TLDR
Supplier suffers account compromise via phishing. Fraudsters monitor email correspondence, insert themselves into an ongoing thread, and send the next invoice as a PDF with identical layout but changed IBAN ('We have changed our bank: new...
How it works
Supplier suffers account compromise via phishing. Fraudsters monitor email correspondence, insert themselves into an ongoing thread, and send the next invoice as a PDF with identical layout but changed IBAN ('We have changed our bank: new...
Red flags
- Urgent pressure to click, pay, or share codes immediately.
- A link or sender that does not match the official organization.
- Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.
What to do
- 1WHAT TO DO: ALWAYS verify IBAN changes by phone using a known number.
- 2IN CASE OF FRAUD: Bank within 24 hours for SEPA recall, report to LKA Cybercrime, lawyer for damages.
Source
BSI
Source reviewed by Mythos Forensic Team
https://www.bsi.bund.de/DE/Themen/Verbraucherinnen-und-Verbraucher/Cyber-Sicherheitslage/Methoden-der-Cyber-Kriminalitaet/Spam-Phishing-Co/spam_phishing_node.htmlFAQ
Is IBAN Swap on Fake Supplier Invoice a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Urgent pressure to click, pay, or share codes immediately.; A link or sender that does not match the official organization.; Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.
What should I do first?
WHAT TO DO: ALWAYS verify IBAN changes by phone using a known number.; IN CASE OF FRAUD: Bank within 24 hours for SEPA recall, report to LKA Cybercrime, lawyer for damages.
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.