A Cypriot company lost €111,370 due to invoice substitution in business correspondence

A Cypriot company from Larnaca filed a complaint with the Tax and Customs Authority, claiming that it had fallen victim to internet scammers and lost a total of €111,370. The firm processed payments for a partner structure and transferred money to a Spanish counterparty through a law office in Spain.

According to the police, in September, the perpetrators gained access to email correspondence between the Cypriot side, the law firm, and the Spanish partner. The scammers interfered with the email exchange and sent forged invoices with altered bank details, visually identical to the originals. As a result, on October 29 and November 4, the company transferred €68,120 and €43,250 to the fake account. Only after direct contact with the real partner did it become clear that the details did not belong to them.

Experts link the incident to a so-called BEC attack (Business Email Compromise), where criminals stealthily insert themselves into business correspondence and replace invoices, domains, and contacts. The police are investigating the case and urge companies to carefully verify payment details for international transfers, especially if they have been changed “via email.”