Invoice fraud: five signals and one phone call

How invoice fraud works

In invoice fraud, a scammer poses as a supplier you really work with. The email looks the way it always does: the same name, a familiar logo, an invoice for an amount that makes sense. Only the bank account is different. Sometimes the scammer has been inside the supplier's mailbox for weeks and writes from their real address; sometimes the address only looks the same.

FPS Economy received 215 reports of invoice fraud in 2024, together more than €3.3 million in damage (source). Those are only the cases that were reported.

The five signals

1. The address is almost right: the name is your supplier's, the domain is not (.co instead of .be, an extra letter, a hyphen).
2. There is a rush: "today before 4 pm", "otherwise we stop the delivery".
3. There is a new bank account, "because of a change at our bank".
4. You are told not to call.
5. The attachment is not an ordinary PDF, for example invoice.pdf.html or a zip file.

One signal on its own proves little. A new bank account together with a rush is enough to stop.

The phone call that stops it

Call the supplier on the number you already had: from your accounts, an old invoice or their own website, never a number from the email itself. Ask whether they changed their bank account. It takes two minutes.

Put it in writing as a rule: nobody pays an invoice with a changed bank account without that call, also when the owner is on holiday.

Your bank now helps

Since 9 October 2025 every bank in the eurozone checks, for a transfer in euros, whether the beneficiary's name matches the account number (FPS Economy). If you get a warning that the name does not match, don't pay until you have called. A match does not rule everything out, because a scammer can also use an account in a similar name. And if you pay with a batch file from your accounting software, you may not see the warning at all: businesses can switch the check off for batch payments.

What to do with an email like this

• Don't pay, don't reply, don't open the attachment.
• Call the supplier on a number you already had.
• Forward the email to suspicious@safeonweb.be, then delete it (Safeonweb).
• Already paid? Call your bank's fraud line straight away, file a complaint with the police, and report it to the FPS Economy reporting point (meldpunt.belgie.be).

Practise it with your staff

On our security awareness page there is a fake invoice email in which you can look for the five signals yourself (try it). In the workshop we do the same with examples from your own sector.

Want the rule on paper? Our one-page checklist has the five signals, the call-back rule and what to do if you already paid. Print it for whoever pays your invoices.