The email looks routine. The supplier's logo, your usual contact's signature, an invoice for the usual amount. One line is new: "We have changed banks; please pay into the account below from now on." The payment goes out, and lands in a fraudster's account.
This is supplier bank-detail change fraud, also called fake supplier fraud or invoice redirection. It targets accounts payable and procurement teams in companies of every size, because it hides inside the most ordinary task there is: paying an invoice. France's national cyber-victim assistance service, cybermalveillance.gouv.fr, and Spain's national cybersecurity institute, INCIBE, both publish guidance on it. This guide brings their advice together, adds the checks that belong in vendor onboarding, and is honest about what a company register can and can't tell you.
The advice quoted comes from cybermalveillance.gouv.fr and INCIBE, checked on 13 October 2026.
What you'll learn
- How the fraud usually unfolds
- The warning signs your team should know
- The controls that stop it, from onboarding a supplier to releasing a payment
- What to do in the first hours if money has already left
- Where a company register check fits, and where it doesn't
How does supplier bank-detail fraud work?
Cybermalveillance.gouv.fr describes the "faux RIB" scam as tricking the victim by impersonating a creditor, so that a transfer goes to an account the fraudster controls. INCIBE describes the same pattern in Spain: the criminal impersonates one of the company's suppliers and asks to change the account number, often from an email address that closely resembles the real one.
The most common version starts with a compromised mailbox. One of INCIBE's published real cases shows it step by step: a criminal got into a business owner's email account, created a rule that diverted his supplier's invoices, then sent him an invoice from an almost identical address with a different bank account. The invoice was paid.
The typical sequence:
- The fraudster gets into a mailbox, yours or your supplier's, and reads the threads.
- They spot an upcoming invoice, the right contact and the usual tone.
- They send a modified invoice, or a "new bank details" notice, from the real address or a lookalike.
- They add a believable reason (new bank, audit, blocked account) and often some urgency.
A second version needs no break-in: the fraudster invents a supplier, with a name close to a real company, and gets it set up in your systems. That is where a register check at onboarding helps most.
Warning signs
- New bank details announced by email, especially with no prior conversation.
- A sender address that is almost right: a swapped letter, an extra hyphen, a different domain.
- An account in a different country from the supplier's, with no explanation.
- Urgency or secrecy: "must be paid today", "please keep this between us".
- A supplier your records don't know, or whose name, address or company number doesn't match the official register.
The controls that stop it
1. Call back on a number you already have
This is the key control, and both agencies put it first. Cybermalveillance.gouv.fr advises contacting the creditor directly by phone to confirm any request to pay a new account; INCIBE advises verifying the invoice with the supplier by phone and applying double-check protocols to account changes. Use the number already in your systems or contract, never the one in the message announcing the change.
2. A written procedure with no exceptions
Cybermalveillance.gouv.fr recommends clear rules for authenticating unplanned payment requests and an internal approval step that cannot be bypassed. In practice:
- no change to bank details without a callback and a second approval;
- one person enters the change, another approves it;
- a record of every check: who called, which number, when.
3. Check the supplier against the register at onboarding
Before a supplier goes into your ERP, confirm in the official register that it exists, that the legal name matches the invoice, that the registered office is consistent and that the company is active. For French suppliers that means checking the SIREN; for Spanish companies, the registered name and the acts published in the BORME. See how to check a French supplier with official sources and how to check a Spanish company before you sign.
If the supplier trades across EU borders, check its VAT number in VIES as well: see how to check an EU VAT number with VIES.
4. Check again when something changes
A change of bank account, address or name is the moment to re-run the register check. If the company has been sold, has entered insolvency proceedings or has closed, a "new account" may have a real explanation, or may be the fraud. See how to check whether a French or Spanish company is insolvent.
5. Secure the mailboxes
Because the fraud often starts with a break-in, the basics matter: strong, unique passwords, two-factor authentication switched on, security updates applied, and finance and procurement staff trained to spot lookalike addresses.
What to do if money has already left
Act at once. Drawing on both agencies' advice:
- Call your bank to try to stop or recall the transfer. Every hour counts.
- Block the fraudulent account in your systems and list every payment already made, pending or scheduled to it.
- Warn the real supplier, so they can secure their mailbox.
- Keep the evidence: emails with headers, invoices, payment orders.
- Change passwords and switch on two-factor authentication if a mailbox was compromised.
- Report it to the police. In France, cybermalveillance.gouv.fr points to filing a complaint with the police or gendarmerie and lists victim-support lines; in Spain, INCIBE's cybersecurity helpline answers on 017.
What a register check gives you, and what it doesn't
To be clear: no company register tells you who owns a bank account. The callback stays essential. But the register answers three questions that belong in your procedure:
- Does this supplier exist? A company number, a legal name, a creation date.
- Is it still the same company? A new address, a new name, a closure or a dissolution are reasons to stop and ask.
- Is it in insolvency proceedings? A company in liquidation doesn't invoice or get paid the way it used to.
Fuentio reads the official French registers and the Spanish BORME and answers in one format, with the source and the check date on every answer:
- the free check looks up one company by SIREN, SIRET, French VAT number or name (3 a day, no account);
- the free list check checks up to 20 suppliers at once, with BODACC insolvency notices for France and a CSV file for the supplier file;
- the API plugs into your vendor-management or ERP workflow to check every new supplier and every change: a free API key gives 100 units a month.
The result is fewer manual checks and a dated record of each one in the supplier file. See what we cover.
Limits. The advice quoted comes from cybermalveillance.gouv.fr and INCIBE, checked on 13 October 2026. Fuentio does not verify bank accounts, does not detect fraudulent emails, and replaces neither the supplier callback nor your internal approval step: it confirms what the official registers say about the company. In Spain, Fuentio shows the acts published in the BORME since 2 January 2009, and a company's status is unknown unless an act says otherwise. This is not legal advice.
Frequently asked questions
How should we verify a supplier's change of bank details?
Call the supplier on a number you already hold, never the one in the message, and have a second person approve the change before any payment.
What is invoice redirection fraud?
A fraudster impersonates a supplier, often from a compromised or lookalike mailbox, and asks you to pay a genuine-looking invoice into a new account they control.
What should we do if we paid a fake invoice?
Call your bank immediately to try to stop the transfer, keep the evidence, warn the real supplier and report it to the police.
Can a company register confirm an IBAN?
No. It confirms that the company exists, its legal name, its registered office, its status or registered acts, and published insolvency proceedings. Bank details are confirmed with the supplier, through a channel you already trust.
Sources
- Cybermalveillance.gouv.fr, what to do in case of transfer fraud or a fake RIB (checked 13 October 2026): cybermalveillance.gouv.fr
- Cybermalveillance.gouv.fr, fake transfer order fraud (FOVI): cybermalveillance.gouv.fr
- INCIBE, the most frequent online frauds facing your business: incibe.es
- INCIBE, real case: paying an invoice to a criminal who got into a mailbox: incibe.es
- INCIBE, cybersecurity helpline 017: incibe.es