In these times - and especially during the holidays, - there is an increase in the number of cases of phishing, invoice and CEO fraud. What exactly are they about and what can you do? First of all, watch out and double-check, preferably in pairs. So, double check or otherwise you'll pay twice. Isabel is also working on solutions to combat these types of fraud even further.
AI Invoice fraud
Police services are warning about a new form of cybercrime: AI-driven Business Invoice Swappers (BIS).
Criminals gain access to business mailboxes and alter invoices before the beneficiary even opens them. They change account numbers and payment references on legitimate invoices.
As a result, payments are transferred to fraudsters’ accounts, even though the invoice appears authentic.
In Belgium, most invoices are now processed via Peppol, but this does not yet apply to all invoices. So far, no cases of this type of fraud have been reported among Isabel clients, but vigilance remains important at all times.
How can you protect yourself?
Use a unique and strong password for every mailbox.
Be aware that invoices can be altered automatically and without visible traces through malware or unauthorised access to a mailbox.
-
For every payment, check the IBAN-name verification and also confirm that the supplier’s name matches a trusted counterparty. If the beneficiary’s name does not match the account number, do not proceed with the payment and contact the supplier via a known phone number.
Isabel offers its partners specific solutions for beneficiary screening and invoice screening. Contact your IT or security partner to explore what is possible to add extra protection.
What is invoice fraud?
Fraudsters send a false invoice by e-mail that is identical to the invoice sent by your supplier. You think you are paying your supplier but in reality you are transferring money to an account number belonging to the fraudsters.
-
So always pay close attention to the account number of your supplier. Is it suddenly a new account number? Then an alarm bell should go off. A Belgian supplier who suddenly asks you to transfer to a new account number abroad, for example, should arouse suspicion. Also compare the account number on the invoice with that on the original order form.
-
The fake invoice you receive often also contains fake telephone numbers. If you call the phone number on the fake invoice to ask whether they really have a new account number, the fraudster on the line will answer in the affirmative and that you may make the payment into the new number. Always call your supplier with the number from your database to double check.
-
Also pay attention to the details in the sender's e-mail address, as you sometimes can ascertain that it is a fake invoice in that way too (different spelling, .com instead of .be).
What is CEO fraud?
A fraudster pretends to be your CEO, an auditor or other financial expert and usually asks by e-mail or sometimes by phone to have money transferred to an account number very urgently. The accounting employee makes the payment and then the money disappears into thin air via mules to the fraudsters.
-
Make sure everyone in the accounts department is aware that this type of fraud can occur.
-
Also, always check the sender's email address to make sure you don't see anything odd there. There are bound to be urgent payments which some people will consent to make under time pressure.
-
Double check with another colleague and verify that the request was actually made. By way of a best practice, we recommend signing in pairs in Isabel 6.
What is phishing?
Criminals pretend to be a trustworthy sender by e-mail and try to obtain sensitive financial information or even your username and password that way.
-
Be alert when you receive e-mails: Does the e-mail come unexpectedly or do you know the sender in question? Never just open attachments, never just click on a link and be suspicious if the e-mail tells you that urgent action is needed.
-
Also check the sender of the mail. Is this address correct? Spelling mistakes can also indicate suspicious e-mails, but phishing mails are becoming more and more correct in this respect.
-
Isabel Group will never ask you for your password, neither by e-mail nor by phone!
What to do when suspecting a suspicious Isabel e-mail?
Do not click on any links
If you suspect fraud, call the Isabel Group helpdesk on +32 02 404 03 37 (on working days from 8 AM to 6 PM)
Always use the trusted channels
Monitor your payment traffic extra closely in the coming days after the phishing mail and be alert for suspicious phone calls or new suspicious e-mails
Forward the phishing mail to Safeonweb: suspicious@safeonweb.be