Daniel works in his company’s accounting department and, like every month, has to pay the suppliers. He opens the corporate banking portal, enters the IBANs one by one, double-checks them and confirms. The summary screens show the IBANs he expected. Everything looks fine.
A few days later, a supplier calls: the payment never arrived.
What is a payee swap attack?
Between the moment Daniel typed the IBANs and the moment the requests reached the bank, someone replaced one of them. It can be done by malware running in the browser, which rewrites the payment form or request and often intercepts the bank’s response as well, so the user keeps seeing the IBAN they expect. It can also be done by a fraudster using a remote access tool, often after a social engineering attempt, who changes the beneficiary while the user’s session is active.
This attack is called a Payee Swap, or IBAN swap.
Why can’t online banking see a payee swap?
Payee Swap attacks operate at levels the web application cannot see. They stem from campaigns that infect PCs and target the browser or the device drivers. The application sees an unchanged environment and the customer sees a correct screen.
How can a bank detect a payee swap?
A bank can detect a payee swap by checking that the beneficiary it received is exactly the one the customer typed. Because the attack happens where the web application cannot see, the check needs an independent source of truth outside the application itself.
It is like asking two couriers who don’t know each other to confirm an address: if their versions don’t match, someone has tampered with the package.
If the two beneficiaries differ, the payment is flagged as high risk and the bank can block it or ask for additional authentication. The XTN Cognitive Security Platform® brings this check to the web channel of online banking.
What does XTN payee swap detection cover?
XTN payee swap detection protects web banking and corporate portals by ensuring that the beneficiary details entered by a genuine customer are exactly what reaches the bank. The technology targets invisible web channel threats that manipulate transactions after data entry, specifically intercepting sophisticated malware in the browser and remote access tools operated by fraudsters. By independently verifying the transaction path, it delivers deterministic protection against IBAN substitution without disrupting the user experience.
Why payee swap protection matters for online banking?
Daniel typed the right IBANs and checked them twice, yet one payment still reached the wrong account. A payee swap attack makes that care irrelevant, because it changes the beneficiary where neither the customer nor the application can see it. This is why banks need protection that verifies the payment itself, from the moment the customer types the beneficiary to the moment it reaches the bank.
Want to know more about how XTN helps protect online banking from payee swap attacks? Contact us at sales@xtn-lab.com.
