Fake invoices and bank account change emails: how to check

How does bank account change fraud work?

Bank account change fraud (BEC, business email compromise) means impersonating a supplier, a CEO or a vendor in company email so that a payment lands in the criminal's account. The email looks like normal correspondence: 'we have changed banks, please pay to the new account', sometimes with a corrected invoice attached.

Scammers work in two ways. Either they take over the supplier's real mailbox and write from it, inside an existing thread. Or they register a domain that differs by one letter and join the conversation from an 'almost identical' address.

The scale is large. According to the FBI IC3 report for 2025, 24,768 BEC complaints were filed with that centre (mostly from the US), with reported losses of over 3.04 billion dollars. There is no comparable public figure for Poland, so it is not known how much Polish companies lose this way.

How to spot a fake invoice

Signals that should stop you:

1. A new account number, especially at a foreign bank or a personal account instead of a business one.

2. Urgency and secrecy: 'urgent, today by 3 pm', 'please do not call, I am in a meeting'.

3. A sender address slightly different from the usual one, or a different reply-to address. We explain the step-by-step check in how to check if an email is real.

4. An invoice from a company you never worked with, or for a service you never ordered.

5. A link to 'download the invoice' instead of an attachment, or a request to log in to see it.

You can check the sender's domain for free in domain or email mode: its age, similarity to a known domain, the CERT Polska warning list and SPF and DMARC settings.

How to verify a bank account change: a routine for your company

Write this routine down and use it every time, including with 'trusted' suppliers:

1. Call the supplier on the number from a previous invoice, the contract or your accounting system. Never on a number from the email announcing the change, and never by hitting 'reply'.

2. Ask someone you know whether the change is real and have them read the new account number out loud. Compare it digit by digit.

3. In Poland, check the new account on the VAT taxpayer register, known as the white list (a Ministry of Finance search tool). You can search by tax ID or by account number and see whether the account is assigned to your supplier's tax ID.

4. Have a second person approve the change in the supplier record. One person enters it, the other confirms after the call.

5. Note who spoke to whom and when. In a dispute with the bank or the supplier, that note is evidence.

Agree the rule with suppliers in advance, ideally in the contract: an account change never arrives by email alone and always needs phone confirmation. When a scammer writes 'urgent, no calls', your accounts team already has an answer and does not have to judge anything under pressure.

The white list also matters for tax. Since 2020, payment for a transaction over 15,000 PLN with an active VAT payer should go to an account on the register. Paying another account means you cannot count the payment as a tax-deductible cost and you become jointly liable for the supplier's VAT. You can avoid this by filing a ZAW-NR notice with the tax office within 7 days of ordering the transfer.

Fake invoices in KSeF: does KSeF protect you from fraud?

Poland's National e-Invoicing System (KSeF) has been mandatory since 1 February 2026 for companies whose 2024 sales (including VAT) exceeded 200 million PLN, and since 1 April 2026 for everyone else. The smallest taxpayers (invoiced sales up to 10,000 PLN a month) may issue invoices outside KSeF until the end of 2026, and from 1 January 2027 the obligation covers everyone. All businesses have had to receive KSeF invoices since February 2026.

KSeF does not protect you from a fake invoice. An invoice reaches the buyer automatically by tax ID and counts as received when KSeF assigns it a number, without the buyer's approval. Asked how an accountant can know an invoice is not a fake, the Ministry of Finance answers that KSeF does not change the existing verification rules and that the taxpayer should follow incoming invoices on an ongoing basis.

Since 24 April 2026 the KSeF 2.0 Taxpayer Application has had a 'Report abuse' function for so-called scam invoices. You select the invoice on the list, give a reason and justification, confirm and submit. The Ministry does not say whether a reported invoice is removed from the system. Questions go to the tax administration helpline at +48 22 330 03 30.

KSeF does help in one way: if your supplier issues invoices in KSeF, compare the account number on the invoice in the system with the one in the email. A PDF attachment may have been swapped, while a KSeF invoice never passed through a mailbox. Also watch out for 'you have a new invoice in KSeF' emails with a link: log in to the system yourself, not from a message.

The transfer has already gone. What now?

Time matters. Do this in order:

1. Call your bank straight away, using the number on your card or on the site you typed in yourself. Say it is a transfer obtained by fraud, and ask them to try to stop or recall it and to contact the recipient's bank. Poland's Central Cybercrime Bureau recommends urgent contact with the bank as the first step. There is no guarantee the money will come back.

2. Report the crime at any police station. Bring the emails with full headers, the invoice, the transfer confirmation and the recipient's account number.

3. Report the incident to CERT Polska at incydent.cert.pl.

4. Tell the supplier through a channel other than email. Their mailbox may have been taken over, and the scammers may be writing to their other customers.

5. Check your own email: change passwords, turn on two-step login and review mail forwarding rules. If you paid over 15,000 PLN to an account not on the white list, file ZAW-NR within 7 days.

Fake invoice: where to report it

You report a scam invoice in KSeF in the KSeF 2.0 Taxpayer Application with 'Report abuse'. You report an email with a fake invoice to CERT Polska (incydent.cert.pl), and if you lost money, also to the police.

If people in your company paste invoices and supplier data into AI tools to 'check' them, set rules first. See whether you can paste data into ChatGPT and the template for an AI use policy for companies.