin recommends dual signatures: the second person is not involved in the exchange and spots the anomaly more easily.
5. Take your time over the first payment to a new account: an instant transfer arrives within seconds. Febelfin stresses that a standard transfer leaves time that can help detect fraud before it is too late.
6. Read the bank's warning instead of clicking ‘Continue’.

These steps cost nothing and need no tools. They only require everyone, management included, to accept that a payment can wait a few hours for a phone call.

Protect your own mailbox too

The fraud works both ways: if your mailbox is hacked, your clients or patients will be the ones receiving fake invoices in your name. Three simple precautions:

• Turn on multi-factor authentication on every mailbox: on top of the password, a code or an approval on the phone is required. Febelfin recommends strong sign-in methods.
• Show your account number on your website and follow up unpaid invoices quickly: a client who has paid a fake account will realise sooner.
• Have your mailbox checked by your IT provider if something seems off, for example a client receiving an email from you that you never wrote.

You have paid: the steps in order

Every hour counts. Febelfin is clear: the sooner you alert your bank, the better your chances of getting the money back.

1. Call your bank straight away, on its fraud line, open 24 hours a day. It will ask the payee's bank to return the money and try to block the transfer or the account.
2. Block the fake IBAN in your accounting software and check that no other payment to that account is scheduled.
3. Warn the real supplier, by phone: its mailbox may have been hacked and other clients may be targeted.
4. Report it to the police, bringing the email, the invoice and proof of the transfer.
5. Report it on ConsumerConnect, the FPS Economy's reporting point, as Febelfin recommends.
6. Forward the trap email to your IT provider, without clicking its links or opening its attachments, so they can check where it came from.
7. Have your own mailbox checked if the email arrived in an existing conversation: the leak may be on your side.

Five questions to ask your accountant this week

1. Who can change a supplier's account number in our software?
2. Do we have a written rule to call back by phone before any change?
3. Are large payments approved by two people?
4. What do we do when the bank shows ‘the name does not match’?
5. Have we written down our bank's fraud line number somewhere?

If any answer is ‘I don't know’, you know where to start. These five points can be sorted out in a one-hour meeting.

Secure your supplier payments→