ExsIT

IT solutions & innovation — support, security, AI for SMEs

Fake IBAN change: who pays the invoice?

Fake IBAN change: who pays the invoice?

Daniel Platteau

Updated on 12 November 2026.

In short: an e-mail from your supplier announces a new bank account, you pay, and the money goes to a fraudster. Under Belgian law, that payment does not discharge you: your supplier can claim the amount a second time. Since October 2025, your bank warns you if the payee's name does not match the IBAN, but it does not stop you from paying. The defence comes down to one internal rule, free and ready to apply this week: no change of bank account is accepted without a phone call to the number you already know.

How the scam works

Fake IBAN change fraud (also called invoice fraud or fake supplier fraud) is not sophisticated. It works because it slips into a routine: paying invoices from suppliers you know. Three variants keep coming back.

1. The supplier's mailbox is hacked. This is the most dangerous one. The fraudster reads the exchanges for days or weeks, spots a large invoice, then writes from the real address, in the real thread: "Following a change of bank, please use the account below from now on." The tone, the signature and the order reference are correct, because they are copied.

2. A look-alike address. The fraudster registers an almost identical domain name (supplier-bv.be instead of supplier.be, an "l" replaced by a capital "I") and replies to your last exchange. On a phone screen, the difference is invisible.

3. The altered invoice. A paper invoice or a PDF is intercepted and scanned, and only the IBAN is replaced. Belgium's FPS Economy describes this scenario: the original invoice is digitised and the supplier's details are changed with software.

In all three cases, two ingredients recur: urgency ("the payment must go out today") and a pretext (audit, change of bank, blocked account). Now that generative AI writes flawless text and can imitate a voice from a few seconds of recording, a "confirmation" call may even follow the e-mail. We covered these techniques in our article on AI in the hands of fraudsters.

How many victims in Belgium?

Public figures only measure what is reported. The FPS Economy received 215 reports of invoice fraud in 2024, for more than 3.3 million euros in declared losses, then 166 reports and 736,719 euros in 2025, up to 9 October (figures quoted by Febelfin). Many businesses report nothing, out of discretion or because they settle the matter with their supplier: the real figure is necessarily higher.

An illustrative case

An invented case, built from common situations. An eight-person joinery near Namur receives an e-mail from its panel supplier one Tuesday morning, in the usual thread: the supplier is changing banks, here is the new IBAN, and the 18,400-euro invoice must be paid before Friday to secure the next delivery. The manager enters the payment between two appointments. Three weeks later, the supplier sends a reminder. Its accountant's mailbox had been hacked. The money left the fraudster's account the same day.

Who pays when you have paid the fraudster?

This is the first question every business owner asks, and the answer often comes as a surprise.

In principle, you still owe the money. The FPS Economy says so plainly in its FAQ: the payment obligation is only extinguished once the creditor, meaning the real supplier, has been paid. So you will in principle have to pay a second time. The supplier may waive this; if it refuses and you dispute it, a judge decides.

The Belgian Civil Code (Article 5.198) does provide an exception: a payment made in good faith to someone who had every appearance of being the creditor can discharge the debt. But judges apply it cautiously. On 3 June 2026, the Antwerp court of first instance ruled against an online auction house that had paid the proceeds of a sale into an account given in a fraudulent e-mail, sent from the seller's hacked address. The message contained mistakes and an incoherent sentence: a "normally prudent" business should have called the seller before paying. The payment was not found to discharge the debt and the auction house had to pay the balance, more than 7,000 euros, with interest.

In practice, this means three things:

  • diligence has to be proven: if you can show that a procedure existed and was followed (a call to the known number, dual approval), your position is much stronger;
  • an ignored warning weighs heavily: if your bank told you the name did not match and you paid anyway, it will be hard to argue that you acted in good faith;
  • the hacked supplier is not necessarily blameless: if its mailbox was poorly protected, the loss may be shared by negotiation, or in court. That is not a certainty, and it costs time and legal fees.

Check your insurance contract too: payment fraud may be covered, excluded or capped depending on the policy. That is a question for your broker before an incident.

What your bank has been checking since October 2025

Since 9 October 2025, all banks (and other payment service providers) in the euro area must check, for every euro transfer, that the payee name you entered matches the IBAN. This is "verification of payee", required by European Regulation 2024/886. Belgian banks introduced it gradually from the summer of 2025. The check is free and automatic.

There are four possible outcomes:

Result What the bank shows What you should do
Match Nothing special Pay
Close match The registered name (for a business) Check: a simple typo, or a name that only looks similar?
No match A warning Do not pay before calling the supplier
Verification not possible A message saying so Treat it as a doubt: call

This is real progress: a fraudster who collects the money on the account of a "mule" (someone who lends their account) cannot make that account match your supplier's name. If you type the supplier's name, the bank will warn you.

But the check has four limits:

  • It warns, it does not block. Febelfin points this out: you remain free to pay, and you remain responsible for your transfers.
  • It only covers euro transfers within the euro area. A supplier in the United Kingdom, in Switzerland or paid in dollars is not covered.
  • It does not check the invoice. If the fraudster opened an account in the name of a company that resembles your supplier, or if you copy the name the fraudster wrote, the check may return "close match", or even "match".
  • It can be switched off for bulk payments. A business that sends its payments in batches from its accounting software can opt out of the check (Article 5c(6) of the regulation). If your accountant or your software works that way, make sure that option has not been ticked.

The five rules that stop the scam

None of them requires a purchase. All of them require discipline.

1. An IBAN change is confirmed by phone, at the known number

The number to call is the one in your supplier file, your contract or the official website, never the one in the e-mail or on the invoice announcing the change. Do not reply to the e-mail to "confirm": if the mailbox is hacked, the fraudster will be the one answering. Febelfin and the FPS Economy give exactly this advice.

Write it down in a two-line note, signed by the manager, that everyone who pays invoices has read. That note will prove your diligence on the day you need it.

2. Two people for an unusual payment

Most Belgian banks offer multiple signatures on business accounts: a transfer above an amount you set must be approved by two people. In a small business, the second person can be the manager, the external accountant or a partner. The fraudster then has to fool two people instead of one.

3. Suppliers' bank details are locked

In your accounting or invoicing software, who can change a supplier's IBAN? If the answer is "everyone", restrict that right to one or two people, and ask whether the software keeps a change history. A changed IBAN should leave a trace: who, when, on the basis of which call.

4. A warning from the bank is never a detail

"The name does not match" is not a bug to work around so the payment goes through. It is exactly the signal the system was designed to give. The internal rule is simple: if there is a warning, do not insist, call.

5. Urgency + change = stop

An invoice that combines a new account and an urgent payment, or a "director" asking for a confidential transfer, should trigger an automatic stop. Fraudsters count on time pressure. A one-hour delay for a phone call has never lost anyone a supplier; 18,000 euros gone has.

What about e-invoicing?

Since 1 January 2026, invoices between Belgian VAT-registered businesses must be structured electronic invoices, exchanged in practice over the Peppol network. For you, this creates a useful reflex: a "new invoice" or a "new IBAN" that arrives only by e-mail as a PDF, when this supplier normally sends invoices through your software, is suspicious. Peppol narrows the fraudsters' room for manoeuvre; it does not remove it, because the supplier's account on its platform can be hacked too. Rule no. 1 still applies.

If it is your business being impersonated

The fraud has two victims: the business that pays the fraudster, and the supplier whose name was used as bait, which is still waiting for its money and sees its customer relationship damaged. If you issue invoices, four measures protect your customers:

  • protect your mailboxes: two-factor authentication on every mailbox, especially those of the accounts department. A hacked mailbox is the starting point of the most dangerous variant. If your e-mail depends on an account created in a hurry, read our article on the Microsoft account;
  • show your IBAN somewhere other than the invoice: on your purchase orders, your terms and conditions and your website, as the FPS Economy recommends, so your customers can compare;
  • announce the rule: a sentence on your invoices such as "We will never change our bank account by e-mail alone: if in doubt, call us";
  • use your exact legal name on your invoices, the one your bank and the Crossroads Bank for Enterprises know: verification of payee works better, and your customers get fewer unjustified warnings.

And if a customer tells you they paid but you received nothing, act quickly: the FPS Economy advises contacting the customer promptly when a payment is late, before the money disappears.

You have paid? The first hours count

  1. Call your bank immediately, on its fraud department number. It can ask the payee's bank to block the account or return the funds: the faster the call, the better the chances. If you cannot find that number, Fraudstop (078 170 170, the same number as Card Stop, open 24 hours a day) puts you through to your bank.
  2. Warn your supplier, by phone, at the known number: it needs to know that its mailbox may be hacked, and other customers may be targeted.
  3. File a complaint with the police and register as an injured party: you will be kept informed of the case. If the perpetrators are identified and prosecuted, you will be able to join the proceedings as a civil party to claim compensation.
  4. Report the fraud on ConsumerConnect, the FPS Economy's reporting point.
  5. Keep every trace: original e-mails (not screenshots), invoices, bank statements. Your IT person will need the full message headers.
  6. Check your own mailboxes: if the e-mail reached you through a hacked mailbox on your side, the attacker may still be in it.

What Europe is preparing

Two European texts are moving in the right direction, but neither will protect your business in the coming months.

The Payment Services Regulation (PSR). Parliament and Council reached a political agreement on 27 November 2025, and the Council adopted its first-reading position at the end of October 2026. The text extends verification of payee to all transfers and strengthens the liability of banks that do not apply adequate fraud prevention. The most publicised refund right, however, covers a different scenario: the fraudster who poses as a bank employee. The fake supplier is not covered in the same way. Do not count on this text to refund an invoice paid into the wrong account.

The European Business Wallet. Proposed by the Commission on 19 November 2025, it would let a business identify itself reliably online, and sign and exchange documents with the same legal value as in person. In time, proving who is sending an invoice or a change request will become easier. But the text is still being negotiated between Parliament and Council (Council position on 9 June 2026, report of Parliament's ITRE committee on 10 September 2026), its use will remain voluntary for businesses and public authorities will have around two years to accept it. It is a solution for the end of the decade, not for your next invoice.

In practice: three options

Option Cost Time Risk
Do nothing €0 None A single successful fraud and you pay the invoice twice, with no guarantee of recovering the first payment. The bank's check warns you, but someone in a hurry can override it.
Do it yourself €0 (multiple signatures: see your bank's terms) Half a day: write the rule, switch on dual signature, restrict rights in the accounting software, brief the team Low on the "payments" side. Still open: the security of your mailboxes and your domain name, which requires technical skills.
Get support A few hours of service One to two days, spread out The lowest: written procedure, mailboxes checked (two-factor authentication, suspicious forwarding rules, domain protection), short training for the people who make payments.

The first step costs nothing and can be done today: rule no. 1, written down and signed.

For your IT person

What follows is for the person who manages your mailboxes and accounts. For the rest of the team, the five rules are enough.

  • Microsoft 365 or Google Workspace mail: multi-factor authentication for every account, with no exception for accounting or shared accounts. Block legacy authentication protocols.
  • Mailbox rules: an attacker sitting in a mailbox often creates a rule that moves or deletes the real customer's replies (keywords "IBAN", "payment", "invoice"), or forwards everything to an external address. Audit inbox rules and external auto-forwarding (in Exchange Online: Get-InboxRule, and the outbound spam filter policy that controls automatic forwarding).
  • Company domain: publish SPF, DKIM and DMARC, then move DMARC gradually to p=quarantine and then p=reject. This prevents direct spoofing of your domain, not the registration of a look-alike domain.
  • Look-alike domains: a tool such as dnstwist (open source) lists variants of your domain name that are already registered. A recently registered variant with an active mail server deserves an alert.
  • Accounting software: separate the right to edit a supplier record from the right to prepare payments, and turn on the change log.
  • Bank: check that the business has not opted out of verification of payee for bulk payments, and set multiple-signature thresholds.
  • Access inventory: know who has access to the online bank accounts, the accounting mailboxes and the domain name console. Our external access audit and our article on the traps of a small PC fleet give the method.

Test yourself

Your SME pays a supplier's invoice to a fraudulent IBAN received by e-mail. Under Belgian law, is your debt to that supplier discharged?

Show the answer

Answer: In principle no: you will probably have to pay a second time

The FPS Economy points out that the payment obligation is only extinguished once the real creditor has been paid. The Civil Code provides an exception for payment in good faith to an apparent creditor, but judges apply it cautiously: the Antwerp court refused it on 3 June 2026 to a business that had not checked.

Since October 2025, what does a euro-area bank do when the payee name entered does not match the IBAN of a euro transfer?

Show the answer

Answer: It warns you before you confirm, but you can still pay

Verification of payee, required by European Regulation 2024/886, serves as a warning: you remain free to pay, and responsible for your transfer. If you get a warning, call the supplier before paying.

To confirm a change of bank account announced by a supplier by e-mail, what is the right reflex?

Show the answer

Answer: Call the supplier at the number you already know (file, contract or official website)

If the supplier's mailbox is hacked, the fraudster will answer the e-mail, or the phone number given in it. Only a number you knew before the message is reliable.

Want to protect your business against fake IBAN changes? Let's talk: the first contact is free, we listen to your needs, then we propose an action plan.

Sources

A&O Shearman. (2026, October 23). Council first reading position with a view to adoption of proposed payment services package. https://finreg.aoshearman.com/council-first-reading-position-with-a-view-to-adoption-of-proposed-payment-services-package

Council of the European Union. (2026, June 9). European business wallets: Council adopts negotiating position. https://www.consilium.europa.eu/en/press/press-releases/2026/06/09/european-business-wallets-council-adopts-negotiating-position/

European Parliament. (2025, November 27). Payment services deal: More protection from online fraud and hidden fees. https://www.europarl.europa.eu/news/en/press-room/20251121IPR31540/payment-services-deal-more-protection-from-online-fraud-and-hidden-fees

European Parliament. (n.d.). European business wallets. Legislative Train Schedule. https://www.europarl.europa.eu/legislative-train/theme-a-new-plan-for-europe-s-sustainable-prosperity-and-competitiveness/file-european-business-wallet

Febelfin. (2025a, June 23). Verification of the beneficiary's name: banks start gradual introduction. https://febelfin.be/en/press-room/fraude-veiligheid/verification-of-the-beneficiary-s-name-banks-start-gradual-introduction

Febelfin. (2025b, October 9). La vérification du nom du bénéficiaire est étendue et renforce la lutte contre la fraude à la facture. https://febelfin.be/fr/presse/fraude-et-securite/la-verification-du-nom-du-beneficiaire-est-etendue-et-renforce-la-lutte-contre-la-fraude-a-la-facture

Febelfin. (2026, July 30). Fraudstop: more than 6,700 calls one month after launch. https://febelfin.be/en/press-room/fraude-veiligheid/fraudstop-more-than-6-700-calls-one-month-after-launch

FPS Economy. (2019, June 18). Facture payée ? Pas sûr… https://news.economie.fgov.be/178189-facture-payee-pas-sur/

FPS Economy. (2025a, January 27). Fraude à la facture : questions fréquemment posées. https://economie.fgov.be/fr/themes/protection-des-consommateurs/stop-arnaques/formes-darnaques/vous-avez-un-probleme-avec-une/vous-avez-paye-une-facture/fraude-la-facture-questions

FPS Economy. (2025b, October 9). La vérification du nom lié à l'IBAN : une nouvelle arme contre la fraude à la facture. https://news.economie.fgov.be/255219-la-verification-du-nom-lie-a-l-iban-une-nouvelle-arme-contre-la-fraude-a-la-facture/

FPS Economy. (n.d.). Fraude à la facture : votre client a payé mais vous n'avez rien reçu. https://economie.fgov.be/fr/themes/protection-des-consommateurs/stop-arnaques/les-principales-arnaques-en/fraude-la-facture/fraude-la-facture-votre-client

FPS Finance. (2025). Period of tolerance during the first three months of 2026. e-invoice. https://einvoice.belgium.be/en/news/period-tolerance-during-first-three-months-2026

Lawbase. (2026, June 24). Veilinghuis betaalt aan fraudeur: rechter oordeelt dat onzorgvuldige betaling niet bevrijdend is [Antwerp Court of First Instance, 3 June 2026]. https://www.lawbase.be/rechtspraak/veilinghuis-betaalt-aan-fraudeur-rechter-oordeelt-dat-onzorgvuldige-betaling-niet-bevrijdend-is

Regulation (EU) 2024/886 of the European Parliament and of the Council of 13 March 2024 amending Regulations (EU) No 260/2012 and (EU) 2021/1230 and Directives 98/26/EC and (EU) 2015/2366 as regards instant credit transfers in euro. (2024). Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2024/886/oj

Related articles

← Back to articles