Fake IBANs and Poisoned PDF Invoices: The Practical Cybersecurity Guide to Protecting Your Company's Bank Account

The Threat That Destroys More Businesses Than the Tax Authority

When business owners discuss financial threats, the conversation almost invariably revolves around corporate taxes, social security contributions, inflation, and delinquent clients. But over the last three years, the most devastating financial killer of Portuguese and European small and medium-sized enterprises (SMEs) has been something entirely different: silent, organized cyber fraud aimed directly at company bank accounts.

At Hélder Ferreira Contabilidade, where our team oversees tax compliance, accounting audits, and financial reporting for hundreds of growing enterprises across central Portugal, we have witnessed the aftermath firsthand.

A trusted building contractor finishes a four-month structural renovation and emails their final invoice for 48,500 €. The email comes from the contractor’s real email address. The PDF logo is identical. The line items match the contract to the cent. But in small font at the bottom, an innocuous note reads: “Please note our new treasury account details at Millennium bcp due to our recent fiscal merger: PT50 0033…”

The client’s administrative clerk schedules the payment. Three days later, the contractor calls asking why the invoice has not been settled. The money is gone.

The funds were wired to a criminal mule account in Porto, converted into cryptocurrency across three decentralized exchanges within nine minutes, and the business owner is left with an unrecoverable 48,500 € loss that insurance policies frequently refuse to cover under “voluntary transfer” exclusion clauses.

According to alerts published by Banco de Portugal and the National Cybersecurity Center (CNCS), Business Email Compromise (BEC) and invoice redirection fraud account for millions of euros in direct liquidity theft every year.

Protecting your company’s bank account does not require a degree in computer science. It requires unforgiving financial controls, dual-channel out-of-band verification, and zero-trust document handling.

OUT-OF-BAND DUAL-CHANNEL IBAN VERIFICATION PROTOCOL

• INCOMING SUPPLIER INVOICE VIA EMAIL
• Invoice claims: “Our banking details have changed to PT50…”
• SENDER LOOKS LEGITIMATE (Compromised Vendor Email Account)
• AUTOMATIC TREASURY FREEZE
• RULE 1: NEVER TRUST CONTACT INFO INSIDE THE SUSPICIOUS EMAIL
• DO NOT reply to the email.
• DO NOT call phone numbers printed on the new invoice PDF.
• DO NOT click any banking authorization links.
• OUT-OF-BAND VERIFICATION CHANNEL
• RETRIEVE HISTORICAL PHYSICAL MASTER FILE
• Locate initial signed master contract / certified SAF-T audit file
• Dial known, verified phone number of the vendor’s CFO/Accountant
• VERIFIED “YES” (Official Company Restructuring): Require written bank ownership certificate (Declaração de Titularidade Bancária)
• VERIFIED “NO” (Fraud Intercepted): Immediately report to CNCS, PJ, and vendor IT.

Business Email Compromise (BEC): How Attackers Infiltrate Invoices

To defend your company, you must understand how invoice fraud actually works. Cybercriminals do not typically “hack” bank mainframes; they compromise standard business email accounts running on Microsoft 365 or Google Workspace through simple phishing links or stolen credential databases.

Once inside a supplier’s email, the attacker does not send an immediate blast of spam. They create silent email forwarding rules:

• Any message containing words like fatura, invoice, IBAN, pagamento, or vencimento is copied to an external mailbox.
• The attacker observes active contracts, payment schedules, and the tone of voice of the supplier’s finance team.
• When an invoice is issued, the attacker intercepts the email, edits the PDF file to replace the authentic IBAN with their own mule account IBAN, and forwards the modified invoice to you.

Because the email originated from the real supplier’s server, traditional spam filters pass it without warning. To your accounts payable clerk, the invoice appears completely authentic.

The Immutable Rule of Out-of-Band Verification

We teach every client one non-negotiable protocol: Any request to change a supplier’s IBAN triggers an automatic payment freeze until verified via an independent, out-of-band communication channel.

If a vendor sends an email stating their bank details have changed:

1. Never use the phone number printed on the new invoice. If the invoice is fraudulent, the phone number connects directly to an accomplice waiting to confirm the fake details.
2. Never reply directly to the email. If the account is compromised or being spoofed, your reply goes straight to the attacker.
3. Use the Master Contract Record: Go to your physical contract file, retrieve the landline number or pre-verified mobile number of the company’s legal representative, and place a voice call.
4. Demand Official Bank Ownership Proof: Require an official Bank Account Ownership Certificate (Declaração de Titularidade de Conta Bancária) issued directly by the bank, bearing the vendor’s legal corporate tax ID (NIPC) matching official records at the Portal das Finanças.

The Trojan Invoice: How Poisoned PDFs Deploy Ransomware into Accounting

The second major attack vector targeting corporate treasuries is the weaponized document attachment.

Accounting and human resources departments are uniquely vulnerable because their entire job involves opening attachments from strangers: CVs, proposals, vendor price lists, and supplier invoices.

Attackers capitalize on this operational reality by emailing compressed files or PDFs with names designed to induce panic:

• Aviso_Penhora_Autoridade_Tributaria_2026.pdf
• Fatura_Vencida_Notificacao_Judicial_Ref8921.zip
• Comprovativo_Transferencia_Urgente_Millennium.exe.pdf

A standard PDF file can contain embedded JavaScript, malicious form submission actions, and hidden downloaders. When an employee double-clicks the attachment, the document executes a background script that downloads a ransomware payload directly into the accounting network. Within thirty minutes, your SQL database containing five years of invoicing, client records, and payroll data is encrypted.

AIR-GAPPED ACCOUNTING DOCUMENT & DATA INGESTION

• INCOMING SUPPLIER INVOICE FILE
• Received via dedicated inbox: faturas@empresa.pt
• NEVER OPENED DIRECTLY ON MAIN ACCOUNTING ERP WORKSTATION
• AUTOMATED QUARANTINE SANDBOX / CLOUD INGESTION
• Scans for embedded executable code and suspicious macro payloads
• Strips active content; converts PDF to pure flat image TIFF/PDF
• Validates certified digital signature and fiscal QR-Code
• Clean Data Transfer
• PRODUCTION ACCOUNTING ERP (Primavera / Sage / TOConline)
• Dedicated VLAN strictly isolated from general office Wi-Fi
• Database writes logged with immutable transaction audit trails
• Daily 02:00 AM Automated Export
• AIR-GAPPED IMMUTABLE BACKUP VAULT
• Full SQL Database Dump + Certified SAF-T Audit Files (PT-SAF-T)
• Stored on WORM Storage (Write Once, Read Many) — Unreachable by Virus

Essential Document Handling Hygiene

To protect your accounting computers from poisoned attachments:

1. Show File Extensions in Windows: By default, Windows hides file extensions. An attacker names a file Fatura_482.pdf.exe. To the user, it looks like a PDF; when clicked, it runs a program. Enable “File name extensions” across all office PCs immediately.
2. Never Open .zip, .rar, or .iso Invoices: Legitimate European businesses do not send standard utility or supplier invoices inside compressed .zip or disk-image .iso containers. Configure your email server to automatically quarantine email attachments with executable or script extensions (.exe, .scr, .vbs, .js, .bat, .iso).
3. Use Web-Based Document Portals: Whenever possible, encourage suppliers to submit documents through verified accounting portals or use cloud-native platforms like TOConline where invoices are parsed and validated via digital certificate signatures without executing local files on desktop machines.

Treasury Controls: The Two-Person Rule and Bank Dual Authorization

The most effective cybersecurity tool for a business bank account is not software; it is organizational separation of duties.

In too many small companies, a single administrative employee has complete, unilateral authority: they open the mail, enter supplier invoices into the system, log into the commercial banking portal, generate the payment batch, and authorize the wire transfer using a banking token kept in their top desk drawer.

This single point of failure invites catastrophe. If that employee is tricked by a fake IBAN email, the money leaves the company immediately. If an attacker installs a keylogger on that specific PC, they capture the bank login and authorize transfers directly.

Every commercial bank in Portugal (Millennium bcp, Caixa Geral de Depósitos, Santander, Banco BPI, Novo Banco) supports Dual Authorization Workflows (Autorização Conjunta):

COMMERCIAL BANK DUAL-AUTHORIZATION PIPELINE

• OPERATOR A: ADMINISTRATIVE ACCOUNTANT
• Matches physical delivery slip against verified vendor invoice
• Cross-checks IBAN against pre-approved master supplier list
• Prepares SEPA batch in banking portal (STATUS: PENDING APPROVAL)
• CANNOT RELEASE FUNDS ALONE
• AUTOMATIC NOTIFICATION SENT TO EXECUTIVE
• Secure mobile push alert: “Payment Batch #2026-10 ready for review”
• Displays vendor name, verified invoice number, and transfer total
• OPERATOR B: CHIEF EXECUTIVE / MANAGING PARTNER
• Independently reviews the transaction batch
• Signs release using separate physical hardware token / biometric app
• BATCH EXECUTED AND FUNDS RELEASED

Under this workflow:

• The administrative team can draft payments, prepare payroll, and organize supplier batches, but their account possesses zero transfer execution authority.
• The business owner or managing partner holds exclusive authorization power on an independent physical device (such as their personal smartphone with Face ID or a dedicated physical RSA token).
• Even if an administrative computer is completely compromised by remote access trojans (RATs), the attacker cannot move a single euro out of the company without the executive’s physical secondary confirmation.

The Air-Gapped Accounting Archive: Protecting Your SAF-T Files

In Portugal and throughout the European Union, losing your accounting database is not just an operational disaster; it is a serious legal violation. Under fiscal regulations monitored by the Autoridade Tributária e Aduaneira, businesses are legally required to maintain certified, uncorrupted electronic records and produce standardized SAF-T (PT) billing files on demand.

If a ransomware attack encrypts your ERP software database and you cannot produce compliant audit files during a tax inspection, your business faces heavy statutory fines alongside the destruction of historical records.

We recommend this Air-Gapped Invoicing Protection Routine:

1. Daily Automated SQL Database Dumps: At the end of every business day, the ERP database generates an encrypted backup bundle.
2. Monthly Certified SAF-T Export: On the first day of each month, export the official certified SAF-T billing XML file for the preceding period and store it in an immutable, read-only storage directory.
3. The 3-2-1 Physical Backup Discipline:
   • Keep one copy on the primary local server.
   • Keep a second copy on a secure Network Attached Storage (NAS) volume protected by immutable local snapshots.
   • Keep a third copy in an air-gapped physical state (e.g., an encrypted external hard drive unplugged from the network after transfer, or an encrypted cloud storage bucket configured with strict WORM compliance policies for 10 years).

Your company’s bank balance and accounting records are the lifeblood of your operation. Treat invoice verification with the same uncompromising discipline that you apply to legal contracts and client relationships. One two-minute phone call to verify an IBAN change can save your business from bankruptcy.

In practice, we apply these exact architectural standards across specialized sectors including traditional accounting firms and strategy & tax consultants. Whether you are modernizing core workflows through business digitalisation and managed hosting for websites and apps, connecting sector-specific requirements to disciplined execution is what turns technical theory into compounding commercial advantage.