A regular supplier writes to say they have switched banks, and attaches an invoice with the new account number. Same signature, same email thread. Your bookkeeper updates the vendor record and the payment goes out. A few weeks later a reminder arrives from the real supplier, who never got paid.
In 2024 the FPS Economy received 215 reports of invoice fraud, with declared losses of more than €3.3 million.
The fraudster does not need to get into your systems. Febelfin describes invoices stolen from the post and doctored, and more and more cases where criminals get into the supplier’s IT and intercept its invoice emails. The fake message can then come from the supplier’s genuine address. The Centre for Cybersecurity Belgium (CCB) has also observed that fraudsters try their luck more during the holidays, when a stand-in knows the procedures less well, and Safeonweb adds Friday evenings and the eve of public holidays.
Call back on a number you already had
Any change of bank details gets confirmed by phone, on a number you had before the email arrived: the vendor record, an old purchase order, the contract, the supplier’s official website. Never the number in the message or on the new invoice. The FPS Economy points out that it can be forged too. If you reply in writing, Safeonweb suggests using Forward to the address you know rather than hitting Reply.
Ask for someone you actually know, and have them read the new IBAN out to you. Then note the date, the person’s name and the number you called in the vendor record. Treat the first invoice from a new supplier the same way.
Two people for every new IBAN
The CCB recommends that any change to your internal list of payee accounts is approved higher up, and that payments above a set amount need more than one signature. In a fifteen-person company, that means the bookkeeper enters the change and the manager approves it after the call. Ask your bank, too, whether your business banking contract can require a second signature above an amount you set.
CEO fraud is handled by the same habit. Someone posing as the boss asks for an urgent, confidential transfer. Safeonweb lists the warning signs, including urgency, secrecy, an unfamiliar account and the Friday-evening request. Tell your team plainly that you will never ask them to skip the procedure.
Put the rule on a single sheet next to the accounts desk. It matters most when the usual person is on leave.
In Odoo, a bank account has to be approved
The FPS Economy advises linking account numbers to suppliers in your accounting software. Odoo 17 and 18 add a lock on top. Every new contact bank account starts out as “Untrusted”, and according to Odoo’s documentation, outgoing transfers to it stay blocked until someone marks it “Trusted” with the “Send Money” toggle. Only users with the “Validate bank account” right can do that; out of the box, that is the administrator. Once an account is trusted, its number cannot be edited without first setting it back to untrusted, and every change is logged on the record.
The split I recommend: the bookkeeper creates or edits the account, the manager alone holds the validation right and only uses it after the call. The two-person rule is then enforced by the software instead of relying on anyone’s memory.
One limit: Odoo only blocks payments prepared in Odoo, typically a SEPA transfer file. A transfer typed straight into the bank’s app never passes through it.
Your bank’s name check
Since 9 October 2025, EU Regulation 2024/886 has required banks in the euro area to check, before you confirm a euro transfer, that the IBAN matches the payee name you typed. It is free. The bank tells you whether the name matches, nearly matches, does not match, or could not be checked. If the payee is a company with a Belgian account, the bank shows its registered name when there is a mismatch, and sixteen Belgian banks also flag when the account belongs to a private individual.
So type the supplier’s legal name as it appears in the Crossroads Bank for Enterprises, not the nickname everyone uses in the office. A warning on a supplier payment means you stop and pick up the phone. Febelfin is explicit: after the warning, the decision is yours, and so is the responsibility for the transfer.
Two details. For batch transfers sent as a file, a business can opt out of the check, so if you upload a SEPA file exported from Odoo, ask your bank whether the check is switched on for your files. And the check only tells you whether this name belongs to this account. It says nothing about whether your supplier actually asked for the change, so you still make the call.
If the money has gone: the first hour
- Phone your bank straight away on its fraud line. According to Febelfin they answer around the clock; the numbers are on your bank’s website, Febelfin’s and Card Stop’s. Your bank will ask the fraudster’s bank to return the money, and that bank will try to block the transfer or the account. Nothing is guaranteed, which is why speed matters.
- Warn the real supplier on the number you know. If their mailbox has been compromised, other customers may be getting the same email.
- Keep the original email, the invoice and the bank statement, and write a short timeline. That is what the police will ask for.
- File a complaint at your local police station. The federal police prefer this to Police on Web, so that the first steps can be taken quickly.
- Report it to the FPS Economy’s reporting platform for businesses (pointdecontact.belgique.be), and forward the fraudulent email to suspicious@safeonweb.be. If it was your own mailbox that was hacked, report the incident to the CCB at notif.safeonweb.be, change the passwords and turn on two-factor authentication, as covered in the article on backups, accounts and updates.
For this week: one sheet of procedure, the Odoo validation right given to the right person, and your bank’s fraud number written down next to the phone. If you would like us to go through the access rights and payment flow in your Odoo with you: info@z80.be, +32 494 111 041.