The invoice looks like every other one. Logo, address, invoice number and amount are correct. Only the IBAN is different. Sometimes there is a line: "Please note our new bank details." Whoever pays now may be transferring money to fraudsters, while the real supplier keeps waiting.
This article explains how this fraud works in Switzerland, what to look for, and which simple rules protect your business.
How the changed-bank-details fraud works
The Swiss National Cyber Security Centre (NCSC, now the Federal Office for Cybersecurity, BACS) describes the method as Business E-Mail Compromise: attackers gain access to a business email account, usually at the supplier. There they find real invoices and real customer contacts. They then resend invoices that were already issued, with a changed IBAN, or announce that future payments should go to a different account.
The email comes from the real sender or from an address that differs by a single letter. The document is the original with one change. Looking for spelling mistakes or poor graphics does not help.
A related form is CEO fraud: a supposed message from management demands an urgent, confidential transfer. According to the NCSC, CEO fraud remains one of the most frequently reported fraud methods among Swiss SMEs (NCSC weekly review, January 2026).
Warning signs on the invoice and in the email
- New IBAN at a supplier you have been paying for some time.
- Note about a change of account in the email text or as a stamp on the invoice.
- IBAN from a different country or bank than before, for the same Swiss supplier.
- Time pressure: "by tonight", "otherwise deliveries stop".
- Request for confidentiality or to bypass the usual approval.
- Different sender address or a reply-to address that does not match the supplier's domain.
- QR-bill payment part that does not match the letterhead: the payee stored in the Swiss QR Code is not the supplier. On the QR-bill, the data in the code is also printed in plain text. Compare the two.
A formally valid IBAN says nothing about the payee. Swiss IBANs have 21 characters and a check digit; fraudsters use real accounts, so the check digit is always correct.
The most important rule: call back on a known channel
For payment requests and changes to master data, the NCSC recommends verification over a second channel: call the supplier on the number you already know, not the number in the email or on the new invoice. Ask specifically: "Have you changed your bank account? What is the new IBAN?" Have the IBAN read out and compare.
Replying by email to the same message is not verification. If the supplier's mailbox is compromised, the attackers reply.
The NCSC advises SMEs to build technical and organisational hurdles:
- Four-eyes principle for payments and for every change to supplier master data, such as a new IBAN.
- No exceptions, not even for instructions "from the top". CEO fraud relies on employees breaking the rule because the boss supposedly demands it.
- Keep master-data changes separate from payment. Whoever changes an IBAN should not be able to release the payment at the same time.
- Keep a history. A list of known IBANs per supplier makes deviations visible.
What to do if the payment has already gone out
- Call the bank immediately. According to the NCSC, the payment can sometimes still be stopped. Every hour counts.
- Inform the supplier so they can have their email account checked and warn other customers.
- File a police report with the cantonal police and report the incident to the NCSC.
- Change passwords and have your own IT checked if it is unclear whether your own account is affected.
The obligation to pay the real supplier usually remains. Prevention is therefore cheaper than any recovery attempt.
Checklist before paying
- Does the IBAN match earlier invoices from the same supplier?
- If not: callback on a known number done and documented?
- Payee in the QR payment part identical to the letterhead?
- Payment and master data change approved by two people?
- No payment under time pressure or with a request for confidentiality?
Detecting IBAN changes automatically
For every uploaded invoice, Klyrenta compares the IBAN with earlier invoices from the same supplier in your account. If it differs, a warning appears with the advice to call the supplier on a known number. It also checks the IBAN check digit, the UID format, duplicates, VAT rates and amounts. Each invoice receives OK, Warning or Error with a reason; results can be exported to Excel.
Klyrenta pays nothing and books nothing. The decision stays with you. Data is hosted in Switzerland at Infomaniak, files are deleted after 90 days.
10 invoices are free. More about invoice review for SMEs. Related: Detecting duplicate invoices.
Checked against the official sources named in the text.