Scammers access the victim's mailbox or use addresses obtained through other means. Then, they send messages from previously purchased domains that mimic real providers in which they request payments or information on invoices.

If they have access to the inbox and digitised invoices, they wait until a payment deadline approaches or a pending invoice is shared to act precisely.

If they have access to the digital invoice, they alter it, keeping its original design but changing the account number. If not, they send an email that pretends to be legitimate and asks that future payments be made to a new IBAN.

They pretend to continue the previous conversation and send the altered invoice as if they were the original vendor.

If you reply to the fraudulent email, the scammer answers by impersonating the vendor. In addition, they often attach a fake bank account ownership certificate for added credibility.

But if you try to confirm the change by calling the usual phone number, you won't get an answer from the scammer.