Supplier IBAN change fraud: how to spot it

An email arrives that looks like it comes from your usual supplier: "we've changed banks, from today please pay to this new IBAN". The transfer goes out, the supplier never sees the money, and whoever paid has lost it. It is one of the most common frauds against small businesses.

How it works

Fraudsters break into the supplier's mailbox (or create a near-identical one, one letter off) and hijack a conversation about a real invoice. Then they send an invoice or a notice with changed bank details. The payer sees a known supplier and a correct amount, and has no reason to be suspicious.

What to check

• The IBAN on the official e-invoice. The genuine invoice goes through SDI (the government's e-invoice exchange system) and lands in your cassetto fiscale: compare its IBAN with the one in the email or PDF you received.
• The history. If the IBAN differs from the one on that supplier's previous invoices, stop.
• Confirmation by phone, on the number you already know, not the one written in the email.
• Account holder and bank. A foreign account, or one held by someone other than the supplier, is a strong warning sign.

An automatic check on every invoice

CassaChiara compares the IBAN on each received invoice with the one on the same supplier's previous invoices (same VAT number) and warns you when it changes, before you pay. It also flags invoices received twice, the other costly mistake.

Frequently asked questions

I already paid to the wrong IBAN. What do I do?

Call your bank immediately and ask them to recall the transfer, then report it to the police (in Italy, the Polizia Postale). The faster you act, the more likely you are to recover the money.

Can a supplier genuinely change banks?

Yes, it happens. That is why the alert blocks nothing: it just tells you to verify before paying.

Does CassaChiara read my email?

No. It only works on the invoice files you load yourself, inside your browser.