Fake payment instruction: Company, Switzerland 2023
Attackers searched a hacked email account for invoices that had been sent and sent a copy to the customer again.
- Incident · 01.2023 · Switzerland
- Evidence: confirmed by an authority
- Fake payment instruction
As of
What happened
In doing so, they replaced not only the IBAN but also the QR code of the QR-bill. Because the target account was a Swiss account, the fraud was hard for the recipient to spot.
- Affected
- Company (anonymous)
- Industry
- other industry
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- hacked email account
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
CEO fraud, diverted payment, fake invoice
Mostly add-on 5 of 9 business products cover it fully, as an add-on or with limits.
-
Third-party claims after a data breach
Liability for data protection and network security breaches
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Immediate help in an emergency
Hotline, IT forensics, crisis PR and legal advice
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Always confirm new account details by telephone using a known number, even if the IBAN is Swiss.
Sources
- Wochenrückblick Woche 3: Von Rechnungsmanipulation bis Abofallen - Vermehrt Betrugsvarianten mit QR-Codes (opens in a new window) Bundesamt für Cybersicherheit BACS (bis 2023: NCSC) · 24.01.2023
«Dabei wurde nicht nur die IBAN getauscht, sondern auch der QR-Code entsprechend angepasst.»