Short answer
In invoice fraud, bank details are falsified; in CEO fraud, criminals pose as management and demand urgent transfers. The most effective protection is a fixed process: changed bank details and unusual payments are always confirmed via a known phone number.
Step by step
- 01
Introduce a call-back rule
Every change of bank details is confirmed by phone via a number you already know – never via contact details from the message itself.
- 02
Four-eyes principle
Transfers above a set amount or to new recipients require a second approval.
- 03
Train people on warning signs
Time pressure, secrecy (“Don't talk to anyone about this”), unusual channels and deviations from the normal process are typical signs.
- 04
Secure email accounts
Many cases start with a compromised mailbox. MFA for all accounts and checking for suspicious forwarding rules reduce the risk.
- 05
If in doubt, call the bank immediately
If money has already been transferred, contact your bank straight away – a quick response improves the chance of recalling the payment. Report it to the police.
Checklist
- Written call-back process for bank detail changes
- Four-eyes approval for larger or new payments
- List of verified phone numbers for key suppliers
- MFA for all email accounts
- Staff know the warning signs
- Bank emergency number at hand
Common mistakes
- Replying to the email or calling the number it gives to confirm.
- Skipping processes because of a supposed instruction from management.
- Losing time after a mistaken transfer before informing the bank.
- Applying the process only to large amounts – smaller amounts are targeted too.
Frequently asked questions
Can I get a transfer back?
Sometimes, if the bank is informed very quickly. There is no guarantee, so contact your bank immediately.
Are small businesses affected too?
Yes. Freelancers and small businesses often have fewer formal processes, which criminals deliberately exploit.
What about fake calls or voice messages?
Voices can be imitated with AI. Don't rely on the voice – rely on the agreed call-back process.
Is invoice fraud covered by cyber insurance?
That depends on the plan. Some policies include so-called social engineering losses or offer them as an option; limits and conditions are set out in the terms.
Sources
- Alliance for Cyber Security (BSI)
- German police crime prevention – polizei-beratung.de
- Federal Office for Information Security (BSI)
Checked on 6 Oct 2026.