![\"Original](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/10\/de-watergroep-invoice-scam-changed-iban-original-example.png\" "\\"\\"")
<\/figure>\nOverview<\/h2>\nA genuine invoice can carry a substituted bank account<\/h3>\n
The De Watergroep invoice scam can involve criminals changing a real bill after it reaches a compromised mailbox, replacing the payment account with their own.<\/p>\n
Safeonweb describes that specific mailbox-based invoice fraud<\/a>. The dangerous detail isn’t necessarily an obviously fake sender or a completely invented water charge.<\/p>\n The image is an original fraudulent-invoice example published by De Watergroep. Its annotations and obscured QR code are preserved, not added as evidence of a separate investigation.<\/p>\n The legitimate water company may really have issued a bill. The attacker redirects the payment by changing instructions the recipient relies on.<\/p>\n The attack described by Safeonweb starts in your mailbox. It doesn’t mean De Watergroep’s systems were breached.<\/p>\n It also doesn’t mean every questionable water invoice follows this route. Other impersonations exist, so compare your bill with the official customer account.<\/p>\n Many phishing warnings tell you to watch for a strange sender, poor spelling, or an invoice for something you never bought.<\/p>\n Those checks are still useful, but they don’t solve a bill altered inside a mailbox. Much of the document may be based on a genuine transaction.<\/p>\n You might recognize the customer account, expected amount, or normal timing. Those details make sense because the criminal doesn’t need to invent the entire relationship.<\/p>\n The changed bank account is enough to redirect a manual transfer. A document can look mostly correct while its most consequential instruction is wrong.<\/p>\n That is why checking the amount isn’t the same as checking the destination. The question isn’t only whether you owe money, but who would receive it.<\/p>\n Don’t blame yourself for not noticing an obvious fake if the invoice wasn’t an obvious fake. Use the official customer area to establish a trustworthy comparison.<\/p>\n The attack also explains why replying within the same mailbox may not be sufficient verification. If someone has access there, they may see your doubts.<\/p>\n In Safeonweb’s described scenario, mailbox access comes before the invoice alteration. The warning doesn’t identify one universal method used to obtain that access.<\/p>\n Don’t assume a password leak, malicious app, or particular email provider caused your case without investigation. The immediate task is securing the account.<\/p>\n That includes checking sessions and rules, not merely deleting the suspicious invoice. The bill may be a visible consequence of an earlier compromise.<\/p>\n The attacker uses an invoice that has reached the mailbox. Its ordinary appearance and recognizable details make it more persuasive than a random payment demand.<\/p>\n You may be expecting precisely that bill. Expectation helps the fraud because it removes one of the questions you would ask about an unexpected invoice.<\/p>\n Still, recognizing the bill doesn’t prove that the version you’re viewing retains the supplier’s original payment instructions.<\/p>\n The attacker changes where the money goes. In De Watergroep’s published example, red boxes highlight the account printed in the payment instructions.<\/p>\n The amount shown is \u20ac90.53. Its apparent reasonableness shouldn’t distract you from verifying the account receiving the transfer.<\/p>\n Some inconsistencies may be visible, such as a changed font or unfamiliar layout. Their absence doesn’t make a document safe.<\/p>\n A transfer can be technically processed as instructed even though the instructions came from an impostor. Your banking app can’t know the story behind every invoice.<\/p>\n Read any recipient-name or account warning rather than dismissing it as an inconvenience. Don’t override a mismatch just because the document carries a familiar company name.<\/p>\n The supplier may not receive the money. Paying the altered instructions doesn’t automatically settle a genuine balance on the real customer account.<\/p>\n The problem may surface when you compare records or the real supplier still shows an unpaid bill. Don’t send another payment until you’ve clarified the position.<\/p>\n Tell the bank about the fraudulent destination and ask about a recall or investigation. Separately, tell the utility which invoice and amount are involved.<\/p>\n Then secure the mailbox. Otherwise, a criminal who remains inside may interfere with new messages or attempt another redirection.<\/p>\n De Watergroep recommends viewing and paying invoices through its customer zone or Doccle. Reach them through access you already trust, not a new link in the questionable email.<\/p>\n Look for the invoice and compare its identifying details. Then inspect the actual payment instructions rather than assuming every field in the attachment matches.<\/p>\n If the invoice isn’t there or something differs, pause. The supplier’s real customer service can investigate without relying on the attachment’s contact details.<\/p>\n A structured payment reference helps identify a bill, but it doesn’t authenticate the bank account printed beside it.<\/p>\n Likewise, an IBAN that has a plausible format isn’t necessarily the supplier’s IBAN. A syntactically valid account can still belong to the wrong recipient.<\/p>\nYour real water supplier isn’t the one changing the account<\/h3>\n
The payment destination needs its own check<\/h3>\n
\n
Why Familiar Details Can Make This Fraud Harder to Spot<\/h2>\n
How the De Watergroep Invoice Scam Works<\/h2>\n
Step 1: Criminals obtain access to the recipient’s mailbox<\/h3>\n
Step 2: A real bill provides a convincing document<\/h3>\n
Step 3: The beneficiary account is replaced<\/h3>\n
Step 4: The recipient authorizes payment to the wrong destination<\/h3>\n
When the Real Bill Still Shows as Unpaid<\/h2>\n
Verify the Invoice Somewhere the Attacker Didn’t Choose<\/h2>\n
Use the customer area or your established Doccle account<\/h3>\n
Compare the recipient, not just the reference<\/h3>\n