Invoice fraud and CEO fraud: how to protect your company’s payments

A regular supplier writes to you from their genuine address, in the thread of your last order: “We are changing banks, please pay the attached invoice into our new account.” Three weeks later, the real supplier chases you for an unpaid invoice. The money is long gone.

Invoice fraud, CEO fraudCEO fraudA scam in which a fraudster poses as a senior executive, supplier or lawyer to get an employee to make an urgent, confidential bank transfer to an account the fraudster controls. and fake bank advisers do not target your servers: they target your payment procedures and the goodwill of the people who run them. Here is how to recognise them, which procedure to put in place, what Verification of Payee is worth and what to do if the money has already left.

Transfers are now the main target of payment fraud in France

According to the Observatoire de la sécurité des moyens de paiement (OSMP), the French payment security observatory chaired by the Banque de France, credit transfer fraud rose by 37% in 2025 to 485 million euros. Transfers have become the largest source of fraud by value (39% of the total), ahead of cards.

The jump comes from manipulation fraud, where victims approve the transaction themselves: fake bank adviser, CEO fraud, IBAN substitution. It reached 516 million euros, up 34%, of which 376 million was by transfer.

For Cybermalveillance.gouv.fr, the French national victim-assistance service, transfer fraud joined the top three threats to companies and associations in 2025: 13.5% of requests for help, up 93% in a year.

Three scenarios, one mechanism

The trick is always the same: make an unusual request look normal, and prevent anyone from checking it.

Fake change of bank details

This is the most common scenario. A supplier, a landlord, or someone posing as one, announces new bank details just before an invoice is due. In most cases, Cybermalveillance.gouv.fr notes, the fraud follows the hacking of a mailbox, the customer’s or the supplier’s, often after successful phishingPhishingA scam that impersonates a trusted sender (a bank, a supplier, a colleague) by email, text message, phone call or QR code to trick the victim into clicking, handing over credentials or paying.. The criminal reads the correspondence, spots an invoice awaiting payment and steps in at the right moment, sometimes from the genuine address, sometimes from a lookalike one letter off.

Two variants are growing: requests to change the account an employee’s salary is paid into, and bank details altered inside a hacked invoicing tool, so that your customers pay genuine invoices into the fraudster’s account.

CEO fraud

A fake executive contacts an employee authorised to make payments: a confidential acquisition, a tax inspection, a deal to close before year end. They insist on urgency and secrecy, sometimes backed by a fake lawyer. The script draws on public information (organisation charts, social media): OSINTOSINT (open-source intelligence)Collecting and analysing publicly available information (websites, social media, public registers, published leaks) to understand a target. put to work for social engineeringSocial engineeringManipulation techniques that get a person to bypass security themselves: revealing a password, approving a payment, opening a door or installing software.. Deepfakes add a cloned voice, or even a whole video call.

Fake technicians and fake bank advisers

The fake technician from your bank or your IT provider announces a migration of the online banking software and asks for “test transfers”, for a remote access tool to be installed, or for an authentication prompt to be approved. The fake bank adviser, the most common form of manipulation fraud according to the OSMP, reports fraud in progress and pushes the victim to “secure” their funds by approving transactions.

The number displayed may be your branch’s own: caller ID spoofing persists despite new French rules that came into force on 1 January 2026, Cybermalveillance.gouv.fr observes. Remember the OSMP’s reminder: a bank never needs its customer to take any action to stop a suspicious payment.

Warning signs

An anti-fraud procedure that works

The first of the “9 security reflexes” published by the French Banking Federation and the Police judiciaire is simple: follow an internal procedure for transfers. It comes down to four rules.

Call back on a known number

Any new or changed bank details are confirmed by calling a number you held before the request (contract, earlier invoice, supplier record), never the one in the message. Don’t read out the new IBAN: ask your usual contact to read it to you. Record the date and the name of the person you spoke to.

Two approvals and separation of duties

Whoever edits the supplier master file does not approve payments. Above a set threshold, two approvals are required, ideally enforced by the banking portal itself. And no exceptions, not even for the CEO: written down and signed by management, this rule protects employees from a pushy “boss”.

A cooling-off period for new bank details

Good practice rather than a legal requirement: new or changed bank details are only used after a set delay, say two or three working days, long enough for the call-back. Fraud feeds on urgency; a delay everyone knows about removes its main lever.

Protect mailboxes and your domain

Turn on multi-factor authentication (MFA)Multi-factor authentication (MFA)A login that requires at least two proofs of identity of different kinds (something you know, something you have, something you are), so that a stolen password is no longer enough. for mailboxes and online banking, and watch for automatic forwarding rules, a favourite fraudster trick. Set up SPF, DKIM and DMARC so nobody can email your customers in your name: our DMARC, SPF and DKIM guide explains how. DMARC does not protect against lookalike addresses or a supplier’s hacked mailbox, so the call-back remains essential.

Checklist for the accounts team

• Every change of bank details is confirmed by a call-back to a known number, and logged.
• Only named people can edit the supplier file, and they are not the people who pay.
• Above the threshold, two approvals are required in the banking portal.
• A cooling-off period applies before the first payment to a new IBAN.
• A Verification of Payee alert holds the payment until the call-back is done.
• Bulk payment files also go through Verification of Payee.
• Mailboxes and online banking are protected by MFA.
• Everyone knows whom to call at the bank if in doubt, including out of hours.

Verification of Payee: a help, not a shield

Since 9 October 2025, Regulation (EU) 2024/886 on instant payments has required banks in the euro area to offer Verification of Payee before any euro credit transfer, instant or standard. Before you authorise, your bank queries the payee’s bank and warns you if the name entered does not match the holder of the IBAN; for a close match, it shows the actual name. The service is free, with no amount threshold.

Real progress, but with limits:

• it blocks nothing: you can go ahead despite the alert, and if you do, the risk is yours;
• a match does not prove legitimacy: in CEO fraud, the account really does belong to the company the fraudster named;
• fraudsters adapt: in late 2025, Cybermalveillance.gouv.fr saw accounts opened in the impersonated person’s name to divert salaries;
• bulk payments: business customers can opt out of the check for batches of transfers; ask your bank what applies to you;
• scope: international and non-euro transfers are excluded, and EU countries outside the euro area are only bound from 9 July 2027;
• false alarms: a trading name that differs from the registered name triggers close matches, which train staff to click “continue”.

The money has gone: what to do in the first hour

An instant transfer arrives in seconds: act straight away.

1. Call your bank immediately on its usual number, report fraud and ask for the funds to be returned. The request goes to the payee’s bank and only succeeds if the money is still in the account.
2. Identify every transfer sent, pending or scheduled to that account, and block the fraudulent details in your systems.
3. Keep the evidence: full emails, phone numbers, transfer orders, invoices.
4. Report it to the police without delay, in person in France: the online complaint service does not cover these scams. Your bank may ask for the receipt.
5. If a mailbox was hacked, change the passwords, close sessions, delete forwarding rules and warn the impersonated partner. If you have cyber insurance in France, Article L12-10-1 of the Insurance Code makes compensation for losses caused by an attack on an information system conditional on a police complaint within 72 hours.
6. Get help: 17Cyber, the online service run by the French police, gendarmerie and Cybermalveillance.gouv.fr, helps you assess the incident. Our Handling an incident chapter covers crisis managementIncident responseThe organised set of actions taken to detect an attack, limit the damage, drive the attacker out, restore operations and learn the lessons. in detail.

Train your teams, regularly

A procedure only protects you if people dare to apply it to a “CEO” on the phone. Train accounts and reception staff on it every year, new starters included. The KrakenShield Academy trains your staff in short modules, including one on CEO fraud. The Phishing, social engineering and physical intrusion chapter of “Cyber A to Z” covers the full range of traps.