Recognizing fake invoices, changed bank account numbers, or CEO fraud

With these forms of fraud, nobody breaks into your computer. A scammer convinces you or a colleague to transfer money yourself. You won't recognize every fake email, but with a few fixed agreements you make sure a fake email isn't enough to get a payment made.

Three forms

If an invoice appears to come from WebOké, check My WebOké under My Invoices to see if it's listed there. See Is this email really from WebOké? Recognizing phishing and using the action code. If it concerns a renewal or registration of your domain, read Emails from ICANN or the registry about your domain: real or fake, and what should you do?

Warning signs

• A change of bank account number. That's always a moment to check, even if everything else seems correct.
• Time pressure: it has to happen today, before the bank closes.
• Secrecy or skipping the normal procedure: "just handle it outside the system for once".
• A sender or reply address that almost matches, or a private address "because I'm on the road".
• A "lawyer" or "accountant" who comes to confirm the instruction.
• An invoice that looks different from usual, or whose order you don't recognize.

The agreements that stop it

1. Call back on a known number. For every new bank account number and every unusual payment request, call the sender. Not on the number from the email or invoice, but on a number you already had: from your records, the contract, or a website you type in yourself.
2. Don't reply to the email. Using Reply can lead you straight to the scammer, because an email can have a different reply address. If you want to email, type the address in yourself.
3. Four eyes. Have a second person check new payees, changed account numbers and payments above a fixed amount. If you work alone, keep a fixed waiting period and call back first.
4. No exceptions via email or chat. Agree with management itself that nobody asks to skip the procedure by email or WhatsApp. That way, such a request is suspicious by definition.
5. Compare with your records. The account number of a regular supplier is in your bookkeeping. Compare it on every invoice.

Your bank's name check

Since October 9, 2025, banks in the eurozone check during a bank transfer whether the name you enter matches the account number. In English this is called Verification of Payee. Your bank shows whether the name matches, almost matches, or doesn't match, before you confirm the payment. This is set out by law in Regulation (EU) 2024/886.

• If you get a warning that the name doesn't match, don't pay and call the supplier on a known number.
• A positive result only confirms that the name and account belong together, not that the recipient is honest. If the scammer puts the name of their own account on their invoice, the check will simply pass.

Already paid?

Then every hour counts.

1. Call your bank immediately, on the number on your card or the official website. Ask whether the payment can be stopped or recalled.
2. Keep everything: the emails, the invoice and the proof of payment. Don't delete anything.
3. File a police report and report it to the Fraud Helpdesk via the report form. The Fraud Helpdesk gives advice and collects reports; only the police can investigate.
4. Warn the supplier via a known number. If their mailbox has been taken over, more customers will be receiving fake messages.
5. If the email came from your own mailbox or a colleague's, it may have been taken over. Follow Mailbox taken over or spam from your address: here's how to clean it up.

Note: if you've paid a scammer, in principle you still owe the amount to the real supplier.

You can read more about these forms of fraud at the Fraud Helpdesk: CEO fraud, The account number on the invoice has been changed and Intercepted invoices. For how to recognize a fake email, read Recognizing phishing: how to read a link and a sender.