Invoices with a changed IBAN and fake requests from management: how managed cybersecurity stops email fraud

• It is not software, it is behaviour These attacks exploit haste, hierarchy and trust.
• The altered invoice leads It is the most lucrative fraud in Portugal and leaves no technical trace.
• Procedure above technology Only a rule prevents a legitimate payment going to the wrong account.
• The master rule Changes to bank details are confirmed by telephone, to a number already known.

1. Intrusion — the attacker compromises the mailbox of a supplier or of the company itself.
2. Observation — for weeks, they silently learn who invoices whom, amounts, tone and deadlines.
3. Interception — when a genuine invoice appears, they resend it with the IBAN swapped. Amount, reference, history and signature are all authentic.
4. Pretext — often a casual note: “we have changed banks, please update our details”.
5. Late discovery — weeks later, the real supplier asks about the overdue payment.

Whoever paid did their job correctly. That is why the defence is a rule with no exceptions, not even for long-standing suppliers: any change of IBAN is confirmed by telephone, to the number you already had — never to the one in the email.

A message from a director reaches accounts or treasury: urgent, confidential, the person is travelling and cannot take calls. It asks for an immediate transfer.

The message attacks three points at once: urgency, so there is no time to think; authority, so there are no questions; confidentiality, so there is no checking with colleagues. Today it uses the right name, the right signature and sometimes real internal matters taken from earlier emails.

The defence is organisational: above a defined amount, no transfer goes out without confirmation through a second channel. And management must tell the team, explicitly, that it will never mind being asked for confirmation.

Both schemes almost always start the same way: someone typed their password into a page that looked legitimate. Fake pages are faithful copies; only the address gives them away, and nobody checks it in a hurry.

• Two-step authentication for everyone The single measure with the best effort-to-protection ratio; a stolen password is no longer enough.
• Password manager Prevents reuse and will not fill in credentials on a fake address, detecting the fraud before the person does.
• Automatic forwarding alerts A rule that sends mail outside is the first step of whoever compromises an account and goes unnoticed for months.

• Changed IBAN Telephone confirmation on a previously known number.
• Dual approval Above a threshold, the person requesting is not the person approving.
• Urgency does not waive verification Urgency is the attacker's tool.
• The right to stop Anyone can suspend a payment without justifying their suspicion; if the culture punishes those who ask, nobody asks.

Add short, regular training with real cases: fifteen minutes a quarter works better than two hours a year that nobody remembers.

1. Bank — immediately request cancellation or recall of the transfer; the first hours count.
2. Accounts — change passwords and end all active sessions.
3. Mailbox — look for forwarding rules created by the attacker.
4. Authorities — file a complaint.
5. Counterparty — alert the supplier or client; they are probably the one compromised, and other companies are receiving the same invoices.
6. Cause — only afterwards, work out how they got in. Without that, it happens again.

DataRoad - IT Services and Consulting implements strong authentication, email filtering and managed firewalls as part of its managed IT services. Request a no-obligation assessment.

More than 10 workstations · support contract · remote, on-site and telephone support. Call +351 211 459 950* or write to sales@dataroad.pt.

*Call to a Portuguese landline.