Stop CEO fraud and payment diversion fraud
In the EEA, 74 percent of the value lost to fraudulent credit transfers now comes from manipulating the payer. We put the checks in front of that moment.
Fraud in a mid-sized company is rarely a break-in. It is usually a changed IBAN that nobody called back to verify.
CEO fraud and business email compromise: an email or a call in the name of your management puts finance under time pressure. For 2025 the FBI reports about 3.05 billion US dollars in BEC losses across 24,768 complaints, the second largest loss category.
Invoice redirection fraud: a supplier reports a new bank account, but the mailbox has long belonged to the attacker. In Germany, credit transfer fraud reached 474 million euros for the 2024 data year, and direct debit fraud 72 million euros, the highest figure of any EEA country.
Long dwell time: the median fraud case runs for 12 months before it is detected, according to the ACFE. Companies with fewer than 100 employees carry the highest median loss of any size band, around 126,000 US dollars.
Supplier data and payment runs
- Verification of supplier master data and of every reported change to bank details
- Dual approval plus a hold period after each IBAN change, with a callback to the number on file
- Payee verification across the whole payment run, not only on the single transfer your bank sees
Technical detection
- Detection of lookalike domains and near-identical sender addresses
- Signals for compromised mailboxes, such as silent forwarding rules in accounts payable
- SPF, DKIM and DMARC configured properly so nobody sends mail in your company name
People and evidence
- Awareness training for finance and procurement, built on the scenarios of your industry
- A clear escalation path for urgent payments, so time pressure never justifies skipping a control
- Documented evidence for auditors, external assurance and your insurer
No change of bank details without a second approval and a documented callback
Name and IBAN matched across the full batch coming out of your ERP, not just single transfers
The median time a fraud scheme stays undetected. We shorten the distance to the first alarm
Fraud prevention
Is anti-fraud software legally required?
There is no legal duty to run a specific anti-fraud product. What does apply in Germany is section 30 (2) no. 4 BSIG on supply chain security, no. 9 on access control and no. 10 on secured voice, video and text communication, together with management liability under section 38 BSIG and section 130 OWiG, which penalises breaches of supervisory duty with fines up to 1 million euros.
My bank has been checking payee names since October 2025.
Your bank checks the single transfer, not your payment run. Since 9 October 2025, banks in the euro area must offer verification of payee for SEPA credit transfers under Regulation (EU) 2024/886. That duty sits with the bank, not with your company. For bulk files coming out of an ERP the check does not effectively apply, and that is where most of the money moves in a mid-sized business.
Is AI driving the current wave of fraud?
The data does not support that claim. In the IC3 report for 2025, only about 30.3 million of 3.05 billion US dollars in BEC losses are explicitly recorded as AI assisted, roughly 1 percent. Under-reporting is likely: Bitkom found for 2025 that 4 percent of German companies suffered deepfake damage while 66 percent perceive increased use of AI by attackers. So we build controls that hold regardless of the tool the attacker uses.
How does this fit with data protection?
Recital 47 GDPR explicitly recognises fraud prevention as a legitimate interest. Article 22 limits fully automated decisions with significant effect, which is why a human always stays in the approval loop. Anomalies are surfaced and explained, the decision stays with your team.
What does the rollout look like?
We start by mapping your payment paths and approval chains: who creates suppliers, who changes bank details, who approves, and what happens when a payment is urgent. Then we place the controls where the largest volume flows. Your existing ERP and banking processes stay in place, we add the verification steps and make them audit ready.
Talk to us before the next change of bank details arrives
We review your approval chain and tell you exactly where it breaks. Write to info@cavrix.de.