Guide · Payments
Wrong IBAN on an invoice: what now?
You have paid to fake bank details. Now time matters. Call your bank first, everything else comes after.
The steps, in this order
Call your bank right away
By phone, not by email or e-banking message. Ask the bank to recall the payment. Have the date, amount and recipient IBAN ready.
File a criminal complaint
With your cantonal police. Bring the email as a file, not only printed, plus the invoice and the payment record. Keep copies, your bank and insurer may ask for them.
Tell the supplier, on a known number
Not by replying to the email. Their mailbox may have been taken over without them knowing. Then other customers may be affected too.
Report to the NCSC
The Swiss Federal Office for Cybersecurity accepts reports through an online form. A report does not replace a criminal complaint.[2]
Inform your insurer
If you have cyber insurance. Notice periods and cover are in your policy.
Have your own mailbox checked
If the invoice came as a reply in an existing email thread, your own mailbox may be affected too. Ask your IT provider to look for unknown sign-ins and forwarding rules, and change the passwords.
What the bank can do, and what it cannot
- The bank can ask the recipient bank to return the money. Whether that works depends on whether the money is still in the recipient account.
- A recall is a request, not a guarantee. The bank executed the payment as you instructed it.
- The sooner you call, the better the chances. Do not wait for the supplier to get in touch.
Getting the money back: what is realistic
Two routes lead to the money: the recall through your bank, and criminal proceedings, in which the authorities can have accounts frozen. Both work best while the money is still in the recipient account.
Whether you have to pay the real invoice again, and who bears the loss, depends on the individual case. This page is not legal advice. Clarify it with a professional before you agree on a solution with the supplier.
So it does not happen again
It is not an isolated case: in 2025 the NCSC received 132 reports of manipulated invoices and 970 of CEO fraud.[1]
The key rule: new bank details are entered only after a call-back on a known number, and a second person approves them.
The seven signs of a fake invoice: How to spot a fake invoice
Frequently asked questions
What do I do if I paid to a wrong IBAN?
Call your bank right away and ask for the payment to be recalled. Then file a criminal complaint with your cantonal police, tell the supplier on a known number and report the case to the NCSC.
Can I get the money back?
Your bank can ask the recipient bank to return it, and accounts can be frozen in criminal proceedings. Both work best while the money is still in the recipient account. There is no guarantee.
Do I have to pay the invoice again?
It depends on the individual case. Clarify it with a professional before you agree on a solution with the supplier.
Where do I report the fraud?
With a criminal complaint to your cantonal police. Additionally to the Swiss Federal Office for Cybersecurity (NCSC) through its online form; the report does not replace a complaint.
General information, not legal advice. As of November 2026.
Where Protime helps
New · rolling outSince October 2026 Payment Guard has been running in a learning phase and shows nothing yet. Protime turns on the alerts after this learning phase.
Protime works inside your mailbox, in Outlook or Gmail, and knows your senders. Today the reply draft already warns when an email announces new bank details: call back on the known number.
Payment Guard also looks for bank details, a payment instruction or a reply-to address that does not fit this sender’s usual pattern.
Protime does not stop any payment. You make the call and the decision.