New bank details on an invoice: ask first, then transfer

The invoice arrives as usual, only this time another IBAN is on it, together with the line that the account has changed. Behind it there can be a hijacked mailbox or a fraudster posing as a supplier, tradesperson or landlord. Since 9 October 2025 your bank has compared name and IBAN before you transfer. That helps with typing errors. If the account belongs to the fraudster and the name fits, the check stays silent.

What the scheme looks like

The German Federal Criminal Police Office (BKA) describes invoice fraud like this: someone contacts you on behalf of a supplier, service provider or lender and asks you to change the bank details for future invoices. The fraudsters control the new account. According to the BKA, this uses telephone, letter, email or a combination. For private individuals it often looks like this: the tradesperson’s invoice arrives by email, shortly afterwards a second email follows with a different account number.

What Verification of Payee checks

Verification of Payee compares the name you enter with the name the payee’s bank holds for the IBAN. Under EU Regulation 2024/886 it must take place before you can authorise the transfer. In euro-area states this has applied since 9 October 2025. According to BaFin, the German financial supervisor, the obligation covers instant and regular euro transfers from current account to current account. Direct debits and savings or loan accounts are excluded, and existing standing orders continue without a check.

BaFin describes three outcomes, and the consumer advice centre names a failed check as a fourth. How your bank displays them can differ.

• Match. Name and IBAN belong together. That only says the account is in this name.
• Close match. The bank shows you the registered name. Compare it with the first invoice and the firm’s legal notice before you correct it.
• No match. The bank warns of a transfer to the wrong payee. According to the consumer advice centre, you must on no account release it and should clear up the mismatch through an official channel.
• Verification not possible. No clear statement can be made. Here too the consumer advice centre advises against paying without asking the payee.

BaFin recommends taking the payee name from the invoice. That applies to the genuine invoice, not the altered one. The consumer advice centre notes that the check makes invoice fraud with manipulated account details harder but does not cover phishing and taken-over accounts.

What it does not do

The Bundesbank writes (our translation): “The check can only identify discrepancies between IBAN and name. Nevertheless, a payment request can always be fraudulent as a whole.” It also does not replace your own care. Four gaps matter for this scenario:

• The account belongs to the fraudster. If the fraudster names a person in the email and the account is held in that name, the bank reports a match although the money goes astray. A plausible-sounding name is enough for that.
• Money mule accounts. According to German police crime prevention, money mules are recruited through job offers so that their account serves other people’s payments. The money is passed on, often abroad. Name and account fit, and the holder may not know what they are lending it for.
• Hijacked mailbox. The email can come from the genuine sender because someone controls their mailbox. A comparison of name and IBAN says nothing about that.
• Payments without a check. Existing standing orders, direct debits and accounts outside the rule run without this check.

Before you transfer: step by step

1. Compare the IBAN.

   Does it match the number on the first invoice or earlier payments? Also look at the country code at the start. A German firm with a foreign IBAN is a reason to ask.

2. Call, but not on the number in the email.

   The BKA advises using contact details from earlier correspondence rather than those in the message asking for the change. Have the IBAN confirmed on the phone.

3. Have the email checked.

   The email check lets you examine the invoice email. More on forged senders is in the guide Recognising and reporting phishing emails.

4. Check the IBAN.

   The IBAN check recalculates the check digits and shows whether there are reviewed fraud reports for the number. It names no account holder. A result without a report is no guarantee.

5. Read your bank’s result.

   With a match the call is still needed. With a close match you compare the name, with no match or no verification you do not release.

If the money has already gone

Under the EU regulation, an instant transfer must be available to the payee within ten seconds, and the Bundesbank speaks of ten seconds at most as a rule. Under section 675p of the German Civil Code, a payment order can in principle no longer be revoked once it has reached the bank. As of 3 August 2026 the consumer advice centre notes that a quick call usually no longer helps because of real-time booking. Try it anyway.

You file the report with your state’s online police station, listed under Where to report it. The BKA advises always involving the police in cases of attempted fraud, even without a loss. What the bank can try, and what you do yourself first, is under Already paid?.

Who pays if it goes wrong

A case from Koblenz shows the direction. A hacker had taken over a fence builder’s mailbox and gave the customer a new account number. On 26 March 2025 (8 O 271/22) the Koblenz Regional Court ruled that the tradesman can still claim his fee, because payment into the foreign account did not discharge his claim. According to Legal Tribune Online, the court considered a simple query appropriate. The tradesman received 8,250 of 11,000 euros because the customer had a counterclaim over the poorly secured mailbox. That was a single case and is not legal advice.

Against your own bank, section 675y of the German Civil Code in our understanding usually does not help. The provision covers defective execution of an order. Where the unique identifier is wrong, the bank is not liable, but it must try to recover the amount and, on request, give you the available information for your claim. If you entered the IBAN deliberately as it stood in the email, you gave the order yourself. A consumer advice centre or a lawyer can assess your case.

Fraudsters also name an account for prepayment when you buy online. How the name check applies there is covered in the article Verification of Payee and fake shops from our sister service fakeshop.ai.