Module 1 · 1.2
English
Phishing, CEO fraud and invoice fraud
Module 1: Why you're a target · Reading time: 10 minutes
Learning objective: After this lesson you'll be able to recognise how phishing, CEO fraud and invoice fraud (BEC) work, and set up a payment procedure with callback checks.
Key concepts: phishing, spear phishing, CEO fraud, invoice fraud, Business Email Compromise, four-eyes principle, calling back on a known number
Three forms of the same trick
All three attacks in this lesson work through deception. Nobody breaks into a computer; instead, someone is persuaded to do something themselves: click a link, fill in a password, transfer money. This is called social engineering. It works because it plays on ordinary human reactions: you want to help your boss, pay a supplier on time, solve a problem quickly.
| Form | What the attacker wants | Typical message |
|---|---|---|
| Phishing | Login details, payment details or a click on malicious software | "Your mailbox is full, log in to keep your messages" |
| CEO fraud | An urgent payment | "I'm in a meeting, can you transfer this today? Don't discuss it with anyone else" |
| Invoice fraud | Payment of a genuine invoice to the wrong account | "Please note: our account number has changed" |
CEO fraud and invoice fraud both fall under the umbrella term Business Email Compromise (BEC): fraud in which business email is misused and a scammer pretends to be someone else.
Phishing and spear phishing
Phishing is a message that pretends to come from a trustworthy sender, so that you do something you wouldn't otherwise do. Usually it's a link to a fake login page, for example rnijnbank.example (with "rn" instead of "m"), or an attachment containing malicious software. Ordinary phishing goes out to large numbers of people at once, with a generic story.
With spear phishing, the message is tailored to you. The attacker uses your name, your role, the name of a real colleague or supplier, a project you're working on. They find this information on your website, LinkedIn, the Chamber of Commerce register or in a previously leaked mailbox. Because the message matches what you expect, it stands out far less.
Spelling mistakes are no longer a reliable indicator. With translation tools and AI text generators, a scammer can write flawless text in your language. In module 3 you'll learn to recognise phishing by things a scammer can't fake: the real domain of a link and the technical sender of an email.
CEO fraud
With CEO fraud, someone who makes payments receives a message that appears to come from the director or owner. The Fraud Helpdesk (Fraudehelpdesk) describes the fixed characteristics:
- Authority: it's an instruction, not a request.
- Secrecy: "don't discuss this with anyone yet, it's about a takeover."
- Time pressure: it has to happen today, before the bank closes.
- A sender address that's almost right: for example
directie@example-com.example, which looks like your own domain at first glance, or a private address "because I'm travelling".
Sometimes a "lawyer" or "accountant" is brought in to confirm the instruction; they're part of the scam too. Associations and small businesses are approached this way as well: the treasurer gets an email from "the chairperson".
Why does it work? Because in a small business, everyone knows and trusts each other. The employee wants to help, and the secrecy stops them from checking with a colleague. That secrecy is exactly the scammer's goal.
Invoice fraud: only the IBAN is different
Invoice fraud is harder to recognise because the invoice is often genuine. Amount, order number, logo, layout: everything matches. Only the account number has changed. According to the Fraud Helpdesk, this happens in different ways: the invoice is intercepted and altered, a separate letter arrives saying "our account number has changed", or the company itself has been hacked and the scammer sends the email from the real mailbox.
That last point is important to understand. If the mailbox of your supplier leverancier.example has been taken over, the email genuinely comes from the right address. All technical checks (SPF, DKIM, DMARC from module 4) pass. The scammer may have been reading the mailbox for weeks, knows which invoices are outstanding, and sends their message at exactly the right moment, in the same conversation thread. Checking the sender address doesn't help here.
A painful detail: if you've paid the scammer, you generally still owe the real supplier the amount.
An example
Bakkerij Example orders a new oven from leverancier.example. The quote, the order confirmation and the invoice all arrive neatly. Two days later, in the same email thread:
Dear Petra, due to a switch to another bank, our account number has changed with immediate effect. Could you transfer the payment for the oven invoice to the new number? The old number will be closed next week. Kind regards, Joost
The address is right, Joost's name is right, the order number matches. The only thing that gives the fraud away is the request itself: a change of account number. That's always a moment to check, never a moment to simply trust the email.
The payment procedure that stops it
You can't recognise every fake email. But you can make sure a fake email isn't enough to get money transferred. You do that with a few fixed agreements.
- Call back on a known number. For every change of account number, and every unusual payment request, call the sender. Not the number in the email or on the invoice, as that could be fake too, but a number you already had: from your own records, the contract, or the official website that you type in yourself.
- Don't reply to the email. If you want to check by email, type the address in yourself. Using "reply" can land you with the scammer, for example via a Reply-To that points to a different address (lesson 3.3).
- The four-eyes principle. Payments above a set amount, new payees and changed account numbers are checked by two people. In a one-person business, that means: a fixed waiting period and calling back before you pay.
- No exceptions via email or chat. The director never asks by email or WhatsApp to skip the procedure. Agree on this, including with the director themselves. Then everyone knows: a message saying "just this once, outside the normal process" is suspicious by definition.
- Record the details. A supplier's account number is in your bookkeeping. Compare the number on every invoice with what you already had. Since October 2025, banks in the eurozone check during a transfer whether the name you enter matches the account number (known as Verification of Payee). Take a warning from this seriously. But a green result only means the name and account match, not that the recipient is honest.
| Situation | Action |
|---|---|
| New account number from an existing supplier | Call back on a known number, second person approves |
| Urgent payment requested by management | Call or ask in person, follow the procedure as normal |
| New supplier, first invoice | Check details against an official source, second person approves |
| Invoice that looks different from usual | Ask before paying |
If it still goes wrong
Have you paid and no longer trust it? Then every hour counts.
- Call your bank immediately and ask whether the payment can be stopped or recovered.
- Report it to the Fraud Helpdesk and report the crime to the Dutch police.
- Warn the supplier: if their mailbox has been taken over, more customers will receive fake messages.
- If the message came from your own mailbox or a colleague's, it may have been taken over. Change the password, revoke sessions and check forwarding rules (lessons 2.5 and 3.5).
Summary
- Phishing, CEO fraud and invoice fraud are all social engineering: you're persuaded to do something yourself.
- Spear phishing is tailored to you and therefore far more convincing; spelling mistakes are no longer a reliable indicator.
- CEO fraud plays on authority, secrecy and time pressure.
- With invoice fraud, often only the IBAN is different, sometimes sent from the supplier's genuinely hacked mailbox.
- A payment procedure with callbacks to a known number and the four-eyes principle stops most fraud, even if you don't recognise the fake email.
Quiz
Exercise
Exercise A1.2: Spot the scam. You'll receive six short messages. For each one, say whether it's likely to be phishing, CEO fraud, invoice fraud or a normal message, and what action you'd take. The programme checks your answers and shows the characteristics you could have spotted in each message.
Exercise D1.2: Your own payment procedure. Write your business's payment procedure on a single page: when to call back, on which number, who does a second check, and above what amount. Discuss it with everyone who makes payments.
Exercise D1.2: Your own payment procedure
Here's how to approach it: (1) Write down on one sheet of paper when a payment needs extra checking: a changed account number, a new payee, an amount above a limit you choose, an urgent request outside the normal process. (2) Write down how you call back: only on a number from your own records, the contract, or the official website that you type in yourself. (3) Appoint a second person to check along (in a sole proprietorship: a fixed waiting period of, say, one night). (4) Agree with management that the procedure is never skipped by email or chat. (5) Discuss the sheet with everyone who makes payments and put it up on the wall.
Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.
Further reading
The steps in the WebOké articles apply to the WebOké environment; with other providers it works in a similar way.
- Is this email really from WebOké? Recognizing phishing and using the promo code
- Emails from ICANN or the registry about your domain: real or fake, and what should you do?
- Fraud Helpdesk, CEO fraud: https://www.fraudehelpdesk.nl/ondernemers-fraude/ceo-fraude/
- Fraud Helpdesk, The account number on the invoice has been changed: https://www.fraudehelpdesk.nl/fraude/het-rekeningnummer-op-de-factuur-is-aangepast/
- Fraud Helpdesk, Intercepted invoices: https://www.fraudehelpdesk.nl/ondernemers-fraude/onderschepte-facturen/