Fake invoice by email:
five signs

There are two common routes, and it's worth knowing both. In the first, someone has got into your supplier's mailbox, usually with a stolen password, and from there reads the real conversations: they know what you buy, when you pay and what the invoices look like. With that, all they need to do is take a genuine invoice, change the account number and send it from the supplier's own address, sometimes replying within the very email thread you already had. In the second, the compromised mailbox is yours, or someone's in your office, and the attacker intercepts the genuine invoice before you see it. In both cases the document is real apart from one detail, which is why checking the logo, the layout or the signature is no use at all. What gives the fraud away isn't in the PDF; it's in the request to change the account.

Not necessarily, and this is the point that causes most confusion. A correct address only proves that the message came from that mailbox, not that it was written by the person you know. If the supplier's email account has been compromised, the fake message will come from their real address, with their signature, their tone and even the previous email chain underneath. The opposite happens too: sometimes the address is very similar but not the same, with one letter changed, an extra hyphen or a different ending, and on a phone screen it's hard to spot. So the address is a useful sign when it doesn't match, but not a guarantee when it does. For a change of bank details, the only confirmation that counts is a call to a number you already had, made by you, without using any phone number that appears in that email.

It's an email header that tells your mail program which address your reply will go to when you press "Reply". It normally matches the sender and nobody pays attention, but it can be set to a different address. In this fraud it's used so the message appears to come from the supplier, yet when you reply asking whether the change of bank is genuine, your question reaches the attacker, who will naturally say yes. To see it, in most email programs you just press "Reply" and look at which address appears in the recipient field before typing anything, or open the message details. If the reply address isn't the supplier's, there's no need to investigate further: it's fraud. And even if it matches, don't reply to that email to verify the change. Verification through the same channel that brought the request verifies nothing; pick up the phone.

An IBAN has a structure you can read without being an expert. The first two letters are the country where the account is held: ES is Spain, and a long-standing Spanish supplier that suddenly asks to be paid into an account starting with different letters deserves a phone call before you pay. In Spanish accounts, after the two letters and the two check digits come four digits that identify the bank; if the email says they've moved to a particular bank and that code belongs to another, that doesn't add up either. In addition, more and more banks now show a warning when you set up the transfer if the payee's name doesn't match the account holder. If that warning says it doesn't match, stop. None of these checks replaces the phone call: a careful attacker can use a Spanish account. They help catch the crude cases, not to give the rest a clean bill of health.

Call your bank there and then, not tomorrow or after you've checked everything. Explain that you've made a transfer to a fraudulent account and ask them to try to stop it or request its return from the receiving bank. The less time that has passed, the better the chance the money is still in that account; with instant transfers the window is very short, and there's no guarantee of getting it back, but without that quick call the chances drop sharply. Then report it to the Policía Nacional or the Guardia Civil, or to the Mossos d'Esquadra if you're in Catalonia, with the email, the invoice and the transfer receipt: the bank usually asks for the report to proceed. Also let the supplier know by phone, because their email is probably compromised and they have their own problem. And if you need guidance on the steps, INCIBE's 017 helpline answers cybersecurity queries free of charge and in confidence.

No, quite the opposite: keep it exactly as it is. That message is the main evidence for the police report and for whatever the bank asks for, and what matters isn't just the visible text but the technical headers, which show which servers actually sent it and which address replies were going to. If you delete it, or forward it and delete the original, some of that information is lost. The best thing is to leave it in your inbox, without replying or opening any more attachments, and if you want it out of the way, move it to a separate folder. There's also no point replying to the attacker to tell them off or try to get the money back: it only confirms that your address is active and that someone reads it. Keep the invoice PDF, the transfer receipt and any other email in the same thread too. With all of that together, whoever reviews the case can reconstruct what happened and from where.

It's possible, and it needs ruling out. If the attacker has read your email, they know your suppliers, your customers and your payment terms, and can repeat the scam outwards, sending your customers invoices from you with a different account. The typical signs are email rules nobody created — for example, one that forwards messages to an external address or moves anything containing the word "invoice" to a hidden folder — sign-ins from unusual places, or sent messages nobody remembers writing. The first step is to change that account's password from a clean computer and turn on two-step verification if it wasn't already; the second is to review those rules and the open sessions. If your business depends on email for invoicing, have someone with administrator access check it thoroughly. It's one of the reviews we carry out as part of our IT support for businesses.

With a short, written process that doesn't rely on someone "having a good eye". First: no change to a supplier's bank account is accepted by email; you call the usual contact, on the number already in the supplier's record, and note who confirmed it and when. Second: adding or changing an IBAN is approved by two people, one who enters it and another who checks it, so that a single well-crafted email isn't enough to move money. Third: any urgency over a payment to a new account is a reason to slow down, not speed up. And fourth: company email with two-step verification on every account, which is what stops the scam coming from your own mailbox. It isn't expensive technology; it's a habit. It takes a couple of minutes per change and stops the fraud at the exact point where it works.