--- title: "IBAN and fake CEO fraud | DataRoad IT" description: "An invoice with a swapped IBAN and a fake urgent request from the board: how they work and which rules and managed controls stop them. No-obligation review." language: en url: https://www.dataroad-it.com/en/email-fraud-changed-iban-ceo-fraud/ source: https://www.dataroad-it.com/en/email-fraud-changed-iban-ceo-fraud/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > An invoice with a swapped IBAN and a fake urgent request from the board: how they work and which rules and managed controls stop them. No-obligation review. # IBAN and fake CEO fraud: the rules that stop the scam At a glance For decision-makers short on time. - 01 The altered-IBAN invoice is one of the dominant scams and leaves no technical trace. - 02 Master rule: IBAN changes are confirmed by phone, on a number already known. - 03 Above a set amount, no transfer goes out without a second channel. - 04 Two-step authentication and forwarding alerts close the front door. ### In this article A single payment sent to the wrong IBAN can wipe out a quarter's profit. And no firewall would have stopped it. The **email fraud** that hurts Portuguese companies most does not exploit software flaws: it exploits someone who, in a hurry, trusts a message and authorises the transfer. The two dominant scams are the invoice with a changed IBAN and the fake urgent request from the board. A simple procedure, reinforced by well-managed technical controls, stops them. ## What do you need to know in 30 seconds? - **The target is people** Haste, hierarchy and trust, not technical vulnerabilities. - **One of the dominant scams** The invoice with an altered IBAN leaves no technical trace. - **Technology is not enough** A payment authorised by mistake can only be prevented with a rule. - **The rule** New bank details are verified by phone, on a contact that already existed. ## How does the altered invoice scam work? - **Entry**: the criminal gains access to a supplier's email, or to your own company's. - **Waiting**: weeks of reading without touching anything: who pays whom, what amounts, what language, what dates. - **Swap**: they take a genuine invoice and resend it with a different IBAN. Amount, reference, previous thread and signature are all correct. - **Excuse**: a casual note usually comes with it: "we've changed banks, please update your records". - **Discovery**: only when the real supplier chases the payment, weeks later. Whoever paid made no mistake: they followed the process. That is why the defence has to be an absolute rule, even for long-standing suppliers. Any IBAN change is verified *with a call* to the number the company already had on file, and never to the one in the email. ## How does the fake board request work? Someone in treasury or accounts receives a message from a director. It is urgent and confidential, they are travelling and cannot take calls. They need a transfer right now. The text presses three buttons at once. **Urgency**, to cut off reflection. **Authority**, to discourage questions. **Secrecy**, to prevent checking with a colleague. Today these messages get the name, the signature and even genuine internal topics right, copied from old emails. The answer is organisational, not technological. Above a set amount, no transfer goes out without validation through another channel. And the board must tell the team, in writing if possible, that it will never take offence at a request for confirmation. ## How do criminals get in? Almost always through a password typed into a fake login page. These pages imitate the original perfectly; the only clue is the address, and someone in a hurry does not read it. Three controls cut this risk drastically: - **Two-factor authentication for everyone** The best ratio of effort to protection; a stolen password on its own no longer opens the account. - **Password manager** Ends reuse and refuses to fill in credentials on a fake domain, warning before the person notices. - **Forwarding alert** The first thing an intruder does is create a rule that copies mail outside; without an alert, it stays there for months. ## Which rules should the board approve now? - **Verify IBANs by phone** Always to a previously registered contact. - **Four eyes** Above the limit, whoever requests the payment is not the one who approves it. - **Urgency is a warning sign** Never a reason to skip verification. - **Licence to stop** Any employee can suspend a payment without justifying their doubt. Where asking is punished, nobody asks. Add short, frequent training with real examples. A quarter of an hour each quarter sticks better than a two-hour annual session. ## What if the money has already gone? Every hour counts. Follow this order: - **Call the bank**: ask for the transfer to be cancelled or recovered, the sooner the better. - **Lock the accounts**: new passwords and every open session terminated. - **Review the mail**: look for forwarding rules you did not create. - **File a complaint**: with the authorities. - **Warn the other side**: the supplier or client is probably compromised, and other companies are receiving the same fake invoices. - **Find the source**: last, but without fail. If you do not know how they got in, they will come back. ## Want to close these doors in your company? DataRoad - IT Services and Consulting configures strong authentication, email filtering and [managed cybersecurity with firewalls](https://www.dataroad-it.com/en/managed-firewall-services-portugal/) as part of its [managed IT services](https://www.dataroad-it.com/en/managed-it-services-networks-security-cloud/). Request a no-commitment assessment. **More than 10 workstations · support contract · remote, on-site and telephone support.** +351 211 459 950 * · sales@dataroad.pt **Call to a Portuguese landline.* Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Cloud and Microsoft 365 ## One StepAhead of IT. The right licences, MFA on every account and backups that actually restore. The cloud stops being an invoice and becomes a tool. - **232** clients under management - **0** DataRoad security incidents in 11 years - **MFA** on every managed account We do **IT** right. DataRoad IT Unlimited ## Operational continuity is not luck. It is method and contract. IT Unlimited reduces risk and shows in writing what changed. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/email-fraud-changed-iban-ceo-fraud/