The invoice looked entirely genuine: the right logo, the right amount, the right file reference. Only one line had quietly changed — the account number. Sophie B., a partner at an accounting firm in French-speaking Switzerland, nearly paid it one Friday afternoon, between two closings, before a small detail made her pause. That scene — a fake supplier invoice almost paid — plays out every week in SMEs convinced they are too small to interest a fraudster.
Spotting a fake supplier invoice before the transfer leaves
The scam is disarmingly simple. A fraudster poses as a supplier you already know — an IT provider, a landlord, a subcontractor — and sends you an invoice that is almost identical to the real ones. Almost: the account number (the IBAN, the international identifier of your bank account) has been swapped for theirs. You pay as usual; the money goes to the crook.
To get there, they have two ways in. The first is called phishing: a booby-trapped email that impersonates a trusted sender to extract information or make you take an action. The second, more targeted, is known as bank-detail change fraud — a variant of what specialists call business email compromise (BEC): the fraudster has sometimes read genuine exchanges, knows the name of your contact, the amount at stake, the due date. Their message arrives at the right moment, in the right conversation thread.
An accounting firm is a prime target, and not by chance. It settles invoices for itself, but above all on behalf of dozens of clients. Decision-making is short and informal — people know each other, trust each other, work fast. There is often no in-house IT person: "IT is what the provider handles." And the raw material is payments and banking data. All the ingredients that make a fake supplier invoice a very real risk, long before any dramatic ransomware or cyberattack enters the picture.
What makes the fake invoice so believable is the fraudster's groundwork. Some of the information is public: the names of your usual suppliers, the look of their documents, sometimes even their billing cycles can be guessed in a few searches. The rest, the crook occasionally gathers from a genuinely compromised mailbox — their own, the supplier's, or a third party's in the chain — watching the real exchanges before slipping in at the right moment. They do not "hack" your accounting software: they imitate a conversation you were already expecting. It is that apparent normality that disarms your vigilance.
Another common, cruder variant that still works: a fake invoice from a supplier you have never worked with — a domain name, a professional-directory renewal, some subscription — sent out en masse in the hope that a busy accounts department pays it without a second thought. The same verification reflex neutralises both cases.
A few signals, taken together, should make you stop:
- a change of bank details announced by a plain email, often "urgent" or "as a one-off exception";
- a sender address that is almost right, off by a single letter, or a tone slightly different from usual;
- an invoice that arrives earlier than expected, with quiet pressure on the deadline;
- an IBAN whose opening letters no longer match the supplier's usual country.
None of these signs is proof on its own. It is their accumulation — and above all the fact that you are asked to act fast on money — that should trigger verification. The right reflex is not to become suspicious of everything, but to have one clear checkpoint at the moment that counts.
In plain terms. A fraudster does not need to "hack" your IT to rob you: they only need to convince you to change an account number. The technology is just scenery; the real target is the routine of your payments.
What to remember
Three ideas are enough to change your exposure.
First, the attack does not target your technology, it targets your trust. No antivirus blocks a perfectly credible email simply asking you to update an account number. The defence is human and organisational before it is technical.
Second, the decisive link is the moment of payment. It hardly matters how the fake invoice got in: everything hinges on the instant someone approves the transfer. That is where one simple reflex stops the vast majority of attempts.
Third, this is a matter of responsibility, not just money. When an accounting firm handles its clients' banking data, the new Swiss data protection act (nFADP) expects it to take "appropriate" security measures. The Federal Office for Cybersecurity (NCSC) regularly issues alerts about these invoice frauds: referring to them already gives you a head start.
Habits to put in place this week
None of this requires a budget, software or an IT specialist. These are team habits, to set up as early as this week.
1. Verify any change of bank details through a known channel
Set a rule with no exceptions: no IBAN is ever changed on the strength of an email alone. As soon as a supplier announces a new account, you pick up the phone and call the number already on file — never the one given in the suspicious message. Thirty seconds on the phone beats an unrecoverable transfer.
2. Introduce a second pair of eyes on payments
Above an amount you set yourself, two people approve every transfer: the one who prepares it, the one who checks it. This "four eyes" costs nothing and breaks the sense of urgency, because the fraudster is banking precisely on a decision made alone and in haste.
3. Slow down when it feels urgent, and train the team's eye
Urgency is the fraudster's favourite tool. Explicitly allow your staff to take the time to check, without fearing they are "wasting time." Pass a sample fake invoice around in a meeting, show the almost-right address and the altered IBAN line: a team that has already seen the trap recognises it far faster.
Where do you really stand?
These three habits belong to your payment procedure and to raising your team's awareness — two areas reviewed by the Cyber Passport self-assessment. It certifies nothing and does not declare you "protected": it shows you, question by question, where your organisation stands firm and where it still rests on trust and habit. When facing a fake supplier invoice, that is often where the blind spot hides.
And if the transfer has already left? Time matters: contact your bank immediately to attempt a recall of funds, keep the invoice and emails as evidence, and report the attempt to the Federal Office for Cybersecurity (NCSC), which centralises these cases. The faster the alert, the better the chance of freezing the money before it scatters.
To go beyond awareness, our anti-phishing blueprint lays out the full procedure: email filtering, a step-by-step payment-verification process, an awareness plan and a simulation. Enough to turn three good reflexes into a defence that lasts.
