Recognising fake invoices, phishing and invoice fraud as a business owner
Written by Ilias Aarrass5 min read · Published on · Last reviewed on 
In short
A fake invoice is a bill for something you never ordered, phishing is a bogus message on behalf of, for example, the tax authorities or KvK, and with invoice fraud everything is correct except the IBAN. The KvK never sends an annual invoice and the tax authorities never send payment requests via a link; report suspicious emails to valse-email@kvk.nl or valse-email@belastingdienst.nl.
- The KvK only charges a one-off registration fee, € 85.15 in 2026.
- Always verify a changed IBAN by phone on a number you already had.
- If in doubt about a message, log in yourself through Mijn Belastingdienst Zakelijk or Mijn KVK.
- Already paid: call your bank at once, report it to the police and notify the Fraud Helpdesk.
As soon as you are registered with the KvK, your business details are public. That attracts not only clients, but also fraudsters. They send invoices for services you never ordered, emails that look as if they come from the tax authorities or the KvK, or a copied invoice from a real supplier with a different account number. Especially in busy periods you pay such an invoice faster than you think. This article explains how to recognise the three forms, how to set up your administration so they have less chance and what to do if you have paid anyway.
Three forms side by side
Most fraud with invoices and messages falls into one of these three groups:
| Form | What it looks like | Tell-tale sign |
|---|---|---|
| Fake invoice | Bill for a listing in a register, directory or database you never ordered | You cannot find the order anywhere in your records |
| Phishing | Email, text or WhatsApp on behalf of the tax authorities, KvK or bank with a link | Urgency, threat of a fine or a request to log in or pay through a link |
| Invoice fraud | Genuine-looking invoice from a known supplier, but with a different account number | Notice that the IBAN has changed, often by email |
Fake invoices and bogus registers
The KvK never sends an invoice for an annual contribution to the Business Register. You only pay a one-off registration fee when you register, € 85.15 in 2026. If you receive a bill with a name resembling the KvK, or a payment slip for a 'business register' or 'trade directory', that is a fake invoice or an offer disguised as an invoice. Read the small print: it often says that paying means agreeing to a subscription.
You see the same trick after registering a trademark or a domain name: shortly afterwards, official-looking invoices arrive for 'publication' or 'renewal' from parties that have nothing to do with BOIP or your registrar.
Phishing on behalf of the tax authorities and KvK
The tax authorities never send direct payment requests, no messages about payment arrears via WhatsApp or email, and never ask for personal data or for money to be transferred through a link. The KvK does not issue fines, does not threaten by email or text to withdraw your KvK number and does not send texts or WhatsApp messages with links. Common pretexts are a mandatory re-identification, UBO registration, a VAT refund or a new digital key.
If in doubt, do not click, but log in yourself through Mijn Belastingdienst Zakelijk or Mijn KVK. If the message is not there, it is fake. Only log in with your own eHerkenning or DigiD via the official website.
Invoice fraud with a changed IBAN
In invoice fraud, criminals copy a genuine invoice, or take over a mailbox and send a message that the account number has changed. Everything is correct, except the IBAN. So build these checks into your monthly routine:
- Compare the IBAN with earlier invoices from the same supplier.
- If the account number has changed, call the supplier on a number you already had, not the one in the email.
- Pay attention to your bank's name check: if the name does not match the IBAN, do not pay.
- Only pay invoices that match an order, quote or contract.
What to do if you are in doubt or have already paid
If you have not paid yet, do not pay and do not respond. Forward suspicious emails as an attachment to valse-email@kvk.nl or valse-email@belastingdienst.nl. If you have already paid, contact your bank immediately to try to recover the payment, report it to the police and notify the Fraud Helpdesk (Fraudehelpdesk). The faster you act, the greater the chance the money is still in the recipient's account. Also read: Paying tax: the new account number and the payment reference.
Frequently asked questions
Do I have to pay a fake invoice?
No. If you ordered nothing, there is no agreement and you do not have to pay. Do not pay just to get rid of it either, because payment can be interpreted as agreeing to a subscription.
Does the KvK send an annual invoice?
No. You only pay a one-off registration fee, € 85.15 in 2026. An annual bill for the Business Register is always fake.
Sources
- Do not fall for invoice fraudKVK · kvk.nl
- Did KVK really send this message?KVK · kvk.nl
- Fake messages, emails and phone callsBelastingdienst · belastingdienst.nl
Sources checked on
This article provides general information based on the rules known for 2026 and does not replace personal tax advice. For your specific situation, we're happy to take a look with you.
