Phishing email / SMS
Fraudulent messages that appear to come from a legitimate partner and contain a pre-substituted IBAN for payment.
Tips for protecting your business from IBAN substitution fraud
IBAN substitution fraud poses a serious threat to financial security. Businesses and organisations that carry out a large number of banking transactions are particularly vulnerable.
Spoofing email / telephone
Impersonation of a legitimate company or bank by email or telephone, requesting a change to the payee's IBAN.
Account takeover (BEC)
Access to a genuine email account in order to monitor correspondence and send fraudulent payment instructions at just the right moment.
Social engineering
Impersonation of a trusted employee or partner, persuading you to change an IBAN because of a supposed "problem" with the bank account.
Fake invoices
Documents that look identical to genuine ones but contain a substituted IBAN.
Malicious software
Trojans and viruses that swap the IBAN during a transaction.
Organisational safeguards
To protect your business, implement the following organisational practices in your company's workflows:
- Staff training – Conduct regular security training sessions and keep them up to date with the latest threats. Train employees to recognise signs of fraud.
- Dual transaction control – Implement a procedure requiring every significant transaction to be approved by more than one employee.
- Verification through an independent channel – Confirm banking details with the recipient by phone before making a payment. Never rely solely on email.
- Financial transaction policy – Develop a clear internal policy with specific verification and approval steps.
- Reporting procedures – Establish procedures for immediately notifying the competent authorities of suspicious transactions.
- Periodic data review – Regularly update your counterparties' banking details and maintain active communication with your banking partners.
Technical safeguards
Combine organisational measures with technical solutions for maximum protection of financial transactions:
- Security software and firewalls – Install and maintain up-to-date antivirus software and firewalls to prevent unauthorised access to data.
- Two-factor authentication – Implement 2FA for all financial transactions and access to sensitive financial data.
- Transaction monitoring – Use systems that analyse anomalies and suspicious behaviour in real time.
- Encrypted communications – Encrypt all financial data and emails to prevent interception and tampering.
- Email security (DMARC/DKIM/SPF) – Implement technologies that protect against spoofing and phishing. Enable anti-spam and anti-malware filters.
Useful information
Postbank never asks its customers to disclose confidential information via email or through any online form.
If you receive an email or message claiming to be from Postbank and requesting financial information, an IBAN, or passwords, treat it as fraudulent. Contact us immediately on 0700 18 555.
Act immediately:
1. Call Postbank — 0700 18 555 to block transactions or accounts.
2. Report it to the authorities — file a report with the police and GDBOP (General Directorate for Combating Organised Crime).
3. Notify your partners — if the fraud affects business communication, inform all affected parties.
4. Preserve the evidence — do not delete emails, messages or any other communication related to the fraud.
Use an independent verification channel — never rely solely on an email message:
Phone call — call a phone number of the counterparty that you already know (not the number provided in the email).
In-person meeting — for significant transactions, confirm the change in person.
Written confirmation — request an official document with notarised certification when a bank account is changed.
If the recipient insists on communicating only by email and refuses any other form of verification, treat it with a high degree of suspicion.
BEC (Business Email Compromise) is a type of fraud in which hackers gain actual access to the email account of an employee or business partner and monitor correspondence.
Signs of a BEC attack: • The email comes from a legitimate and familiar email address, but the content is unusual
• It requests an urgent change of IBAN or banking details
• It is sent shortly before an expected payment is due
• It uses a tone or sending time that is atypical for the sender
If you suspect a BEC attack, always verify through a phone call, even if the email appears completely legitimate.