Fake IBAN on an invoice: how a forensic expert identifies the compromised mailbox

An intermediary receives an email from an address that differs by a single letter from the seller's, with the invoice for the sale, €103,375.64, and the bank details. He forwards everything to the buyer, who pays. The account belongs to a fraudster and the money is never recovered. On 17 June 2026, France's Court of Cassation set aside the appeal judgment that had treated this payment as discharging the debt. One technical question remains, and it is often decisive: where did the fraud start?

Pay the fraudster, and you may pay twice

Under the French Civil Code, a payment made in good faith to an "apparent creditor" is valid (Article 1342-3). But someone who usurps the creditor's identity is not an apparent creditor, the Court holds. The dispute then often shifts: did someone's negligence make the fraud possible? The answer lies in technical facts.

In Belgium, the Federal Judicial Police in Antwerp warned on 14 May 2026 of a largely automated variant. Using passwords that mostly come from earlier data leaks, perpetrators get into mailboxes and monitor incoming email. The account number and the structured payment reference on the attached invoice are replaced, and the document, which looks identical, is put back in the mailbox or sent straight to the recipient. Since 9 October 2025, banks in the euro area must offer a free check of the payee's name (Verification of Payee). Useful as it is, this check compares a name with an IBAN; it says nothing about whether the message announcing the change is genuine.

First question: where did the message come from?

The analysis starts from the fraudulent message in its original format (an .eml or .msg file): with a screenshot or a forwarded email, what matters is lost. Its headers trace its path from server to server and record the results of the sender domain's authentication checks (SPF, DKIM, DMARC).

Either the message comes from an address imitating the supplier's, as in the French case, often on a lookalike domain: the supplier's mailbox was not necessarily used. Or it comes from the genuine address: those checks then help to distinguish mere spoofing of the address from a message actually sent from the supplier's mailbox, which points to a compromised account. In most cases, the perpetrator knew the transaction and the amount, so they had access to real email exchanges, at one of the parties or at an intermediary.

The attachment tells its own story. Comparing the hash of the invoice kept in the supplier's Sent Items with that of the invoice received shows whether the document was altered. The PDF's internal metadata and structure, which sometimes retains traces of an earlier version, can reveal tampering.

Second question: who had access to the mailbox?

In Microsoft 365, widely used by SMEs, several logs complement each other:

• Sign-in logs (Microsoft Entra ID): who, when, from which IP address, with which application, with or without multi-factor authentication. MFA is not always enough: as early as 2022, Microsoft described phishing campaigns that intercept the already authenticated session and then use it for payment fraud.
• The audit log (Microsoft Purview): actions taken in the mailbox. The first thing to look for is suspicious inbox rules, for instance rules that move a client's messages, or messages containing "invoice" or "payment", to a rarely opened folder, or mark them as read. Listed in the MITRE ATT&CK knowledge base, this technique lets the conversation continue without the mailbox owner noticing. Investigators also look for automatic forwarding to external addresses and, depending on licence and configuration, for the MailItemsAccessed event, which helps establish which messages were opened.
• Message trace: messages sent and received over the last 90 days, including those the intruder later deleted. A deleted message, even one removed from Deleted Items, generally remains recoverable for 14 days by default.

Any security alerts received (risky sign-in, impossible travel), and what was done about them, also show what the organisation could have known, and when. With consumer email providers, the available logs are often far more limited.

Time works against the evidence

The sign-in logs available in Microsoft Entra ID only go back 7 days without an Entra ID P1 or P2 licence, and 30 days with one. The audit log is kept for 180 days in the standard version. Yet the fraud often only comes to light when the supplier chases an invoice it believes is unpaid, sometimes weeks later. And what was never logged cannot be reconstructed afterwards.

The first steps matter: alert the bank immediately and report the fraud to the police; change the password and close open sessions; keep the fraudulent message in its original format, export the logs and document suspicious rules before deleting them. Also assess without delay whether a personal data breach must be notified to the data protection authority (in Belgium, the APD/GBA): the GDPR requires this, where feasible, within 72 hours. Secure, yes; erase traces, no.

What the expert can conclude

A thorough analysis examines both sides, and possibly an intermediary copied on the exchanges. If one party refuses access to its systems, the conclusions are limited to what was examined. They remain measured: traces consistent with unauthorised access to a given mailbox from a given date, no traces in the available logs, or expired logs that do not allow a conclusion. That caution is what makes the report useful to a judge, a lawyer or an insurer.

Key takeaway

In fake IBAN fraud, the question "who bears the loss?" often comes down to another: "which mailbox leaked, and who could have noticed?". The answer rests on logs, headers and hashes, not on screenshots, provided they were preserved in time.

Cyber Praxis handles digital forensics and expert witness work, from preserving the logs to the expert report.

Sources: French Court of Cassation (Commercial Chamber), 17 June 2026, No. 24-13.306, text of the judgment (Légifrance, in French); Federal Judicial Police Antwerp, warning of 14 May 2026 (in French).