The email looks perfect. It's from your regular supplier, in the same thread as last month's invoice. "Please note our new bank details for this and future payments." The new IBAN is attached on letterhead.
Or it's from your CEO, on a Friday afternoon: "Are you at your desk? I need a confidential payment to a foreign supplier today. Please don't mention it to anyone yet."
Both are classic scams, and both work on smart, careful people. In Switzerland, the Federal Office for Cyber Security (BACS in German, FOCS in English; known as the NCSC until the end of 2023) says CEO fraud is among the fraud methods most often reported to it, with reported cases rising from 719 in 2024 to 971 in 2025.
Here's how these scams work and the controls that stop them.
Scam 1: Invoice manipulation (business email compromise)
How it works: the attackers gain access to a business email account, often the supplier's, sometimes yours. They read real invoices and conversations. Then they send a message in an existing thread, asking you to pay an invoice to a different IBAN, or to use a new account "for all future payments".
Because the message refers to a real email history, it's easy to mistake for a genuine one. BACS describes exactly this pattern: invoices already sent are re-sent with a changed IBAN.
Variations: a "corrected" PDF invoice, a manipulated QR-bill with a different account in the QR code, or a lookalike domain (supplier-ag.ch becomes supp1ier-ag.ch).
Scam 2: CEO fraud
How it works: someone in finance gets a message that seems to come from the CEO or another senior person. The name is right, and the address looks right at first glance. The message asks for an urgent, confidential payment, often to a foreign supplier, or asks for the current account balance first.
According to BACS, the fraudsters prepare carefully. They research LinkedIn, the company website and the commercial register to understand who has signing authority, who works in accounting and who's away. Pressure phrases like "I'm counting on your discretion" or "please execute immediately" are meant to stop you following the normal process.
New variants: BACS reports CEO fraud via WhatsApp and phone, AI-written messages that imitate a boss's writing style, and deepfake voice calls. It cites a case in the canton of Schwyz where a company lost several million francs. Fraudsters also pose as real Swiss law firms to add pressure around a "confidential deal".
The controls that stop both
BACS recommends technical and organisational hurdles. Here they are as a practical checklist.
1. Four eyes on payments and on payee changes
Require a second person to approve payments and, just as important, any change to a supplier's bank details. A changed IBAN is a master-data change, not a routine update.
2. Verify through a second channel
If a payment request or bank change arrives by email, call the person on a number you already have, not the number in the email. Never verify by replying to the same email thread.
3. No exceptions for the boss
Agree in writing that the payment process applies to everyone, especially instructions from senior management. A healthy scepticism should count as a strength, not as disobedience.
4. Mark external emails
Configure your email system so messages from outside the company are clearly marked ("EXTERNAL"). An "internal" CEO email with an external tag is an instant red flag.
5. Turn on two-factor authentication everywhere
On email, on your payment accounts, on your accounting software. BACS stresses it as one of the most effective protections.
6. Check email rules after any suspected hack
Attackers often set up a forwarding rule so they keep receiving copies of your emails. Check filters and forwarding rules.
7. Slow down "urgent and confidential"
Urgency plus secrecy is the signature of these scams. Make it a rule: any payment described as urgent and confidential gets a phone call before it goes out.
A payee-change checklist (print this)
Before you add or pay a new or changed bank account, check:
- Request arrived by email or chat? Call back on a known number.
- Spoke to someone you know at the supplier, not a "new colleague"?
- Sender domain checked letter by letter?
- New account in the same country and name as the supplier? A change from a Swiss IBAN to an account abroad deserves extra scrutiny.
- Second person approved the change?
- For a new payee, consider a small first payment and confirm receipt by phone.
If it already happened
Speed matters. BACS recommends:
- Contact your payment provider immediately. It may still be able to stop or recall the payment.
- File a criminal complaint with your local police if you've suffered financial loss.
- Tell the supplier if the fraudulent email came from their address; their system may be compromised.
- Change passwords and have your IT checked if your own email was used.
- Report it to BACS through its online form. It helps them spot trends and warn others, and BACS passes fraudulent IBANs on to law enforcement.
Why your payment setup matters
Fraud controls work best when they're built into how payments happen, not bolted on:
- Bills go through one approval flow. No paying from an email inbox on a phone at 6 p.m.
- Payee details are verified once, by phone, and changes go through the same check.
- You see the payment before it goes out: recipient, amount, fee.
- Stablecoin addresses get the same treatment as IBANs. On-chain payments generally can't be reversed, so verify the address and do a test payment. See How a Swiss Company Can Receive USDC (and What to Do Next).
A worked example (hypothetical)
The bookkeeper at a Winterthur engineering AG receives an email from a long-standing German supplier: new bank details at a bank in another country, please pay the open EUR 48,000 invoice there.
- The email is in the real thread, but the domain has one letter swapped.
- Under the company's rule, she doesn't reply. She calls the supplier's accounts team on the number in the company's records.
- The supplier hasn't changed anything. Their email was compromised.
- The bookkeeper flags the email to IT, the supplier resets its systems, and the AG reports the IBAN to BACS.
- The invoice is paid to the verified account by SEPA, after the usual second approval.
Total cost: one phone call.
Common mistakes
- Treating a bank-detail change as admin, not as a risk event.
- Verifying by replying to the same email.
- One person can create a payee and pay it without a second approval.
- Making exceptions for urgent requests from the boss.
- No 2FA on email.
Bottom line
Invoice and CEO fraud don't beat technology; they beat process. Four eyes, a call-back rule and no exceptions stop most of them for the price of a phone call.
FAQ
What is CEO fraud?
A scam where fraudsters pose as a company's CEO or another senior person and pressure an employee into making an urgent, often confidential payment to an account they control.
What should I do if a supplier emails new bank details?
Don't reply to the email. Call the supplier on a number you already have, confirm the change with someone you know, and have a second person approve the change before paying.
Can a fraudulent payment be recovered?
Sometimes, if you act fast. Contact your payment provider immediately, then file a police report. The sooner you act, the better the chance.
Who do I report payment fraud to in Switzerland?
Your local police if there's a financial loss, and the Federal Office for Cyber Security (BACS) through its online reporting form.
Can QR-bills be manipulated?
Yes. Fraudsters can send a fake or altered QR-bill with a different account in the QR code. Compare the account on a new or changed bill with the supplier's verified details. More: The QR-Bill, Explained for Busy Founders.
Approve before anything leaves
On Firma, nothing goes out without a yes. Bills you email or photograph are read, categorised and held until you approve, and every payment shows the recipient, amount and fee before it's sent. Two-factor authentication is on. On the Platform plan, API payments run inside a daily limit you set. Money in is free. Every outgoing payment carries the plan fee (25 bps on Plus, 20 bps on Platform, custom on Enterprise), shown before you send. Conversions use the Reuters rate, and if an incoming payment is converted, there's no spread. Plus is Fr. 499 a month. Verification takes about two days, and if we can't verify your company, there's nothing to pay.
Set up the approval flow: Forward a Bill, Click Approve: Accounts Payable on Autopilot. Questions to ask any provider: "Is My Money Protected?" Questions to Ask Any Business Account Provider.
This article is general information, not advice. Check the details for your situation with your provider or adviser.
Firma is not a bank and is not licensed by FINMA. Firma Operations AG is a member of VQF, a FINMA-recognised self-regulatory organisation for anti-money-laundering, and does not hold client funds. Fiat payments are processed through partner banks. Balances are digital stablecoin tokens, not bank deposits, and are not covered by esisuisse.
Sources: BACS, business email compromise (invoice manipulation fraud); BACS, weekly review 4/2026: CEO fraud remains a constant for SMEs (27 Jan 2026); BACS, weekly review 3/2023: fraud variants with QR codes; Firma.
