Diverted transfer: the fake IBAN on an invoice scam

A routine invoice, a detail that costs dearly

You receive an invoice from a supplier you have been paying for years. Everything looks normal: same logo, same layout, same contact. Only one thing has changed, and you do not see it: the IBAN you are meant to pay. You make the transfer as usual, and the money goes to a criminal.

This fraud, known as the fake IBAN scam or invoice redirection, targets businesses as well as individuals paying a tradesperson, rent or a deposit.

How the criminal swaps the IBAN

The most common scenario begins with the hacking of a supplier's mailbox. The criminal reads the correspondence, spots a pending invoice, then sends a message from that genuine address announcing a "change of bank details". Because the email comes from the usual sender, no suspicion is triggered.

In another variant, the criminal intercepts an invoice and resends it altered, with a modified IBAN. The rest of the document is authentic, which makes the manipulation almost invisible.

The warning signs

A few details often give the attempt away:

• a change of IBAN announced by email, especially if it is presented as urgent;
• an IBAN whose country does not match that of the supplier;
• a pressing tone, a vague justification ("new bank", "old account closed");
• an invoice received by email when you previously got your documents another way.

The defence: check through another channel

The rule fits in one sentence: a change of bank details is always confirmed through an independent channel. Never use the phone number or contact details given in the suspicious email, as they may belong to the criminal.

Go back to the number you already know, from an earlier exchange or the contract, and call your contact to ask them out loud whether they really changed their IBAN. This simple check defeats almost all of these frauds.

Before approving a transfer to a new IBAN, also check it is consistent with our IBAN checker. An inconsistent IBAN, or one tied to an unexpected country, is a strong signal.

If the transfer has already gone

Time is against you, but all is not lost.

Contact your bank immediately to try to recall the transfer before it is credited and withdrawn. Warn the real supplier, whose mailbox may be compromised. Keep the fraudulent email and the invoice, file a report, then flag the facts to Action Fraud.

To place this fraud within the full range of traps targeting your payments, see the guide Banking scams.