In summary<\/p>\n
- \n
- Most fraud doesn't exploit software<\/strong> \u2014 explores pressure, hierarchy and trust.<\/li>\n
- Invoice modification is the most profitable fraud in Portugal<\/strong> and leaves no technical trace whatsoever.<\/li>\n
- No technology can prevent a payment authorised by mistake. What is preventing it is a procedure.<\/strong><\/li>\n
- The rule that resolves almost everything: bank detail changes are confirmed by telephone<\/strong>, at a number already known.<\/li>\n<\/ul>\n<\/div>\n
\nIn this article<\/p>\n
- \n
- The amended invoice<\/a><\/li>\n
- The urgent request from management<\/a><\/li>\n
- Credential theft<\/a><\/li>\n
- The procedures that work<\/a><\/li>\n
- If it has already happened<\/a><\/li>\n<\/ol>\n<\/div>\n
When talking about IT security, people think of firewalls and antivirus software. But most of the money that Portuguese companies lose to fraud does not go through a technical flaw \u2014 it goes through a transfer authorised by someone who believed what they were reading.<\/p>\n
They are attacks that do not exploit software. They exploit haste, hierarchy and trust. And that is why no technology alone solves them.<\/p>\n
The amended invoice<\/h2>\n
It is the most profitable scheme and the hardest to detect. This is how it works.<\/p>\n
Someone compromises a supplier's mailbox \u2014 or the company's own \u2014 and watches in silence for weeks. They learn who invoices whom, the usual amounts, the tone of the messages, the deadlines.<\/p>\n
When a real invoice arrives, intercept it and resend it with the IBAN changed<\/strong>. Everything else is authentic: the value, the reference, the conversation history, the signature. It frequently comes accompanied by a casual note \u2014 \u201cwe've changed bank, please update our details\u201d.<\/p>\n
Payment is made by someone who did their job correctly. The fraud is only discovered weeks later, when the real supplier asks about the overdue payment.<\/p>\n
\nThe rule that completely stops this fraud:<\/strong> Any change to a supplier's bank details is confirmed by phone<\/em>, to a number they already had before \u2014 never to the number given in the email requesting the change. No exceptions, including for long-standing suppliers.<\/p>\n<\/div>\n
![\"Dark](\"https:\/\/www.dataroad.pt\/wp-content\/uploads\/2026\/08\/DataRoad_IG_ciberseguranca-v2.png\")
The altered invoice fraud does not exploit a technical flaw \u2013 it exploits a process without verification.<\/figcaption><\/figure>\n The urgent request from management<\/h2>\n
A message from someone in management to the accounts or treasury department. It is urgent, confidential, the person is travelling and cannot answer the phone. They are requesting an immediate transfer.<\/p>\n
The details vary, but the structure is always the same and it attacks three things at the same time: urgency<\/strong>, so there's no time to think; authority<\/strong>, to discourage questions; and confidentiality<\/strong>, to prevent verification with colleagues.<\/p>\n
These attacks are quite convincing nowadays: they use the right name, the right signature, and sometimes refer to real internal matters gathered from previous emails.<\/p>\n
Organisation is the defence, not technology: no transfer above a set amount is made without confirmation via a second channel<\/strong> \u2014 and management must explicitly tell the team that they will never be annoyed at being asked for confirmation.<\/p>\n
Credential theft<\/h2>\n
The gateway for both of the previous schemes is almost always the same: someone typed their password into a page that looked legitimate.<\/p>\n
Fake authentication pages are now faithful copies. What gives them away is the address \u2014 and that is precisely what nobody checks when they are in a rush.<\/p>\n
Three measures drastically reduce this risk:<\/p>\n
- \n
- Two-factor authentication for everyone.<\/strong> It is the single measure with the best balance between effort and protection. A stolen password is no longer enough.<\/li>\n
- Password manager.<\/strong> As well as preventing reuse, it has an underestimated advantage: it doesn't autofill credentials on websites whose address doesn't match the real one. It spots the fraud before the person does.<\/li>\n
- Automatic forwarding alerts.<\/strong> Creating a rule to forward mail externally is the first step for anyone who compromises an account \u2014 and it goes unnoticed for months.<\/li>\n<\/ul>\n
The procedures that work<\/h2>\n
Four simple rules, written down and known by everyone, that resolve the vast majority of cases:<\/p>\n
- \n
- IBAN changes are confirmed by telephone<\/strong>, to a previously known number.<\/li>\n
- Payments above a limit require two people.<\/strong> He who requests is not the one who approves.<\/li>\n
- No urgent request dispenses with verification.<\/strong> Urgency is the attacker's tool, not a reason to skip steps.<\/li>\n
- Anyone can stop a payment<\/strong> without having to justify mistrust. If the company culture punishes those who ask questions, no one asks.<\/li>\n<\/ul>\n
And short, regular training with real examples. Not a two-hour session once a year that nobody remembers \u2014 fifteen minutes a quarter with concrete cases works better.<\/p>\n
If it has already happened<\/h2>\n
Speed is everything. In the first few hours there is still a chance.<\/p>\n
Contact the bank immediately to request the cancellation or recovery of the transfer \u2014 the sooner you do it, the higher the likelihood. Change the passwords of the accounts involved and end all active sessions. Check if any forwarding rules have been created in your mailbox. File a complaint with the authorities. And notify the supplier or client on the other end, because they are likely the ones who have been compromised \u2014 and other companies will be receiving the same invoices.<\/p>\n
Then, and only then, figure out how they got in. Without that, it will happen again.<\/p>\n
DataRoad helps companies implement IT security<\/a> and strong authentication, within the managed IT services<\/a>.<\/p>\n
\nA chat before making a decision<\/p>\n
Whether you\u2019re tackling a specific problem, planning a move or simply looking for a second opinion, we always start in the same way: by understanding your situation before making any suggestions. No obligation, no jargon and no catalogues.<\/p>\n
- Payments above a limit require two people.<\/strong> He who requests is not the one who approves.<\/li>\n
- Password manager.<\/strong> As well as preventing reuse, it has an underestimated advantage: it doesn't autofill credentials on websites whose address doesn't match the real one. It spots the fraud before the person does.<\/li>\n
- The urgent request from management<\/a><\/li>\n
- Invoice modification is the most profitable fraud in Portugal<\/strong> and leaves no technical trace whatsoever.<\/li>\n