Thursday, 4:40 pm. At an earthworks company in western Lausanne, the bookkeeper opens an email from the concrete plant the company has worked with for eight years. Same signature, same month-end invoice, with one extra sentence: following a change of bank, please use the new details.
The amount is right to the cent. So is the reference. The payment goes out on Friday with the others. Three weeks later, the concrete plant sends a reminder for an unpaid invoice of CHF 38,600.
This story is a composite, but it matches what the Federal Office for Cybersecurity (FOCS) describes almost line for line. Invoice manipulation is among the frauds it sees most often in reports from companies. And construction ticks nearly every box a fraudster looks for.
Why construction attracts this kind of fraud
A construction company pays a lot of people, often, and for amounts that surprise nobody. The concrete plant, the gravel pit, the machine rental firm, the rebar supplier, the subcontractors who change from one site to the next. A forty-thousand-franc invoice does not raise an eyebrow at the office. It is an ordinary Tuesday.
The office, as it happens, is small. Two or three people handle the accounts, payroll, tenders and the phone while the rest of the team is out on site. Payments go out in batches once or twice a month, and the same person often enters and approves them. Add suppliers who have settled everything by email for years, and you have exactly the ground a fraudster wants.
How the fraudster gets hold of the right invoice
Nobody guesses the amount of a concrete invoice. To send a convincing fake, you have to have read the real ones. So the most common scenario starts well before the fake email, with a stolen password.
A fake Microsoft 365 login page, a password reused on another website, and a mailbox falls. Sometimes it belongs to the supplier, sometimes to you. The fraudster breaks nothing. He reads, for weeks, and often sets up a quiet rule that diverts or hides certain replies. He learns who pays what, when, and how everyone signs off.
The QR-bill is no obstacle. A QR-bill is a PDF and a code generated from a handful of fields. Take the real invoice, replace the IBAN, regenerate the code. The result scans without a hitch in your e-banking, and nothing on screen gives the change away.
The details that give the fake away
When the fraudster writes from an address that looks like the supplier's, a few clues are visible, provided you know where to look.
There is a problem with this list, and it is better said plainly: if the supplier's own mailbox has been hacked, the first two clues vanish. The email comes from the real address, with the real conversation history underneath. What remains is the urgency and the changed IBAN, and that is about it. Which is why the defence that works is not found in the email.
The rule that almost does the job: call back
Any change of bank details gets checked by phone, with someone you know, on a number you had before the message arrived. The one in the contract or on an old invoice, never the one in the email announcing the change.
The call takes two minutes. It works even when the fraudster writes from the real address with the real invoice. To turn it into a reflex rather than a good intention, write the rule down, note each time who called whom and when, and require a second signature for any first payment to a new IBAN above an amount you set.
Ask your bank, too, what it offers for new payees. Depending on the bank, a first payment to an unknown account can trigger an extra confirmation or an alert.
On the IT side, what closes the door
The call-back protects your payments. Your mailbox is still exposed, and if it is the one that falls, your clients will be the ones receiving a fake IBAN signed with your name tomorrow. Four settings cut that risk sharply:
- two-factor authentication on every company mailbox, including the ones only ever read on a site phone;
- an alert whenever a forwarding or hiding rule is created, and a block on automatic forwarding to outside addresses;
- a clearly visible tag on emails from outside the company, so that a look-alike domain jumps out;
- correct SPF, DKIM and DMARC records on your domain, so nobody can easily send email pretending to be you.
None of these settings means changing tools. In Microsoft 365 as at Infomaniak, they take about half a day to configure for an SME, as long as you know where they hide.
If the transfer has already gone
The first hours matter more than anything else. Call your bank immediately and ask for the payment to be recalled. Warn the supplier by phone, since their mailbox may be compromised. File a complaint with the cantonal police and report the case to the FOCS, which cross-checks reports and can warn other victims.
Only then look at your own side: change the passwords used by accounts, check the forwarding rules on every mailbox, turn on two-factor authentication wherever it is missing. If the fraudster read your email for weeks, he also knows your clients.
Checking that no forwarding rule is lying around and that every mailbox has two-factor authentication is among the first things I look at during a Flash Diagnostic. And if you run a construction company, the page on IT for construction companies explains how we handle the rest, from the office to the job site.
Frequently asked questions
Can my bank get the money back?
Sometimes, if you call very quickly and the funds have not yet left the receiving account. After a few days the odds get slim: the money is usually moved on as soon as it arrives. Since you gave the payment order yourself, do not count on an automatic refund.
The supplier was hacked, not us. Who pays?
That is a legal question, and the answer depends on the case: who was compromised, what checks were made, what your terms of business say. Talk to your insurer and a lawyer. In practice, the company that paid the wrong account often ends up paying a second time.
Does cyber insurance cover this kind of fraud?
Some policies cover payment fraud, others exclude it in writing or cap it very low. Look for terms such as “CEO fraud”, “invoice manipulation” or “social engineering” in your policy, and ask your broker before you need it.
Can I check an IBAN online?
An online checker only confirms that the number is well formed. It says nothing about who holds the account. A fraudulent IBAN is perfectly valid. The only useful check is still a call to the supplier, on a number you already had.
Written by
David Cunha
Founder · Technical director, AlpenData
A computer engineer with over 10 years of experience managing systems, networks and infrastructure, David helps Swiss SMEs with their IT, security and compliance.
More about AlpenData →