Serbian Firms Lose Millions to Invoice Scams
Jovan Milosavljević, head of the Information Security Service, warns that scammers alter account numbers on invoices and exploit weaknesses in business partners.
Cyberattacks on companies don’t always involve breaching information systems or stealing data. Sometimes, scammers only need to change a single detail on an invoice, such as the bank account number where a company is supposed to transfer funds. The document may appear entirely authentic, but the money ends up in the scammer’s account instead of the supplier’s.
How Scammers Exploit Invoice Changes
Jovan Milosavljević, head of the Information Security Service and representative of Serbia’s National CERT, operating under the Regulatory Body for Electronic Communications and Postal Services (RATEL), highlighted this risk during a workshop on information security for journalists organized by CERT and NALED. He cited cases where Serbian companies paid for goods, vehicles, and other products from abroad, believing they were following correct supplier instructions. The documentation looked identical to the original, but the payment account number had been altered, diverting funds to scammers.
“The danger of such scams lies in the fact that the document doesn’t need to contain obvious errors that would alert employees. All other details on the invoice may be accurate, making it difficult to detect fraud based solely on document review,” Milosavljević emphasized.
Read Also: Beograd gets new finance education center
These cases show that cybersecurity involves more than protecting computers and business systems from hackers. It also means verifying business communications, payment instructions, and changes that may seem routine.
When an account number changes, it must be verified through an independent communication channel. Milosavljević stressed, “If a supplier suddenly sends a new account number, don’t just check if the invoice looks authentic. Contact the supplier using a previously known phone number or other verified address to confirm the payment instructions have indeed changed. This is especially critical for larger amounts or payments to foreign countries.”
Attacks Through Business Partners
Milosavljević highlights another significant trend: attacking companies through their business partners. “Even if a company has well-protected systems, an attacker may try to reach it through another organization it collaborates with that has weaker security.”
Attackers exploit vulnerabilities in the business relationship chain to compromise even well-secured companies. Businesses must consider risks from partners, not just their own protection.
Read Also: Apple starts selling first foldable iPhone
Reported financial losses in Serbia surged to over 187 million dinars in 2025, with 1,759 incidents recorded, up from 1,269 incidents and 69 million dinars in losses in 2024. In 2023, there were 735 reported incidents with losses exceeding 15 million dinars, compared to 519 incidents and over 8 million dinars in 2022.
For businesses, especially small and medium-sized ones, verifying any changes to payment instructions through an independent channel is critical. Milosavljević stressed, “Companies shouldn’t limit prevention to installing security software. Verifying changed payment instructions, handling business documents carefully, and being aware of risks from partners are vital steps in protecting money and operations from cyber scams.”
Phishing remains the most common scam type in Serbia, involving fake messages and links designed to trick users into revealing personal or financial data. SMS phishing, misuse of public company and state institution names, and scams via communication apps like WhatsApp are also prevalent.
Attackers exploit such reactions, using artificial intelligence to create convincing messages that trigger fear, curiosity, or urgency. Milosavljević advises, “Take a 30-second pause.” That time can be enough to check the sender’s address, notice slight differences in web addresses, or spot other inconsistencies. Fake websites can closely resemble official ones, including logos and page designs, while tricking users into downloading malicious software or giving away sensitive data.
