Boss scam and fake bank transfer instruction

What you need to understand

• For the urgent transfer instruction, first check the requested action, the channel used and what may already have happened if you clicked, paid or shared a code.
• Use an official channel for the urgent transfer instruction that you open yourself. A received link, QR code or phone number is not a reliable starting point.

The scenario, step by step

• The fraudster studies the company and contacts someone who can make payments by pretending to be a manager, a lawyer or a supplier.
• The request is presented as urgent, exceptional and confidential to get around double approval.
• The address may be spoofed or a real mailbox may be compromised, so the email content alone is not enough to authenticate the instruction.

What the fraudster is trying to obtain

• A transfer to a new beneficiary.
• A change to a supplier IBAN or internal documents that can help with a second fraud.

Common variants

• Fake boss.
• Fake lawyer or secret acquisition operation.
• Gift cards or split payment.

Warning signs in your case

• The request bypasses the usual payment approval process
• The message insists on secrecy, urgency or exceptional availability from the manager
• The address looks like the company’s but has a subtle difference
• A new IBAN or an unusual beneficiary is given at the very last moment

What a legitimate service would do

• An exceptional transaction still remains subject to internal checks.
• A real manager does not forbid independent confirmation with a second person in charge.

Belgian context and fraud chain

• Boss scams target organisations and rely on public information: roles, travel, suppliers and approval processes. The message looks believable because it reuses the company’s real context.
• It is different from invoice fraud: one impersonates authority to force an exceptional operation, while the other often diverts an expected supplier payment. The two can also be combined.

Decision points to check

• Apply double approval even when the instruction seems to come from a manager and even if the message refers to confidentiality.
• Confirm the beneficiary, amount and reason through a known channel, without using the contact details given in the request.
• Treat any IBAN change as a sensitive modification, regardless of the apparent authenticity of the invoice or email.

How to check without taking a risk

• Do not reply to the message and do not use the link, QR code or number it contains.
• Open the official app or website yourself, then check whether the same request appears in your personal area.
• If in doubt, contact the organisation using a number found on its official website, a reliable invoice or your bank card.

What to do immediately

• Pause the payment and check orally with the manager through a number already known.
• Apply internal double approval, even if the message claims the case is confidential.
• If the transfer has already been sent, contact the company’s bank and the police without delay.

If you have already clicked, paid or replied

• Stop the exchange and do not try to negotiate with the sender.
• Change the access details communicated through the official service. Contact the bank immediately if a payment, card, IBAN or validation is involved.
• Keep the exchanges, payment references and observed addresses for reporting, without sharing personal data publicly.

Reacting after an incident

• Alert the bank and the internal decision chain immediately to try to block the payment and avoid similar instructions.
• Preserve email headers, logs, invoices and approvals. A simple screenshot does not always contain the technical elements needed for the investigation.
• Check whether an email inbox or internal account has been compromised before restoring the payment process.

Limits and level of evidence

• An unusual tone or urgency does not prove that a manager was impersonated; confirmation of the channel and sending account is needed.
• This page does not allow the incident to be attributed to a group or to establish the full extent of an internal compromise on its own.

Analysis grid for the urgent transfer instruction

• To assess a the urgent transfer instruction, separate four questions: who is contacting you, through which channel, what action is being requested, and which independent element can confirm it. One reassuring answer does not cancel out the other inconsistencies.
• The priority signs in this case are: the request bypasses the usual payment approval process; the message insists on secrecy, urgency or exceptional availability from the manager; the address looks like the company’s but has a subtle difference; a new IBAN or an unusual beneficiary is given at the very last moment. Their combination matters more than an isolated word, logo or typo.
• Always compare the message with the real status of the service. For the urgent transfer instruction, a request that is not present in the app, account or official contact should remain unexecuted until confirmed.

When to ask for immediate help

• In a the urgent transfer instruction case, contact the relevant department without delay if a code, validation, payment, card, identity document or remote access has already been shared. Describe the exact action rather than saying only that you were hacked.
• If no sensitive action has been taken, keep the useful elements, block the contact and use the detector to document the signs. This difference helps avoid confusing prevention, a confirmed incident and a simple unsolicited message.

What to do now

• If you have not acted, do not click further and open the named service's official channel yourself.
• If you clicked, close the page, enter nothing else and note what information was shown or requested.
• If you shared a code, card, password or payment, contact your bank or the relevant official service immediately.
• Keep the message, time, link used and any useful screenshots. Share them only with an official reporting channel or a trusted helper.

Limits of this page

• This page does not prove that a message is safe and does not replace your bank, the police, Safeonweb, a platform or a public service.
• A scam may be new, very well written or described with too little context. Use the result as decision support, not as absolute certainty.
• Before taking a final action, checking through the official channel matters more than the appearance of the received message.

Check through an official channel

• Type the service address yourself or open the official app. Do not use a phone number, link or QR code from the suspicious message to verify the situation.
• When money, card details, a code or account access are involved, the safety action comes first. The analysis can then help organise the evidence.

How to read the result

• A low number of signals does not mean that everything is safe. It only means that this page or analysis did not find decisive evidence with the information available.
• Focus on the requested action: paying, sharing a code, installing an app, approving a bank action or leaving an official platform. That action matters more than a logo, sender name or polished wording.
• If the situation feels urgent, step away from the received message first. Then check calmly through a channel you already trusted before the message arrived.

Belgian reading of this situation

• For the urgent transfer instruction, focus on the relevant Belgian next step: open the official channel yourself, contact the bank, use Safeonweb or preserve evidence.
• The right decision for the urgent transfer instruction depends on what has already happened. Reading a message is not the same as clicking, paying, sharing a code or granting remote access.

Frequently asked questions

Useful official sources

• SPF Économie - Fraude à la facture - link checked on 2026-09-17
• Febelfin - Fraude à la facture - link checked on 2026-09-17
• SPF Économie - Comment reconnaître une arnaque ou un arnaqueur ? - link checked on 2026-09-17
• SPF Économie - Victime d'une arnaque ? Que faire ? - link checked on 2026-09-17
• Bancontact Company - Ensemble contre la fraude aux paiements - link checked on 2026-09-17