Recognising an IBAN change scam
An email announces new bank details, an invoice arrives with different account details, a “CEO” demands an urgent and confidential transfer. This fraud affects very small businesses as much as large companies, and a single transfer can be very costly.
Kayzen Security editorial team4 min read
The most common scenarios
- The fake supplier: a message, sometimes sent from the supplier's real, hacked mailbox, announces a “change of bank” and attaches new bank details.
- The fake executive (or “CEO fraud”): a supposed executive asks for an urgent and confidential transfer for a sensitive operation.
- The fake invoice: an invoice identical to the usual one, but with a modified IBAN, sometimes slipped into a genuine email thread.
- The fake employee: a request to change the bank details used for salary payments, sent to the payroll department.
The signs that should stop you
- A request to change bank details, whatever the justification.
- Pressure on the deadline (“before tonight”, “otherwise the delivery will be blocked”).
- A request for discretion or to bypass the usual procedure.
- A slightly different sender address (one letter changed, another domain name) or a reply that goes to another address.
- An IBAN in a country that is unusual for this supplier, or an account holder that does not exactly match the company.
The verification procedure to adopt
The most effective defence is a simple rule, written down and known to everyone: no change of bank details is recorded without a call-back.
- Systematic call-back to the number in your supplier file or on an old contract, never the one in the message.
- Dual approval: the person who enters the new IBAN is not the one who approves the first payment.
- Waiting period: no large payment in the days following a change of bank details.
- Payee verification: since 9 October 2025, banks in the euro area must indicate, before a SEPA transfer, whether the payee's name matches the IBAN (règlement (UE) 2024/886). Read this result carefully: it is a safeguard, not a guarantee. For bulk transfers submitted as a file, a company may have opted out of this check: ask your bank.
- Awareness: explain these scenarios to accounting, payroll and executive assistants, who are the most targeted.
If the transfer has already gone out
- Call your bank immediately to request a recall of the funds: the chances of recovery decrease by the hour.
- Keep all the evidence (emails with their headers, invoices, statements) without altering it.
- File a complaint with the police or gendarmerie.
- Warn the real supplier or the real executive: their mailbox may have been hacked, and other customers may be targeted.
- Get guidance from 17Cyber (17cyber.gouv.fr) and notify your insurer if you have cyber or fraud cover; for cyber cover, compensation may require a complaint filed within 72 hours (French insurance code, article L.12-10-1, to be confirmed with your insurer).
Official sources
- Cybermalveillance.gouv.fr (new tab) — Assistance et prévention en sécurité numérique (fiches réflexes, prestataires ExpertCyber)
- 17Cyber (new tab) — Le réflexe en cas de cybermalveillance (Police nationale, Gendarmerie nationale, Cybermalveillance.gouv.fr)
- EUR-Lex (new tab) — Règlement (UE) 2024/886 (virements instantanés, vérification du bénéficiaire)
The resources cited are published by their authors in their original language. Kayzen is not affiliated with any of these organisations.
This guide is general and for information only. It does not replace legal advice or the help of an IT security professional.