Scam with genuine invoices and a changed account number

The best-known invoice scam is the usual one: you receive an invoice for a service you have not ordered, with a payment link or a bank account. It is easy to spot, because nobody is expecting that invoice.

This one is much more dangerous: you receive an invoice you are actually expecting, from a real supplier, within a real conversation, for the right amount. The only thing that changes is the account number, which the attacker has replaced with one of their own in the PDF or in the text of the email.

You pay as normal. Days later the supplier asks you for payment, and they are right: the money went to the attacker's account. That account may be a foreign one or a Spanish account belonging to another victim, used as a bridge to move the money out later.

How they do it

The goal is always the same, changing the bank details, but there are several ways to achieve it:

• Hidden rules in the recipient's mailbox. This is the most common route we see. The attacker gets into your email and creates a rule that intercepts messages containing words such as "invoice", "payment", "receipt" or "IBAN". The rule forwards them or moves them aside, the attacker changes the bank details and puts the message back in your inbox as if nothing had happened. You do not notice anything odd.
• Compromised sender or recipient mailbox. With the password of either account, the attacker reads the conversations and sends modified invoices at just the right moment, from the genuine address.
• Lookalike domain. The attacker replies from an almost identical address: they change an "m" for "rn" (proveedor.com → proveedor.corn), add a letter or use another extension (.net instead of .com). At a glance it looks like the same thread.
• A virus on the computer. A trojan on the computer where Outlook or another email program is used can alter sent or received messages.

A changed IBAN does not by itself tell you which of the two parties has been compromised. Both should check.

Before paying an invoice

• Compare the account with the one used for previous payments. If it is different, or it is the first payment, do not pay until you have confirmed it.
• Confirm the change by phone, calling the supplier's number you already had. Do not use the phone number or link in the same email.
• Be wary of urgency. "We have changed banks", "the previous account is blocked" or "pay today to avoid surcharges" are the usual phrases.
• Ask for an electronically signed invoice and check it in VALIDe, the Spanish Government's signature validator. If someone modified the file after signing it, the signature is no longer valid.
• Ask for a certificate of account ownership issued by the supplier's bank. Careful: if it arrives attached to the same suspicious email it may also be forged; confirm it by phone anyway.
• In a company, the person who accepts an account change should not be the same person who approves the payment.

If you have already paid

1. Call your bank immediately and ask them to try to hold or reverse the transfer. The sooner you do it, the more options there are; it is not always recovered.
2. Keep the evidence: the original email (not a screenshot, but the full message with its headers), the PDF you received, the transfer receipt and the dates.
3. Let the supplier know by phone so that they can check their accounts too.
4. Report it to the police with that evidence. In Spain you can report it to the Policía Nacional or the Guardia Civil, and get guidance from 017, INCIBE's cybersecurity helpline.

Check your email

If you suspect your mailbox has been compromised, check the following from a computer you know is clean:

1. Email account filters. In cPanel, go to Email Filters, click Manage Filters for each mailbox and look for rules you did not create: ones that look for "invoice", "payment" or "transfer", or that forward, move to odd folders or discard messages. This is how they are managed: email filters in cPanel.
2. Global filters. Global Email Filters apply to all the accounts on the hosting. Check them too.
3. Forwarders. In Forwarders, check that there is no address copying your email to an external mailbox.
4. Email program rules. If you use Outlook, Thunderbird, Gmail or another client, check its rules too: they do not appear in cPanel.
5. Sent and Trash folders. Look for messages you did not send or replies you have not seen.
6. Change the passwords of the email accounts and cPanel to new, random ones that you do not use anywhere else. Changing the password does not delete the rules: remove them by hand.
7. Enable two-step verification in webmail and in the client area.
8. Scan with an antivirus the computers and phones where you read your email.

If your email is with Hostsuar, open a ticket with the affected addresses and the approximate dates: we review the recorded logins (IP, times, origin) and give you the information for the police report. Never send us passwords.

In the guide on how passwords are stolen you have the most common methods and how to prevent each one. INCIBE also has a guide on compromised business email fraud (in Spanish).