Updated 13 August 2026
Payment redirection fraud is among the most expensive there is: a supplier announces "new bank details", the transfer goes to the fraudster's account, and nobody notices until the real supplier chases the unpaid invoice weeks later. The attached document is often genuine in every detail but one: the IBAN.
The attack takes three main forms: an email imitating the supplier with a fraudulent bank-details document attached; a genuinely compromised mailbox, from which a perfectly credible message is sent; or an authentic invoice intercepted and re-sent with only the IBAN changed.
In all three cases the attachment is the control point: it is often a real document with a single edited field, and that localised edit is detectable.
An IBAN carries its own checksum: the two digits after the country code are computed from the rest of the number (modulo 97), offline, with no database needed. A hand-edited IBAN — one digit changed to resemble the original — almost always fails this test.
Mind what the test means: a wrong checksum condemns the document, but a valid one does not clear it. Fraudsters open real accounts, with real, perfectly valid IBANs.
The digits at the start of the account portion identify the bank (in a French IBAN, the five digits after the check digits). A document showing one bank's logo while the bank code belongs to another — often an online payment institution — contradicts itself. The BIC, when printed, must name the same institution.
A foreign IBAN for a domestic supplier is not proof of fraud, but it is a signal that alone justifies a phone check.
When the fraudulent document is a genuine invoice or bank-details sheet that was modified, the evidence is the same as in the tampered-invoice guide — concentrated on the IBAN line:
Since late 2025, European banks must check that the beneficiary name matches the IBAN at transfer time (verification of payee). That is an extra net, not a reason to relax: the alert comes when the payment is made, not when the decision is taken.
The golden rule does not change: any change of bank details is confirmed by phone, on a number you already had — never the one in the message announcing the change, nor the one printed on the suspicious document.
Edited amounts, altered dates, swapped bank details: the technical evidence that gives away a tampered invoice PDF, and how to check for it.
Utility, telecom and internet bills used as proof of address: the technical checks that reveal an edited document, and when the checks simply cannot apply.
A PDF keeps a record of its successive saves: incremental revisions, ghost objects, two sets of metadata. Where to look to find out whether a file was edited.
The 2D-Doc barcode on tax notices, pay slips and official certificates: what it contains, what it actually proves, and why it is different from every other check.
Fake pay slips in rental files and loan applications: payroll software fingerprints, arithmetic checks and the French 2D-Doc barcode that expose an edited document.
Analyse a document for free