Fraud type · Phishing and invoice fraud

Fake emails, invoices and bank details: the forgeries behind almost every fraud

Whether it is a clone, a fake haulier or cargo theft: it almost always starts with an email that is not quite real. Spot that, and you stop most fraud at the door.

SafetyBizz Knowledge base · updated 16 October 2026 · 7 min read

The four forgeries you need to know

1. The look-alike domain

The sender looks right, but the domain differs by a fraction: an extra letter, two letters swapped, .com instead of .nl, or an added hyphen. On a phone you hardly see it. Always read the domain after the @ letter by letter.

2. The hacked mailbox

Even more dangerous: the email really comes from the right address, because your partner's mailbox was hacked. The fraudster has been reading along for weeks and at the right moment sends a message in an existing thread, usually about a payment or a route change.

3. “Our bank details have changed”

An invoice or email with new bank details and a plausible reason: an audit, a new bank, a takeover. The new account is in someone else's name or at a bank in another country. This is one of the costliest fraud types, precisely because it targets existing relationships.

4. The edited invoice or forged document

Invoices, CMRs, B/Ls, insurance certificates and register extracts are forged or altered. Often the original is genuine and only the bank account, amount or address was changed. Small differences in font, alignment or logo are a sign.

How to protect yourself

The best protection is a fixed procedure everyone in your company follows, even under time pressure. Technology helps too: two-factor authentication on all mail accounts, a properly configured own domain (so others can't easily impersonate you) and a name-and-account check before paying a new payee.

10 red flags

• The domain after the @ differs by one letter,or a free address while the company has its own domain.
• New bank details,especially in another country or another name.
• Urgency and secrecy:“pay today”, “don't call, we're in a meeting”.
• A different tone or signaturefrom what you're used to from this contact.
• An attachment or link you must opento “view” an invoice or document.
• The reply-to address differs from the senderwhen you hit reply.
• The invoice looks slightly differentfrom earlier invoices of the same supplier.
• A change in the middle of an ongoing threadabout payment, address or route.
• The domain was registered recentlywhile the company has existed for years.
• The request comes outside office hoursor just before a weekend or holiday.

One red flag is not proof. If you see two or more, stop and check further first.

Checklist: before you pay or change anything

1. Read the email domain letter by letter and compare it with earlier emails and the official website.
2. Call back every change of bank account on a number you looked up yourself, never the one in the email.
3. Check the account is in the company's name before paying a new payee.
4. Compare the invoice with earlier ones: logo, font, address, VAT number and bank account.
5. Don't open unexpected attachments or links and have suspicious files checked first.
6. Use four eyes for new payees and changed bank details.
7. Enable two-factor authentication on all mail accounts and ask your partners to do the same.

What to do if it goes wrong

• Call your bank immediately and ask them to recall the payment. The faster, the better the chance.
• Report it to the police and keep the emails with full headers.
• Warn your business partner: if their mailbox is hacked, more customers will receive such emails.
• Change your passwords and check whether forwarding rules were set in your own mailbox.

Frequently asked questions

Read also

• Spotting a clone company
• Cargo theft without a break-in
• Spotting a fake carrier

This page is general information and not legal advice.