In short
According to CSIRT Italia, fraudsters read compromised mailboxes and join real conversations asking for payment to a new IBAN.
Every IBAN change and every urgent payment should be confirmed on a different channel, by calling a number you already know.
Segregation of duties and dual signatures above a threshold stop one person from changing an IBAN and paying it.
SPF, DKIM and DMARC protect your exact domain, not lookalike domains: you also need MFA and training.
If the transfer has gone, call your bank and report it at once: a recall is possible only within the value-date period.
On 17 February 2026, CSIRT Italia, the incident response team of Italy's National Cybersecurity Agency (ACN), issued a bulletin on a Business Email Compromise campaign targeting organisations in Italy: compromised company mailboxes, domains almost identical to the real ones and payment requests with a new IBAN. In March the Italian Postal Police published an alert on the same pattern seen from the supplier side, with altered emails in which the legitimate IBAN is replaced by the fraudsters' own.
These are two different alerts describing the same risk: someone in accounts, in good faith, sends a bank transfer to an account controlled by criminals. It happens when the email appears to come from the owner, a director or a regular supplier. In this guide you will find what the official sources say, the warning signs to recognise, the double-check procedure to adopt for IBAN changes and urgent payments, how to configure your email and what to do straight away if the transfer has already gone.
What have ACN and the Postal Police reported?
The authorities describe two main variants of the same fraud. In the first, the fraudsters pose as a company executive and ask for a payment. In the second, they slip into a real conversation with a customer or supplier and change the bank details. In neither case is there a virus emptying the account: it is a person authorised to pay who is persuaded to do so.
Whaling, the "CEO fraud"
Back in January 2023, CSIRT Italia reported a "Whaling Phishing" campaign (bulletin BL01/230117/CSIRT-ITA) that also affected Italian organisations. According to ACN, whaling, also known as CEO Fraud, uses social engineering to target an organisation's top management or people with decision-making or spending powers, impersonating credible senders to get illegitimate financial transactions authorised.
The bulletin described emails that impersonated a real sender known to the victim, used the recipient's real name and carried a signature imitating one sent from a smartphone, typical of someone travelling. ACN recommended awareness campaigns for staff, particularly senior roles.
Thread hijacking: a real conversation, a fake IBAN
The bulletin of 17 February 2026 (BL01/260217/CSIRT-ITA) reports the resumption of a campaign already covered in December 2025. According to CSIRT Italia, attackers steal email credentials through a fake login page that also asks for the OTP code. Then they do not act immediately: they read the mailbox to find ongoing business exchanges.
At that point they register a domain very similar to the company's, with easily confused characters, and join the conversation with a customer. They ask for payment of an apparently outstanding invoice, giving a new IBAN. The context is real and the references are real: for the person receiving the email, the change is hard to spot.
The Postal Police alert on "man in the middle"
On 27 March 2026 the Postal Police described "man in the middle" fraud on business email: the fraudster inserts themselves into communications between a company and its supplier and replaces the IBAN with their own. According to the alert, the fake messages are almost identical to the originals and often press for urgent payment, justified by administrative problems, accounting updates or a change of bank.
In an earlier communication from September 2025, the Postal Police summarised the two variants: a different IBAN inserted into correspondence with a business partner, or fake internal emails that appear to come from the chief executive or finance director and order an employee to pay.
Why does it affect SMEs too, especially at year end?
It affects SMEs because the fraud does not need large systems to attack: all it takes is one mailbox and one person who can make payments. In small companies the same person often receives invoices, updates supplier records and uploads transfers, while the owner authorises remotely. That short chain is exactly what the fraudster exploits.
Official data confirm that bank transfers are the instrument most exposed to this kind of deception. In the Bank of Italy's report on the second half of 2025, published in July 2026, "payer manipulation" fraud, where the account holder is induced in good faith to pay a fraudulent account, is the prevailing type for credit transfers: 72% by value and 58% by number. The report also notes that transfers are used for high-value payments, including between businesses.
The end of the year adds pressure. Contracts are closed, invoices are settled before the books close, payments are brought forward ahead of the holidays and the person who authorises is often out of the office. Urgency and absences are exactly the levers the authorities identify as typical of these scams.
How do you recognise a fraudulent payment request?
CEO fraud is recognised more by the type of request than by the quality of the email. The ACN and Postal Police alerts show well-written messages, in the right language, with real names and signatures. That is why it pays to train people on behavioural signals, not on spelling mistakes.
Signals to take seriously:
Urgency and secrecy: "it has to be done today", "don't tell anyone", "I'm in a meeting, don't call me".
A different procedure from usual: a payment outside the normal flow, with no recorded order or invoice, or with an approval skipped.
An IBAN change: a new account "due to a change of bank", "administrative problems" or "an accounting update", especially if the account is abroad or in a different name.
An almost-right sender: an extra letter, a hyphen, a different domain. The Postal Police advise checking addresses, which may contain small variations that are hard to notice.
A channel that closes: the sender avoids a phone call, asks you to reply only by email or switches to a number never used before.
A real conversation with one new detail: in thread hijacking the exchange is genuine; only the final request changes.
None of these signals alone proves fraud. But each one is a good reason to stop and carry out the check described in the next section.
Out-of-band double checking: the rule that stops many attempts
The most effective defence the authorities point to is simple: every request to change an IBAN or make an unusual payment must be confirmed on a different channel from the one it arrived on. ACN speaks of "out-of-band" verification, for example a phone call to a number you already know, even when the request seems to come from a trusted contact. The Postal Police mention a call to a known number, the official certified email address (PEC) or a verified contact.
For supplier IBAN changes
Write a simple rule: no IBAN is changed in your records on the strength of a single email. Whoever receives the request calls the supplier on the number already held in the supplier record or contract, never the one given in the message. They ask for confirmation of the new IBAN and account holder and note the date, time and name of the person who confirmed.
It helps if the change to the record is made by someone other than the person who uploads payments, and if the first payment to the new IBAN is flagged to whoever authorises. This links to supplier evaluation: agreeing in the contract how changes of bank details are communicated makes verification quicker for both sides.
For urgent payments "from the owner"
The owner or director should be the first to tell everyone that they will never ask for an urgent, confidential transfer by email or chat alone. That way the person receiving the request does not have to choose between trusting and disobeying: they follow a rule already announced. Confirmation is done by calling the personal number already in the address book, not by replying to the message.
If the owner really cannot be reached, the payment waits. A few hours of checking rarely harms a business relationship, while a transfer to a fraudulent account can be hard to recover.
The bank's name-IBAN check helps but does not replace yours
Since 9 October 2025, as the Bank of Italy points out, banks and Poste Italiane must check that the payee's name matches the IBAN for both standard and instant transfers, warning the payer if the details do not match. It is a real help: if a mismatch warning appears, stop and check. It does not replace the call to the supplier, though, which remains the main control.
Segregation of duties and authorisation thresholds
The second defence is organisational: making sure that no single person can change an IBAN and pay it on their own. You do not need a large structure; you need to split the key steps and set thresholds above which a second pair of eyes is mandatory.
An example scheme for an SME, to adapt to your volumes and organisation:
Operation | Prepared by | Approved by | Out-of-band check |
|---|---|---|---|
New supplier or IBAN change | Accounts | Head of accounts | Always, on the number already on file |
Routine payment below threshold | Accounts | Single signature on bank portal | Only if the IBAN is new |
Payment above threshold | Accounts | Dual signature on bank portal | If the IBAN is new or the request is unusual |
Urgent out-of-process payment | Nobody without confirmation | Owner, confirmed by voice | Always |
The company sets the threshold based on its usual amounts. Many business banking portals let you set up dual signatures and authorisation profiles: it is worth asking your bank what is available. The rules must be written down, explained and followed even when the person asking is the owner.
SPF, DKIM and DMARC explained simply
These three acronyms are the settings that tell the world which emails really come from your domain. In April 2026 ACN published dedicated guidelines on configuring email for sender authentication, aimed at countering spoofing, phishing and message tampering.
In plain terms:
SPF is the list of servers authorised to send mail for your domain. According to ACN, on its own it is not enough to counter spoofing, because it checks a technical address rather than the one the recipient sees as the sender.
DKIM is a digital signature added to every message: the recipient checks that the email comes from your domain and has not been altered.
DMARC ties both checks to the visible address and tells receiving servers what to do with emails that fail them: no instruction (none), treat them as suspicious (quarantine) or reject them (reject). It also lets you receive regular reports on who is using your domain.
ACN recommends implementing all three protocols together. Ask whoever manages your email or domain to check the configuration and to move DMARC, step by step, towards a policy that blocks fake messages.
One limit to be aware of: these settings protect your exact domain. They do not stop a fraudster from registering a similar domain, as described in the February bulletin. That is why you also need multi-factor authentication on mailboxes, which ACN asks to be made mandatory, checks on automatic forwarding rules and out-of-band verification. The other basic measures are in our guide to minimum cybersecurity measures for SMEs.
Training: teaching those who pay to say "let me check first"
The authorities put training among the first measures: ACN recommends awareness campaigns, especially for senior roles, and regular training to recognise phishing. Useful training here is not a generic security course: it is targeted practice for those who receive invoices, manage supplier records and upload payments, and for those who authorise them.
What works in practice:
Realistic, anonymised examples: show emails of the kind described in the alerts, with a changed IBAN or an urgent request from the "owner".
A phrase to use: "I'll call you back on the usual number to confirm". It makes checking normal, even with a superior.
No blame for reporting: whoever holds up a legitimate payment to check it has done the right thing.
Refreshers before critical periods: a short reminder before year end and the holidays.
If you work with ISO 27001, this training falls under the competence and awareness requirements: you will find how to plan and document it in our guide to competence, training and awareness.
The transfer has gone: what to do straight away
If you realise a payment has gone to a fraudulent account, time matters. The Postal Police point out that a transfer can be recalled only within the value-date period, and the Bank of Italy notes that an instant transfer cannot be revoked once executed. Acting quickly improves the chances of recovery, but does not guarantee it.
Call your bank immediately, do not just send a message: ask them to block or recall the transfer and find out what details they need.
Report it to the Postal Police as soon as possible; you can also report through the online Police station (Commissariato di PS Online). Bring emails, invoices and transfer receipts.
Keep the evidence: do not delete the emails, do not reply to the fraudster, save the messages as they are.
Secure your email: change the passwords of the mailboxes involved, enable multi-factor authentication, and check forwarding rules and recent logins with whoever runs IT.
Warn the real supplier or customer using a contact you already know: they may also be receiving fake emails.
Assess whether there is a data breach: if criminals had access to a company mailbox, they may have read personal data.
When it is also a data breach
If the fraud started from a compromised mailbox, the problem is not just the transfer. Emails often contain data on customers, employees and suppliers: unauthorised access may be a personal data breach under the GDPR. In that case you need to assess notification to the Italian data protection authority (Garante) within 72 hours of becoming aware of it, unless the risk to individuals is unlikely, and the event must be documented in any case.
The assessment depends on the specific case and is best done with your DPO or privacy lead. The steps, hour by hour, are in our guide on what to do in the first 72 hours after a data breach. If you fall within the scope of NIS2, also check whether the incident must be notified to CSIRT Italia.
What to do in the medium term: bring the controls into a system
Rules on IBANs and payments work if they hold up even when people change. This is where an information security management system such as ISO 27001 helps: it turns good habits into written, assigned controls that are checked over time.
Several Annex A controls of the standard address this risk directly: segregation of duties (5.3), information transfer (5.14), information security in supplier relationships (5.19), incident management planning and preparation (5.24), awareness and training (6.3) and secure authentication (8.5). Including payment fraud in your risk assessment leads to choosing these controls with judgement, not from a list.
In the medium term, useful steps are:
A written procedure for IBAN changes and urgent payments, with out-of-band checking and a record of the confirmation.
Authorisation profiles on the bank portal aligned with the agreed thresholds.
Supplier clauses on how changes of bank details are communicated.
Verified email configuration: SPF, DKIM, DMARC, multi-factor authentication, forwarding checks.
One simulation a year: an exercise with a fake IBAN change request to see whether the procedure holds.
A response plan with bank, Postal Police and DPO contacts ready to use.
How Complaion supports you with information security
Complaion works alongside companies with a dedicated Lead Auditor who follows the organisation over time and proposes the most suitable path, from ISO 27001 certification to compliance with the NIS2 directive. The internal audit is carried out by the Lead Auditor, who checks how the system really works before the certification audit.
The Complaion platform collects evidence, manages documents, keeps the deadline schedule and prepares the audit. The offer is completed by web application penetration testing (WAPT) and an outsourced DPO. We work with more than 1,000 clients. If you want to understand where to start, get in touch.
Frequently asked questions about CEO fraud and fake IBANs
What is CEO fraud?
It is a fraud in which a criminal poses as a company executive, or one of their advisers, to persuade someone who can make payments to send an urgent transfer. ACN describes it as a form of whaling that uses social engineering to get illegitimate financial transactions authorised. It belongs to the wider family of Business Email Compromise.
What is the difference between CEO fraud and Business Email Compromise?
Business Email Compromise is the general category: frauds that exploit company email, compromised or imitated, to obtain payments. CEO fraud is the variant in which the fraudster poses as the owner or an executive. The other common variant is the fake IBAN change from a supplier or customer.
If the email comes from the supplier's real address, can I trust it?
That is not enough. ACN's February 2026 bulletin describes cases where criminals had access to the real mailbox and knew the ongoing conversation. That is why every IBAN change must be confirmed on a different channel, by calling a number you already know.
Are SPF, DKIM and DMARC enough to block these scams?
No. They reduce the chance of someone sending fake emails from your exact domain, but they do not block similar domains or emails sent from compromised mailboxes. They need to be combined with multi-factor authentication, training and out-of-band payment checks.
Can a fraudulent transfer be recovered?
Sometimes, if you act very quickly. The Postal Police point out that a recall is possible only within the value-date period, and the Bank of Italy notes that an executed instant transfer cannot be revoked. Call your bank immediately and report it to the police without waiting.
Does a BEC scam have to be notified to the data protection authority?
It depends. If the fraudster had access to mailboxes containing personal data, it may be a data breach to assess: notification to the Garante must be made within 72 hours, unless the risk to individuals is unlikely. Carry out the assessment with your DPO and document the event in any case.
Does ISO 27001 protect against CEO fraud?
No standard eliminates the risk. ISO 27001 helps reduce it because it requires you to assess risks and apply controls such as segregation of duties, supplier security, training and incident management, and to check their effectiveness through regular audits.
