Guide updated 11 July 2026
Can this invoice be trusted?
The fraud that moves the most money does not forge the invoice: it copies a real one and changes the IBAN. The Guardia Civil sums it up this way: «a real invoice, a fake IBAN». These are the checks you can make before paying, and the one that cannot be automated.
1. The tax QR says the same as the paper
Verifactu, TicketBAI and Portuguese invoices carry a QR with NIF, number, date and amount. If the paper says €1,210 and the QR €1,150, someone has tampered with the document. Moreover, that QR can be checked on the tax authority's website without a certificate.
2. The supplier's NIF is real
The NIF carries a check letter or digit that catches invented or badly copied numbers. For suppliers from other EU countries, the European Commission's VIES register says whether their VAT number is active.
3. The arithmetic adds up
Base times VAT rate equals the VAT amount, and base plus VAT minus withholding equals the total. An invoice forged by hand often fails here.
4. The account is the usual one
No check on the invoice alone says whether the IBAN is your supplier's: a fake IBAN is also valid. The only thing that gives it away is comparing it with the one you used last time. That is why PAPYR remembers, only in your browser, each supplier's account, and warns you in red if it changes.
If the account changes, call
The Guardia Civil's advice: confirm any change of account by calling your supplier on a number you already had, never the one that comes in the email or on the invoice. If you have already paid, tell your bank immediately to try to hold the transfer, and file a report.
Frequently asked questions
Is a valid IBAN a safe IBAN?
No. «Valid» means it exists and is written correctly; the fraud uses valid accounts in other people's names.
Does PAPYR store my suppliers' accounts?
Not on our server. The list lives in your browser and you can delete it whenever you like.