IBAN and fake CEO fraud: the rules that stop the scam

• The target is people Haste, hierarchy and trust, not technical vulnerabilities.
• One of the dominant scams The invoice with an altered IBAN leaves no technical trace.
• Technology is not enough A payment authorised by mistake can only be prevented with a rule.
• The rule New bank details are verified by phone, on a contact that already existed.

1. Entry: the criminal gains access to a supplier's email, or to your own company's.
2. Waiting: weeks of reading without touching anything: who pays whom, what amounts, what language, what dates.
3. Swap: they take a genuine invoice and resend it with a different IBAN. Amount, reference, previous thread and signature are all correct.
4. Excuse: a casual note usually comes with it: "we've changed banks, please update your records".
5. Discovery: only when the real supplier chases the payment, weeks later.

Whoever paid made no mistake: they followed the process. That is why the defence has to be an absolute rule, even for long-standing suppliers. Any IBAN change is verified with a call to the number the company already had on file, and never to the one in the email.

Someone in treasury or accounts receives a message from a director. It is urgent and confidential, they are travelling and cannot take calls. They need a transfer right now.

The text presses three buttons at once. Urgency, to cut off reflection. Authority, to discourage questions. Secrecy, to prevent checking with a colleague. Today these messages get the name, the signature and even genuine internal topics right, copied from old emails.

The answer is organisational, not technological. Above a set amount, no transfer goes out without validation through another channel. And the board must tell the team, in writing if possible, that it will never take offence at a request for confirmation.

Almost always through a password typed into a fake login page. These pages imitate the original perfectly; the only clue is the address, and someone in a hurry does not read it. Three controls cut this risk drastically:

• Two-factor authentication for everyone The best ratio of effort to protection; a stolen password on its own no longer opens the account.
• Password manager Ends reuse and refuses to fill in credentials on a fake domain, warning before the person notices.
• Forwarding alert The first thing an intruder does is create a rule that copies mail outside; without an alert, it stays there for months.

• Verify IBANs by phone Always to a previously registered contact.
• Four eyes Above the limit, whoever requests the payment is not the one who approves it.
• Urgency is a warning sign Never a reason to skip verification.
• Licence to stop Any employee can suspend a payment without justifying their doubt. Where asking is punished, nobody asks.

Add short, frequent training with real examples. A quarter of an hour each quarter sticks better than a two-hour annual session.

Every hour counts. Follow this order:

1. Call the bank: ask for the transfer to be cancelled or recovered, the sooner the better.
2. Lock the accounts: new passwords and every open session terminated.
3. Review the mail: look for forwarding rules you did not create.
4. File a complaint: with the authorities.
5. Warn the other side: the supplier or client is probably compromised, and other companies are receiving the same fake invoices.
6. Find the source: last, but without fail. If you do not know how they got in, they will come back.

DataRoad - IT Services and Consulting configures strong authentication, email filtering and managed cybersecurity with firewalls as part of its managed IT services. Request a no-commitment assessment.

More than 10 workstations · support contract · remote, on-site and telephone support. +351 211 459 950 * · sales@dataroad.pt

*Call to a Portuguese landline.