Bank-detail change fraud: spotting a fake IBAN

An email saying "we've changed banks, please pay our new account from now on", a usual invoice with a different IBAN: changed-bank-details fraud is one of the most common scams against businesses, and the money is rarely recovered.

Updated October 14, 2026

How the scam works

1. The fraudster hacks or imitates a supplier's mailbox (a near-identical address, or a genuinely hacked account).
2. They send a real or well-imitated invoice, or a letter announcing new bank details, often with time pressure.
3. The transfer goes to their account. The real supplier chases payment weeks later: the money is gone.

Warning signs

• The IBAN differs from the supplier's previous invoices. This is the main signal.
• The IBAN is foreign although the supplier is domestic, or the bank changes for no apparent reason.
• The change is announced by email only, with urgency or a request for discretion.
• The sender's address is one character off, or the phone number given is new.
• On a Factur-X invoice, the IBAN in the PDF differs from the one in the XML: the PDF may have been edited.

A valid checksum rules out a typo, but doesn't prove the account belongs to your supplier: only the procedure below does.

The procedure to put in place

1. Confirm every bank-detail change by phone, on the number you already know (supplier record, contract, official website), never the one in the email or invoice.
2. Two people approve any change of bank details in your system.
3. Compare each invoice with the supplier's history: same IBAN, consistent numbering, no duplicates.
4. Ask for a signed bank statement or bank letter for any new account.
5. Train the accounts team: "it's urgent" is the fraudster's main tool.

If you've already paid

1. Call your bank immediately and ask for a recall of the funds. Every hour counts.
2. Report it to the police, with the emails, the invoice and the transfer confirmation. In France, you can also report on cybermalveillance.gouv.fr.
3. Warn your supplier: their mailbox may be compromised and other customers targeted.