Payment fraud in Estonia 2026: how to protect a company's payments?
BUSINESS · OCTOBER 2026
Estonian companies lost more than 10 million euros to payment order fraud in 2025. One of the most dangerous schemes is invoice fraud, in which a criminal changes a business partner's bank details or takes over email correspondence between companies. How can you recognize this kind of fraud, protect your accounting, and avoid transferring money to the wrong account?
28 September 2026 published an overview by Eesti Pank shows that payment fraud is a growing financial risk for Estonian businesses. Fraudsters no longer target only private individuals. Increasingly, they try to manipulate company executives, accountants, and employees who are authorized to initiate or approve payments.
The danger is that a forged invoice can look completely genuine. An email may also come from a familiar address and contain references to previous agreements. Therefore, it is no longer enough to check only the sender's name or the invoice's design.
How serious a problem is payment fraud in Estonia?
Source: Eesti Pank, 28.09.2026. The data concerns the year 2025. Losses exceeding 10 million euros include various payment order fraud schemes targeting businesses, not just fake invoices.
In Estonia, the total losses from payment fraud amounted to 25,3 million euros in 2025. Although only 15% of payment order fraud cases involved companies, they caused more than half of the financial damage from this type of fraud.
Even a loss of a few thousand euros can cause serious cash flow problems for a small business. For larger invoices, the consequences can be even more severe.
How does invoice fraud actually work?
Invoice fraud is a type of payment fraud in which a criminal directs a company to pay an invoice to the wrong bank account. This may involve sending a forged invoice, changing billing details, or interfering with ongoing business correspondence.
Example of a typical invoice scam
01. An Estonian company orders goods or services from a long-term business partner.
02. An accountant receives a routine invoice. The email says that the supplier’s bank account has changed.
03. The invoice amount, company name, and other information are as expected. Only IBAN is different.
04. The accountant pays the invoice to a new account, believing they are carrying out a routine work task.
05. It later turns out that the actual business partner has not received the money. The transfer was made to a fraudster.
What is business email compromise (BEC)?
BEC (Business Email Compromise) means compromising a business email account or abusing the trust placed in it. For example, a criminal may gain access to a company’s email account, monitor correspondence with a supplier, and intervene precisely when it is time to pay an invoice.
In such cases, a scam email may even arrive from a genuine email address belonging to a business partner. Sometimes, however, fraudsters use an almost identical domain or impersonate a company executive.
Therefore, a familiar sender's name, previous correspondence, or a correctly formatted PDF invoice does not yet prove that the payment details are correct.
Important rule: if a business partner notifies you of a new bank account, do not approve the change based solely on an email. Call the partner using a previously known phone number and verify the new IBAN separately.
Real case: an Estonian company lost 1,6 million euros in a single invoice scam
According to the Information System Authority (RIA), in April 2026, an Estonian company lost 1,6 million euros due to invoice fraud.
A company received an email on behalf of its business partner, asking it to pay invoices to a different bank account going forward. The message appeared to come from representatives of the business partner. In fact, the new account belonged to fraudsters.
The incident shows that a criminal does not necessarily have to take over a company’s online banking to cause a major financial loss. It is enough to manipulate someone who makes or approves a transfer.
Source: RIA – Cybersecurity Situation, April 2026.
6 warning signs that mean the payment should be stopped
1. Unexpected bank account change
Tarnija teatab uuest IBANist, eriti vahetult enne maksetähtaega.
2. Haste and pressure
You are asked to pay immediately, warned of a delay, or asked to make an exception to the usual procedure.
3. Unusual email address
The sender’s address differs from the usual one by a single letter, symbol, or domain extension.
4. Unusual communication style
A familiar partner suddenly starts demanding secrecy, urgent confirmation, or a change of communication channel.
5. Suspicious payee
The bank account holder's name does not match the expected recipient, or the bank displays a corresponding warning.
6. Extraordinary instruction received in the manager's name
The accountant receives an urgent payment instruction and is asked not to discuss it with others.
None of these signs alone proves fraud, but each is a reason to check the payment further before confirming it.
How can a company protect its accounting and payments?
The most effective protection is neither a single software program nor employee vigilance. It is a clear working procedure that prevents company funds from being transferred to the wrong account based on a single forged email.
1. Establish a procedure for changing bank details
Iga tarnija IBANi muudatus peab läbima eraldi kontrolli. Võta ühendust varasemast lepingust või kinnitatud kontaktide registrist pärit telefoninumbril. Ära kasuta kontrollimiseks ainult kahtlases e-kirjas või arvel toodud kontakte.
2. Apply the two-person approval principle
For larger transfers, one employee should prepare the payment and another should approve it. For higher-risk transactions, the second approver must also check the underlying invoice details, not just click the approval button in online banking.
If only one person works at the company, additional safeguards can be used: stricter payment limits, mandatory telephone verification, and dedicated time to review unusual payments.
3. Keep supplier details under control
The accounting software should include a register of approved suppliers. Every change to account details must be documented along with the reason, the person who approved it, and the date it was verified. The mere arrival of a new PDF invoice should not automatically change the supplier’s bank details.
4. Protect work email accounts
Ettevõtte e-post on sageli sama oluline kui ligipääs internetipangale. Eriti tuleb kaitsta tegevjuhi, raamatupidaja ning ostude ja müügiga tegelevate töötajate postkaste.
- Use multi-factor authentication (MFA).
- Do not use the same password across different services.
- Check for suspicious logins and automatic email forwarding rules.
- Remove access for former employees and service providers.
- If necessary, configure SPF, DKIM, and DMARC with a IT specialist to help reduce the risk of domain spoofing.
5. Restrict bank users’ permissions and payment limits
Each employee should have only the access necessary to perform their work duties. Check who can add new payees, change limits, and approve large transfers. Giving one person complete control over all these activities increases risk.
6. Use the bank’s payee verification service
Euroopa Liidus rakendatud makse saaja kontroll ehk Verification of Payee aitab euroülekande eel tuvastada, kas sisestatud saaja nimi vastab IBANi omaniku andmetele. Kui pank näitab mittevastavust, tuleb põhjus enne maksmist välja selgitada.
However, even a positive verification result is not an absolute guarantee. It does not confirm that an invoice or payment instruction sent by the company is genuine.
7. Train employees to recognize fraud
An accountant, administrator, or project manager must know what to do with a suspicious invoice. Practise together how to verify a change of bank account, whom to notify about a suspicious email, and when to stop a payment. It is equally important for managers to be ready to answer employees’ questions during checks.
Checklist before paying an invoice
Kasuta seda nimekirja eriti uue tarnija, muutunud IBANi või tavapärasest suurema ülekande korral.
☐ The invoice corresponds to an actual order or contract.
☐ The recipient company's name and IBAN have been verified.
☐ The changed bank details have been verified through an independent channel.
☐ Any alerts from the bank about the recipient's name have been resolved.
☐ The necessary payment approvals are in place.
☐ No one has requested a secret, urgent, or unverified transfer.
If any response is uncertain, stop the payment and verify the information before proceeding.
What should you do if the money has already been transferred to a scammer?
If you suspect invoice fraud or another payment instruction scam, the most important thing is to act immediately. Especially with instant payments, the money can reach the recipient’s account within seconds.
1. Contact your bank immediately. Report the suspected fraud and ask them to investigate whether the payment can be stopped or recalled. Getting the money back is not guaranteed.
2. Report it to the police. Cybercrime-related incidents can be reported at cyber.politsei.ee\/report.
3. Notify the actual business partner. Use the phone or another independent communication channel. This allows the partner to check whether their mailbox or identity is also at risk.
4. Check the security of the company’s IT. If you suspect that an email account has been compromised, involve an IT specialist. Check active sessions, logins, forwarding rules, and access rights, and revoke any unauthorized access.
5. Keep evidence. Keep emails, invoices, payment confirmations, screenshots, and other relevant information. Do not delete suspicious messages before documenting them.
A potential cyber incident can also be reported to the Estonian Information System Authority at raport.cert.ee.
According to Eesti Pank, 2025 year, 96% of the losses caused by payment order fraud were borne by the victims. This is an important reminder: there is no guarantee that a fraudulent transfer, once approved, can be recovered.
What should an Estonian small business change today?
Preventing payment fraud does not necessarily require expensive software or a dedicated security department. Many risks can be reduced through simple procedures that are followed consistently.
Start with three decisions: no new bank account is put into use without an independent check, larger payments require additional approval, and work email accounts must be protected with multi-factor authentication.
The most important thing is not merely to spot fraud. It is important to establish a system within the company where one mistaken decision cannot automatically cause major financial damage.
Korduma kippuvad küsimused (KKK)
Can invoice fraud come from a legitimate email address?
Yes. If a criminal has gained access to a business partner’s email account, a fake payment instruction may arrive from a genuine address. Therefore, an unexpected change to bank account details must be verified through another channel.
Is an invoice sent digitally always secure?
No. The electronic format of an invoice or its delivery through the usual channel does not in itself guarantee that the payment details are correct. Invoices received automatically must also undergo the checks agreed upon within the company.
What should you do if a business partner notifies you of a new bank account?
Do not change payment details immediately. Call the previously verified contact person, check the new IBAN, and document approval of the change. If necessary, request independent additional confirmation.
Will the bank refund money lost to invoice fraud?
Not automatically. The possibility depends on the circumstances of the transaction, how it was authorised, and how quickly the bank is notified. If fraud is discovered, the bank must be contacted immediately.
Does a small business need a dedicated cybersecurity specialist?
Not necessarily a full-time employee. You can start with strong authentication, payment limits, checking supplier details, and training employees. For more complex email and IT security configurations, it is worth bringing in a specialist.
These articles may also be of interest
How to recognise phone scammers in 2026?
Scam calls made using AI, fake bank numbers, and practical tips for protecting your money.
Digital hygiene: how to protect yourself and your data on the Easyfind portal?
Account security, suspicious messages, protection of payment details, and safe communication online.
The quiet business: how to protect know-how and customers in a small business?
How to manage access, protect company documents, and reduce the risk of losing data and customer information.
Find out which training grants can help develop employees’ digital skills and cybersecurity knowledge.
Make your business more visible on Easyfind
Easyfind helps businesses, tradespeople, and specialists showcase their services, products, and offers in one place. Post an advertisement with a description, photos, contact details, and other important information to make it easier for potential customers to find you.
On the portal, you can also publish special offers and expert articles that help you share your knowledge and build trust. You can start with a free listing.
Sources and further information
1. Eesti Pank – Last year, businesses lost over 10 million euros to payment order fraud (28.09.2026)
2. RIA – Situation in cyberspace, April 2026
3. RIA – Invoice scams are spreading! Check before you pay
4. European Central Bank – Instant Payments Regulation and Verification of Payee
5. RIA – Recommendations for organisations on handling cyber incidents
The article was prepared using information published by Eesti Pank, RIA, and the European Central Bank. Artificial intelligence was used to help prepare the text.