A swapped bank account number on an invoice: how to protect your company and customers

An email arrives in accounting from a regular supplier: the same address, the same signature, often even the same thread as usual. The message contains a short note, “We have changed banks, please pay to the new account number”, and the attachment is an invoice that looks like every previous one. The transfer goes out. Two weeks later the supplier calls to ask when the overdue invoice will be paid.

This is not a rare scenario. In August 2026 the Central Cybercrime Bureau of the Polish Police (Centralne Biuro Zwalczania Cyberprzestępczości, CBZC) announced the arrest of four people suspected of belonging to a group that took over company mailboxes and swapped account numbers on invoices. According to CBZC, the losses exceeded PLN 4 million. In this guide I show how to recognize a swapped account number on an invoice, how to check it in 2 minutes, how to secure your own email so that nobody cheats your customers in your name, and what to do in the first hour if the money has already gone out. This is not legal or tax advice. I describe the regulations as of 24 October 2026, and for tax consequences and a dispute with a counterparty, consult your accountant or a lawyer.

How the “new account number” fraud works

There are three main scenarios:

1. A hijacked mailbox, the supplier’s or yours. The fraudster obtains a password, e.g. through a fake login page, and reads the correspondence for several weeks. At the right moment they send an invoice with a swapped number from the genuine address, often in an existing thread. Rules set up in the mailbox hide or delete replies, so the owner sees nothing.
2. A look-alike domain. The email comes from an address that differs by one character, e.g. biuro@przyk1ad.pl instead of biuro@przyklad.pl. On a phone you usually see only the sender’s name, so nobody notices the difference.
3. A forged sender. If the company’s domain doesn’t have DMARC set up correctly, the fraudster can send an email in which the “From” field looks exactly like the real address.

The common denominator is a pretext and haste: “change of bank”, “audit”, “account temporarily blocked”, “I’m on vacation, please don’t call”. Each of these sentences is a signal to slow down.

Don’t count on the bank catching it for you. For a transfer in zlotys, what counts is the account number, not the recipient’s name (Art. 143 of the Payment Services Act, ustawa o usługach płatniczych). Recipient verification (VoP), that is, checking whether the recipient’s name matches the account number, is to cover transfers in zlotys from 9 July 2027. As of 24 October 2026, however, this is still a draft act from the Ministry of Finance dated June 2026. Even after the change the bank will only warn about a mismatch, and the decision about the transfer will remain with you.

The VAT “white list” (biała lista): a check in 2 minutes

The white list search engine, officially the Register of VAT Taxpayers (Wykaz podatników VAT), is free and works without logging in: wykazpodatnikowvat.mf.gov.pl. You search it by NIP (Polish tax ID), REGON (business registry number) or account number.

How to check a “new number”:

1. Enter the supplier’s NIP from the contract or an earlier invoice, not from the email asking for the change.
2. Compare the accounts from the register with the number on the new invoice. Check all 26 digits, not just the beginning and the end.
3. Also enter the new account number itself. If it belongs to a company in the register, the search engine will show which one.
4. Save the confirmation with the search identifier and attach it to the transfer documents.

The absence of the number from the register doesn’t always mean fraud: the supplier may not have reported the new account to the tax office yet. It always means one thing, though: you don’t pay until you have cleared the matter up by phone. The register covers companies registered for VAT in Poland, so for a foreign supplier the phone call is what you are left with.

The PLN 15,000 threshold and tax consequences

The white list is also a tax obligation. When you settle an invoice from an active VAT taxpayer and the one-time value of the transaction exceeds PLN 15,000 (regardless of how many transfers you split it into), a transfer to an account that is not in the register means that:

• you can’t count this payment as a tax-deductible cost (Art. 22p of the Personal Income Tax Act, ustawa o PIT; Art. 15d of the Corporate Income Tax Act, ustawa o CIT),
• you are jointly and severally liable with the supplier for its unpaid VAT on this transaction (Art. 117ba of the Tax Ordinance, Ordynacja podatkowa).

You avoid these consequences if, within 7 days of ordering the transfer, you file the ZAW-NR notification with your tax office through e-Urząd Skarbowy (the online tax office portal). If the money went to a fraudster, ask your accountant right away whether it is worth filing it in your situation. The deadline runs from the day the transfer was ordered, not from the day the fraud came to light.

A phone call to a number you already know

The white list checks the number, but not the person. The most effective protection is simple: you confirm every change of account number by phone, at a number known earlier: from the contract, from the record in your invoicing program, or from the supplier’s website typed manually into the browser. Never from the email asking for the change or from its signature, because a fraudster who has taken over the mailbox swaps the phone number in the signature too.

Rules for the call:

• you call a person you know, not “a new person from the finance department”,
• you don’t read out the number first, you ask the other person to read out the new number, and you compare it with the invoice,
• a test transfer of PLN 1 proves nothing: the fraudster will also confirm that the money arrived.

KSeF helps too. In 2026 most invoices between Polish companies go through KSeF (Krajowy System e-Faktur, Poland’s national e-invoicing system), and the account number can be part of them. An invoice in KSeF is issued by the supplier’s program, not by a mailbox, so swapping a PDF in an email does not change it. A different number in KSeF than in the email is a strong warning sign.

A one-page “account number change” procedure for accounting

The rule only works if it is written down and applies to everyone, including the company owner. Below is a version to print for the person who makes the transfers.

Procedure: changing a counterparty’s account number

1. You don’t change a number based on an email, a text message or a PDF. Every request for a change, even “from the boss”, goes through full verification.
2. You check the counterparty’s NIP on the white list (the NIP from the contract or the record) and save the search identifier.
3. You call the number from the contract or the record. The other person reads out the new number and you compare. You write down the person’s name, the date and the time.
4. A second person approves the change in the record. The same person doesn’t enter and approve a new number.
5. You pay from the list of saved recipients in the bank, not by pasting a number from a PDF. You add a new recipient only after steps 2–4.
6. Haste means stop. A request “urgent, today, no call” goes to the company owner before the transfer.
7. Above PLN 15,000 you pay only to an account from the white list. You agree exceptions with your accountant (ZAW-NR within 7 days).

Account change card (fill in for every change):

Secure your email and domain to protect your customers

A fraudster can also impersonate your company and send your customers a “new account number”. Then they lose the money, and you lose the payment and their trust. Three things I check first:

1. Two-factor authentication (2FA) on every mailbox, including accounting, the office and the accounts of former employees. Preferably through an authenticator app or a hardware key, and SMS only when there is no other option. A stolen password then stops being enough.
2. Rules and forwarding in the mailbox. Check that nobody has added rules that move emails containing the words “invoice” or “transfer” to the trash or forward them to a foreign address. This is how fraudsters hide counterparties’ replies.
3. SPF, DKIM and DMARC on the company domain. DMARC in quarantine or reject mode makes an email forged with your address land in spam or not arrive at all. How to set this up step by step, I described in the guide Company emails going to spam? SPF, DKIM and DMARC. You can check your domain’s status for free with the Check your website tool.

An honest word on the limits: DMARC doesn’t protect against a look-alike domain or a hijacked mailbox, because then the email passes all the tests. That is why all three safeguards are needed, along with clear information for customers. A ready-made text for an email footer, an invoice and the contact page:

We do not change our bank account number by email. If you receive a request to pay to a new account number, please do not pay and call [phone] (the number from [website address]). Our account can be checked on the VAT white list by NIP [NIP].

A plan for the first 60 minutes after a transfer

Time matters, because fraudsters quickly move the money on or withdraw it from ATMs.

Minutes 0–10: the bank

• Call your bank’s hotline (the number from your card or the bank’s website, not from an email) and say it plainly: “A transfer has gone to a fraudster’s account. Please urgently hold it and contact the recipient’s bank.”
• An ordinary transfer to another bank goes out in clearing sessions during the day, so sometimes it can still be stopped. An instant transfer arrives in a few seconds, and then all that is left is a request to the recipient’s bank to freeze the funds.
• Write down the report number, the time and the consultant’s name.

Minutes 10–25: the supplier and your mailbox

• Call the real supplier at a known number. Their mailbox may be hijacked, and then the fraudsters write to other customers too.
• If the leak may have been on your side, change your email password from another device, log out of all sessions, turn on 2FA and delete foreign rules.

Minutes 25–40: evidence

• Don’t delete emails. Save the message with full headers (in Gmail, the “Show original” option), the invoice PDF, the transfer confirmation and the white list result.

Minutes 40–60: reports

• Report the incident to CERT Polska through the incydent.cert.pl form. Attach the sender’s address, the headers and the fraudster’s account number.
• File a crime report with the police, preferably the same day, with printouts and the report number from the bank. Pass the case number to your bank. The bank where the fraudster has the account can itself block suspicious funds for 72 hours at most, and a longer block is decided by a prosecutor (Art. 106a of the Banking Law, Prawo bankowe).

After the first hour

• Accountant: ZAW-NR (7 days from ordering the transfer) and recording the loss in the books.
• Lawyer: a transfer to a fraudster usually doesn’t release you from the debt to the supplier (Art. 452 of the Civil Code, Kodeks cywilny), but where the supplier’s mailbox was broken into, the matter can be disputed.
• Insurer, if you have a cyber risk policy.
• Customers: if your mailbox was hijacked, warn them by phone or text message, not from the same mailbox.

Summary

A swapped account number on an invoice is a fraud built on trust: one email at the right moment is enough. A simple rule protects you: no change of number without a white list check and a phone call to a known number, and on the company side 2FA on email and DMARC on the domain. Print the procedure from this guide and hand it to the person who makes the transfers.

If you want me to check the security of your email and website, order a security audit from PLN 990 net. I set up a business domain and email with SPF, DKIM and DMARC configured from PLN 390 net per year. Write to me: I reply within 24 hours, and new clients get 20% off their first order (the discount does not cover the domain and hosting).