Fake IBAN fraud: protecting your payments

Payment fraud does not involve a virus. It relies on a convincing message that leads someone to pay into the wrong account: a supplier announces new bank details, or a senior manager asks for an urgent transfer. The sums involved can be large, and a transfer that has gone out is hard to recover.

Protection is first and foremost a matter of procedure. Technology complements it.

Common scenarios

• The fake supplier: an e-mail announces a change of bank and asks you to update the IBAN.
• The fake executive: a message asks for an urgent, confidential payment, outside the usual procedure.
• The hacked mailbox: the message comes from the supplier's real address, within an existing conversation, because their e-mail has been compromised.
• The altered invoice: a PDF or a QR-bill in which only the payment details have changed.

Warning signs

• A change of bank details, especially to another bank or another country.
• Urgency and a request for discretion.
• A request to bypass the procedure 'just this once'.
• A tone or wording slightly different from your usual exchanges.

Rules that protect you

• Any change of bank details is confirmed by phone, on the number you already have, never the one given in the message.
• Payments above a set threshold are approved by two people.
• The procedure is written down and known to everyone, and management commits to never asking anyone to bypass it.
• The IBAN on a QR-bill is compared with the one recorded in the supplier's file.

The technical side

• Multi-factor authentication on every mailbox, so that yours cannot be used to deceive your customers.
• DMARC on your domain, to prevent direct spoofing of your address.
• A visible tag on e-mails that come from outside the company.
• An alert when forwarding rules are created in mailboxes.

If a fraudulent transfer has gone out

• Contact your bank immediately: a payment recall is sometimes possible if it is requested very quickly.
• File a complaint with the cantonal police.
• Report the fraud to the Federal Office for Cybersecurity (FOCS).
• Warn the real supplier, whose e-mail may have been compromised.
• Have your own mailboxes checked.