Guide · Payments

How to spot a fake invoice

Fake invoices usually arrive by email and look genuine. Seven signs help you spot them. The most effective step stays simple: call back on a number you already know.

The seven signs

One sign alone proves nothing. When two come together, say new bank details and time pressure, hold the payment and check.

New bank details

The email announces a new IBAN, or the invoice shows a different one than before. This is the most important sign. Genuine changes happen too, so check every one.

Time pressure

“Today”, “urgent”, “or we send a reminder”. Pressure is meant to stop you from asking. The NCSC names urgent payments abroad as a typical pattern.^[2,3]

Discretion

“I am relying on your discretion”: this is how the NCSC quotes typical fraud emails. Whoever asks for secrecy wants to prevent the call-back.^[2]

Different reply-to address

The displayed sender is right, but replies go to another address. You only see it when you click “Reply” and read the address.

Look-alike domain

One character off: “rn” instead of “m”, “.co” instead of “.ch”, an extra hyphen. The NCSC names such addresses as a tool of fraudsters.^[2]

Invoice only “attached”

The email text is short and only points to a PDF or a download link. Compare the PDF with earlier invoices from the same supplier. Do not open links in unexpected emails.

Unusual sender

A supplier you have never dealt with. A “lawyer” from a well-known firm. The boss writing from a private address. The NCSC explicitly warns about fake lawyers of Swiss law firms.^[2,3]

Before you pay: the call-back

An email filter checks whether the sender is genuine. If the sender’s account has been taken over, the sender is genuine. Then only one thing helps: asking a person, through a second channel.

Call a number you already know
From the contract, an earlier invoice or your address book.
Never the number in the email
Not the one in the signature either. It may belong to the fraudster.
Do not ask by replying
If the mailbox is taken over, the fraudster answers.
Approve bank changes with two people
Enter new bank details only after the call-back, and have a second person confirm them.
Ask internally
Even if the email asks for discretion. A real boss does not mind a question.

From practice

At a family business in Bern, a payment instruction came from the real, compromised account of an internal person – with new bank details and time pressure. Email filters saw nothing, because the sender was genuine.

How common this is

The Swiss Federal Office for Cybersecurity (NCSC) received 970 reports of CEO fraud in 2025, up from 719 the year before.^[1]
132 reports concerned manipulated invoices (2024: 114).^[1]
According to the NCSC, fraudsters research the company website, LinkedIn and the commercial register.^[2]
42 % of Swiss SMEs feel protected against cyberattacks, down from 55 % the year before. Die Mobiliar names invoices manipulated by email as a common method.^[4]

Who is liable when the money is gone?

It depends on the individual case. There is no general rule, and this page is not legal advice.

What matters includes the contract with the supplier, your bank’s terms and who exercised which care. Have the case reviewed by a professional.

Check your insurance. A cyber policy does not always cover fraud by deception (social engineering). At Zurich, for example, it is covered only in the “Optimum” package. Ask your insurer what your policy covers.^[5]

Reporting

To the NCSC through its online reporting form. Every report helps warn others.^[6]
If money has gone: file a criminal complaint with your cantonal police, and call your bank right away.

Already paid? The steps in the right order: Wrong IBAN on an invoice – what to do now

For your own company: SPF, DKIM and DMARC

These three entries in your domain define who may send email in your name. With DMARC “p=reject”, receiving servers reject forged emails using your sender address.

That protects your customers from receiving fake invoices “from you”. Ask your IT provider whether the entries are in place.

Against a real account that has been taken over, SPF, DKIM and DMARC do not help. The email then really comes from the right server. That is what the call-back is for.

Frequently asked questions

How do I spot a fake invoice sent by email?

By seven signs: new bank details, time pressure, a request for discretion, a different reply-to address, a look-alike domain, an invoice only attached or behind a link, an unusual sender. When two come together, hold the payment and call the sender on a number you already know.

What do I do when a supplier announces a new IBAN?

Call the supplier on a number you already know, for example from the contract or an earlier invoice. Never on the number in the email. Enter the new bank details only after the call-back and have a second person approve them.

Who is liable for a fake invoice?

It depends on the individual case, for example on the contract, the bank’s terms and who exercised which care. Have the case reviewed by a professional and ask your insurer: cyber policies do not always cover social engineering.

Where do I report a fake invoice?

To the Swiss Federal Office for Cybersecurity (NCSC) through its online reporting form. If money has gone, call your bank right away and file a criminal complaint with your cantonal police.

General information, not legal advice. As of November 2026.

Where Protime helps

New · rolling outSince October 2026 Payment Guard has been running in a learning phase and shows nothing yet. Protime turns on the alerts after this learning phase.

Protime works inside your mailbox, in Outlook or Gmail, and knows your senders. Today the reply draft already warns when an email announces new bank details, and when the company behind it is bankrupt according to the commercial register.

Payment Guard also looks for bank details, a payment instruction or a reply-to address that does not fit this sender’s usual pattern, and then suggests the call-back.

Protime does not stop any payment. You make the call and the decision.

Book a call Try 14 days free