Invoice fraud: how a swapped IBAN gets caught before payment

Alexander Krastev · 2026-09-22

The most expensive attack on a small company is also the dullest. Someone gets into a mailbox — a supplier's, or yours — waits for a real invoice to go past, changes one line of it, and forwards it on. Everything else is genuine: the logo, the amounts, the reference, the wording. Only the bank account is theirs.

It works because nobody reads an IBAN. It is a long string that looks like every other long string, and the person paying is checking the total, not the twenty-two characters underneath it.

What does not stop it

changed, in a place the eye slides over.

inside it, nothing says whether it was.

• Trusting the sender's address. The mail really did come from that mailbox.
• Reading the invoice carefully. The invoice is real. Only two dozen characters
• A PDF that "cannot be edited". Any PDF can be edited. Without a signature

What does

Compare against what this supplier used last time. The strongest check is the dullest: this supplier has been paid before, to an account you already have. A different one is not proof of fraud — companies do change banks — but it is the moment to pick up the phone, using a number you already had, not one printed on the new invoice.

Seal the document when it is created. A seal inside the PDF binds the file to its content: open it later in any reader and it says whether anything changed since. AIK's document seal goes one step further for invoices — it reads out the IBAN and the amount and signs them, so a later change to either breaks the seal visibly instead of quietly.

Let the automation flag it, not wave it through. A pipeline that copies fields into a spreadsheet has automated the mistake at speed. The extraction in AIK marks a record for a person when the supplier has never been seen before, when the numbers do not add up, when the VAT is not what the rate implies, or when a company number fails its checksum — and a workflow can hold the payment step behind a human approval until someone presses Approve.

None of these is clever. They are the three questions a careful bookkeeper asks, written down so they are asked every time, including on the Friday when two hundred invoices arrive.

Trying it

You can try AIK for free at aikautomation.com — upload an invoice, seal it, change one character and check it again to see the seal break. To have it on your own computer or server, with your document types and approval steps set up, you buy a licence and we install it for you. Get in touch.