SecurCheckCyber Centre

INVOICES · IBAN · FINANCE TEAMS

How to check a suspicious invoice and IBAN before a bank transfer

Secur Cloud ·

Supplier impersonation or bank-detail fraud can rely on a genuine invoice with only the payment details altered. A compromised mailbox, impersonated identity or forged document can make a request convincing. Its appearance does not guarantee authenticity.

To help protect your cash flow, combine technical checks with independent verification. Here is a method to examine an invoice and check an IBAN before a bank transfer.

1. Look for warning signs on the invoice

Logos, typography and invoice numbers can be reproduced. Focus on what differs from your usual dealings.

An IBAN that differs from your records

Compare the details with those already approved for this supplier. A change of country — DE for Germany, LT for Lithuania or PL for Poland, for example — calls for contextual checks. A foreign IBAN is not proof of fraud: an unexpected or unconfirmed change is what should pause payment approval.

Changed contact details

An email address or phone number may have been replaced on the invoice to redirect your checks to the fraudster. Compare these details with contracts and established supplier records rather than relying on the new document.

Unusual urgency

Demands for immediate payment under threat of penalties or contract termination may be intended to bypass your procedures. Check agreed deadlines and do not skip approval steps under pressure.

2. Examine the sending context

Inspect the full sender and reply-to addresses. A domain resembling your supplier’s, with a changed letter or added word, may be impersonating them. A difference calls for confirmation; it is not proof of fraud on its own.

A new contact, unusual payment method or break in the conversation history also deserves investigation. Even a familiar address can be compromised: an authenticated email is not sufficient authorisation for a transfer.

Read the suspicious email analysis guide

3. Use an online IBAN and invoice checker

An IBAN and invoice checker helps compare document details with your records. Submit only necessary information and follow your organisation’s confidentiality rules.

IBAN structure

The module checks the IBAN’s format, length and checksum and identifies its country. It can compare the details with a reference IBAN you provide. Valid structure does not confirm account existence, ownership or absence of fraud.

Company identifiers

Depending on the information supplied and available sources, declared SIREN or SIRET identifiers can be compared with public company data. A company’s existence does not prove that it sent the invoice or owns the stated IBAN: a fraudster may reuse its details.

Beneficiary and sender consistency

The tool compares stated details, the beneficiary name and the sender domain to highlight discrepancies for review. It does not certify the requester’s identity. Also use your bank’s beneficiary verification service where available.

Explore the IBAN and invoice checks

Give your finance team a practical checking tool

A convincing payment request can escape a visual check. SecurCheck Business helps accounting teams compare details and identify discrepancies before approving a transaction.

The report complements your procedures: it does not confirm account ownership or guarantee absence of fraud. Timing depends on the supplied information and available sources.

Explore SecurCheck Business for your payment workflows

4. The essential rule: independent verification

Verify an unconfirmed bank change before making a transfer. An explanation involving an audit or restructuring does not remove the need for your usual checks.

  1. Avoid contact details on the suspicious document

    Do not call the number on the new invoice or in the email announcing a bank change. Simply replying to the message is not independent confirmation.

  2. Find an established contact

    Use your CRM, a signed contract or established details for your usual contact. These references should predate the suspicious request and have already been verified.

  3. Confirm and apply dual approval

    Call your contact to confirm the change and record the check under your procedures. Then obtain approval from a second authorised person where required: an independent callback does not replace separation of duties.

Related: CEO fraud and fake bank details, four warning signs

Make verification part of accounting routines

Fake bank details exploit routines in which speed can displace checks. Online invoice analysis, independent callbacks and separation of duties help reduce risk before payment. If a suspicious transfer has already been made, promptly contact your bank and the relevant teams in your organisation.

Discuss deploying SecurCheck Business for your accounting teams