Current invoice scams: how to spot fake invoices in 2026
Today's fake invoices often do not look wrong. Criminals intercept genuine invoices by email and replace the IBAN in the PDF, and the amount fits earlier orders. This page collects documented warnings from 2026, each with date, features, the source's advice and a link to the original. As of 04.11.2026.
How today's fake invoices work
Genuine invoice, replaced IBAN
According to the Thuringia consumer advice centre, criminals gain access to email communication, intercept invoices and replace the IBAN in the PDF. The manipulated invoice appears to come from the genuine sender, and even expected invoices are affected. Source: Thuringia consumer advice centre ↗
Invoice fits earlier orders
A guide in the EWE Business Magazine describes the process like this: the invoice seems to come from the usual supplier, the amount fits earlier orders, a superficial check finds nothing, and then payment is made. As a preliminary step the article names data theft, for example a hijacked mailbox. Source: EWE Business Magazine ↗
Current warnings
The warnings are in chronological order. Each comes from a consumer advice centre, a news outlet or a warning site and links to the original.
Manipulated invoices by email: check the account details
Sender and scheme: criminals intercept email communication and swap the IBAN in the PDF, so the invoice looks as if it came from the genuine supplier. Advice from the Thuringia consumer advice centre: compare IBAN and account holder with earlier invoices or the company website, have new bank details confirmed by phone (not via contact details from the email), do not let yourself be rushed, and in case of loss inform your bank, your business partner and the police immediately. Source: press release of the Thuringia consumer advice centre of 30.03.2026 ↗
Fake invoices from “Sixt Server”
Sender and scheme: according to Watchlist Internet, “Sixt Server” is an invented company with no connection to Sixt. The amount is usually 2,139.06 euros, the service (cloud hosting 2026/2027) is described vaguely, and the IBAN given is a German one, which says nothing about authenticity. Advice from the source: check internally whether a contract exists, and check the company and its contact details. Note: the source is Austrian, and the source does not document any spread in Germany. Source: Watchlist Internet of 18.06.2026 ↗
Forged letters from the Federal Central Tax Office
Sender and scheme: according to the Saxony consumer advice centre, criminals pose as the Federal Central Tax Office (BZSt) and ask you to confirm your IBAN for an alleged SEPA direct debit mandate. Features: logos, file numbers and official wording, very short deadlines, threats, transposed letters in names or addresses. Advice from the consumer advice centre: if you are put under pressure, ignore the message, do not click links, do not disclose personal or financial data, and when in doubt ask the Federal Central Tax Office directly. Source: Saxony consumer advice centre of 22.07.2026 ↗
Invoices for subscriptions never ordered, from Hong Kong
Sender and scheme: according to t-online, the Baden-Württemberg consumer advice centre and the Swiss Federal Office for Cybersecurity (BACS) warn of fake subscription invoices under names such as Novavitalia, Bongo-Chat, Astrolonova and Fitnovaness; according to the warning, Margot Brands Limited in Hong Kong is behind them. Amount: 200 euros or more for subscriptions never ordered. Advice from the consumer advice centre: do not pay and object in writing. Advice from the BACS: ignore it and do not click links. Source: t-online of 24.07.2026 ↗
Older cases
For comparison, a case from 2022. This page makes no statement about the present state of the company named.
IHK Osnabrück warning about “humedical” invoices (2022)
In 2022 the IHK Osnabrück (chamber of commerce) warned of invoices from ALPHA RIBS GmbH (Grabau) under the name “humedical”: invoices with older dates (2020, October 2021) plus reminders with the current date, supposedly for ordered Covid rapid tests and protective masks. Those affected had ordered nothing. Advice from the IHK: check the invoice and, if necessary, involve the police. According to the German protection association against economic crime (DSW), there is no obligation to pay. Source: IHK Osnabrück, as of 04.07.2022 ↗
What the numbers say
Economic crime: 2.76 billion euros in damage
The BKA's 2024 federal situation report on economic crime lists 61,358 cases (up 57.6 percent), of which 39,207 were fraud cases (2023: 18,092). The damage amounts to 2.76 billion euros. The BKA does not publish a separate figure for invoice fraud or payment diversion, so the numbers are only the general frame. Source: BKA, report of 31.07.2025 ↗
Want to see it with your own case? We will show you in a free online demo.
How the invoice check helps
Against the replaced-IBAN scheme, comparison with the past helps. Our invoice check compares the bank details of every incoming invoice with the supplier's history and warns if they differ, the check digits are wrong, the IBAN country does not fit the company's location, or the same IBAN suddenly appears for a different supplier. For invoices received through the mailbox connection we also check the sender domain. The formal check of individual e-invoices is free without an account.
Short answers
How do I recognise a current fake invoice?
Compare IBAN and account holder with earlier invoices or the company website, as the Thuringia consumer advice centre advises. According to the EWE Business Magazine, warning signs are a changed account or invoice connection and an implausible customer or invoice number. An invoice for a service you never ordered is a warning sign of its own.
What should I do about an invoice for a subscription I never ordered?
According to t-online, the Baden-Württemberg consumer advice centre advises not to pay and to object in writing. The Swiss BACS advises ignoring the invoice and not clicking links. Check internally whether there is a contract or an order.
What should I do if the invoice comes from the genuine supplier but the IBAN is new?
According to the Thuringia consumer advice centre, have the new bank details confirmed by phone, not via contact details from the email, and compare IBAN and account holder with earlier invoices. You will find the exact procedure under Bank details changed.
Questions about your case? Write to us and we will reply personally.
Frequently asked questions: current scams
Which scams with invoices are current in 2026?
This overview documents four warnings from 2026: manipulated invoices with a replaced IBAN (Thuringia consumer advice centre, March), invented cloud hosting invoices “Sixt Server” (Watchlist Internet, June), forged BZSt letters (Saxony consumer advice centre, July) and subscription invoices from Hong Kong (Baden-Württemberg consumer advice centre according to t-online, July).
How does invoice fraud via intercepted emails work?
Criminals gain access to email communication, intercept invoices and replace the IBAN in the PDF. The invoice appears to come from the genuine sender, and even expected invoices are affected. This is how the Thuringia consumer advice centre describes it.
Is there an official figure for invoice fraud in Germany?
The BKA does not publish one. Its 2024 federal situation report on economic crime lists 39,207 fraud cases and 2.76 billion euros in damage, without quantifying invoice fraud or payment diversion separately.
Do I have to pay an invoice for a subscription I never ordered?
According to t-online, the Baden-Württemberg consumer advice centre advises not to pay and to object in writing. If you ordered nothing, do not settle the invoice but check internally whether a contract exists.
What is a forged BZSt letter?
According to the Saxony consumer advice centre, a phishing message in the name of the Federal Central Tax Office that asks you to confirm your IBAN for an alleged SEPA direct debit mandate. The consumer advice centre advises ignoring the message under pressure, not clicking links and, when in doubt, asking the Federal Central Tax Office directly.
Further reading
Check every incoming invoice automatically
Start for free, 10 transactions included. No credit card.
Get started