An invoice that checks out? Five quick checks before you transfer

An invoice that looks completely legitimate — but with a faked account number. Five checks to do before you hit transfer, plus two tools that make it quick.

You get an email from a supplier: "Please find attached the invoice for July." Attachment opens fine, the PDF looks clean, the amount is roughly what you expected. You transfer the money. Done.

Except the attachment was a forged invoice. The real company exists, the email looked legitimate, but the IBAN in the PDF belonged to a fraudster. This kind of invoice fraud is on the rise — and the nasty part is that the email often doesn't even get caught by your spam filter, because the domain looks legitimate or has genuinely been hijacked.

Below is a short, practical checklist you can run through before clicking "approve" or "transfer". No accounting lecture — just four minutes of attention.

1. Does the IBAN match what you paid before?

The simplest check, and immediately the most effective. Look up the company name in your banking environment or accounting software and see which account number you paid last time. Same? Great. Different? Then you want to know why.

Watch out: fraudsters sometimes change only one or two digits in the IBAN, making it look correct at first glance. Compare digit by digit, or use copy-paste from an old invoice.

2. Does the IBAN match the company name?

An IBAN is built according to fixed rules. You can check whether an IBAN is valid (correctly formatted) and which bank it belongs to. If the invoice comes from a Dutch company but the IBAN starts with, say, HU (Hungary) or LT (Lithuania), that's a reason to pick up the phone. Not automatically wrong — some companies bank abroad — but definitely worth a double-check.

With our IBAN check you can instantly see whether an IBAN is valid and which bank it belongs to. A handy first filter.

3. Do the company registration and VAT numbers check out?

Every business invoice should include a company registration number and (for VAT-registered suppliers) a VAT number. If they're missing, that's already a red flag. If they are there, you can verify them:

• The company registration number can be checked for free via the public trade register of the Chamber of Commerce.
• The VAT number can be verified using our VAT check. It queries VIES (the European system) and shows whether the number is active and whose name it's registered under.

If the name on the VAT number doesn't match the sender of the invoice: be careful.

4. Who actually sent the email?

Don't just look at the display name in your email — look at the full email address. "Jan van Bakker Groothandel <j.vanbakker@bakker-groothandel-nl.com>" looks familiar, until you notice that the real domain is bakkergroothandel.nl — no hyphen, no .com.

Still unsure? Call the company using a phone number you look up yourself (not the number in the email or on the invoice). Ask whether they actually sent that invoice and whether the IBAN is correct. Two minutes of effort, hundreds of euros of protection.

5. Were you actually expecting this invoice?

The most important question — and the easiest one to skip. Fraudsters love sending invoices for "domain registration", "listing in a business directory", "SEO subscription", or "website maintenance". Vague enough that you think: oh right, that must be from something we signed up for.

If you're not sure: set the invoice aside and ask internally whether anyone ordered that service. No answer? Then the invoice is probably fake.

Red flags at a glance

• Different IBAN from last time, with no prior notice.
• Foreign IBAN from what appears to be a Dutch company.
• Vaguely described service ("maintenance", "listing", "renewal").
• Urgency: "please pay within 3 days to avoid interruption".
• Sender domain that subtly differs from the real company domain.
• No company registration or VAT number, or numbers that don't check out.
• Amount just low enough not to raise eyebrows (think €47 or €89).

Make it a small routine

You don't need to scrutinise every single invoice. For familiar suppliers you pay monthly, a quick glance at the IBAN is enough. But for:

• a new supplier,
• a changed account number, or
• an unexpected amount,

run the full check. Five minutes. That's all it takes.

What if something has already gone wrong?

Paid, and only discovered later it was fraud? Call your bank immediately. If the payment hasn't been fully processed yet, it can sometimes be recalled. Also file a report with the police — not because you expect to see your money again, but because repeated reports do lead to investigations.

Also report suspicious invoices to the Fraudehelpdesk. They track patterns and warn other businesses.

Quick summary

Two tools that help you right away:

• IBAN check — is the account number valid and which bank does it belong to?
• VAT check — is this VAT number registered to who you think it is?

Want to embed invoice verification more firmly into your administration, or think your email environment could be better protected against spoofed senders? Take a look at our email security (SPF/DKIM/DMARC). It makes it considerably harder for fraudsters to impersonate your suppliers.