Account-swap fraud on invoices
A regular supplier writes to inform you that they have changed banks and attaches their new account number. The email appears legitimate: the same name, the same tone, even the same signature. The invoice is paid, and weeks later the supplier complains that they have not received anything. The money has ended up in an account controlled by a third party.
This is known as ‘account takeover fraud’, a form of identity theft that primarily affects SMEs and professional practices. It works because it does not target the company’s IT systems, but rather the trust between two businesses that have been working together for years.
How it usually occurs
- From the supplier’s genuine account, which has been compromised, or from an almost identical email address, with just one letter changed.
- Under the pretence of urgency: a pending payment, a month-end closing, or a supposed audit.
- With a request not to ring, because the contact person ‘is away on business’.
- Sometimes within a genuine email thread, capitalising on an ongoing conversation.
What has changed with beneficiary verification
From 9 October 2025, banks in the eurozone must offer beneficiary verification free of charge: before executing a transfer, they check whether the name provided matches that of the holder of the recipient’s account and issue a warning if it does not match or only partially matches. This is a real help, but it has two limitations. The warning does not block the transaction, and if it is ignored and the payment is made anyway, the bank is not, as a rule, liable if the money goes to the wrong recipient. That is why a ‘name does not match’ warning should always be treated as a signal to stop.
Proposed measures
- Confirm any change of account details by telephone, using a number already on file, never the one provided in an email.
- Require a certificate of bank account ownership in the supplier’s name.
- Ensure that changes to bank details are approved by a second person.
- Do not ignore the bank’s ‘name mismatch’ alerts.
- Train administrative staff and enable two-step verification for the company’s email account.
If you have already paid
Time is of the essence. It is recommended that you notify the bank immediately so that it can request the funds be withheld or returned by the receiving bank, file a report with the police or the Mossos d’Esquadra, providing all the relevant documentation (emails with full headers, the invoice, proof of the transfer), and inform the supplier of what has happened.
There is also a matter to be resolved between the two companies: who bears the loss. As a general rule, a payment made to a party other than the creditor does not extinguish the debt, meaning the client may still owe the amount on the invoice. The courts, however, assess the diligence of each party: whether it was the supplier’s email account that had been compromised, or whether the client overlooked obvious warning signs. Each case requires its own analysis.
At SF Abogados, we advise companies both on prevention – through internal payment protocols – and on making claims once fraud has already occurred.
