Peppol and invoice fraud: protecting your accounts team in 2026

Since 1 January 2026, VAT-registered Belgian businesses have had to exchange structured electronic invoices with each other. They do so through the Peppol network. A PDF sent by email is no longer enough between businesses. The switch has largely happened. According to the FPS Finance, 1,059,335 VAT payers were connected to Peppol by mid-July 2026, or 89%.

Peppol makes invoicing more reliable, but it does not eliminate fraud. Febelfin says so clearly in its 2026 brochure. Its advice against invoice fraud still applies, including to invoices received through Peppol. Here is what has changed, the fraud scenarios to know about and a simple procedure for your accounts team.

Where the Peppol obligation stands

The FPS Finance granted a tolerance period during the first three months of 2026. The business did, however, have to show it had taken steps "in a timely and reasonable manner". It ruled out any general postponement.

The Royal Decree of 8 July 2025 provides for fixed fines. They amount to €1,500 for a first offence, €3,000 for a second and €5,000 for subsequent ones. As of 3 August 2026, according to Belga, no fine had yet been imposed. The FPS says it prefers a "constructive dialogue". Around 12,000 businesses still had to register. According to the FPS, the other unconnected businesses have no B2B activity.

Small businesses can claim a tax incentive. It is an increased deduction of 120% for invoicing software subscriptions. It applies to the 2024 to 2027 tax periods.

Peppol reduces some risks, not all

Peppol removes one classic attack route: the PDF invoice intercepted in a mailbox or in the post and then altered. Invoices now travel between identified access points. Three limits remain, however.

Identity at registration. Peppol does not automatically check the intentions of those using the network. Banqup Group made this point in an article published in April 2026. That check is left to software platforms and access points. If a supplier's registration relies only on a VAT number, without strict checks, identity fraud remains possible.

Automatically created identifiers. According to Innovate Tax (January 2026), the former Hermes platform automatically generated some Belgian Peppol identifiers. It has been switched off since 31 December 2025. Businesses may therefore have a Peppol identifier in their name without knowing it. The same source cites two Belgian cybersecurity firms, SalesBridge and SafeByte. They showed that it is technically possible to send a legitimate-looking fake invoice through Peppol.

The invoice content. Peppol carries the invoice. It does not guarantee that the IBAN on it really belongs to your supplier.

Three fraud scenarios to know

1. The fake invoice

A fraudster sends an invoice for a service nobody ordered, in the name of a real or fictitious supplier. Febelfin advises never paying a suspicious invoice without checking it first. Make sure you really are a customer of that company or that you ordered something.

2. The IBAN change

This is the costliest scenario. According to Febelfin, fraudsters intercept a genuine invoice or break into a supplier's mailbox. They then replace the account number and send the document again. Sometimes they add a letter or a sticker saying "Warning, account number changed". The request can also arrive as a simple email from the supplier's "accounts department".

3. The fake "Peppol" or "FPS Finance" message

The Peppol obligation and the threat of a fine make a credible pretext: "complete your Peppol registration", "settle your situation before a penalty". As of 14 October 2026, we found no official warning (Safeonweb, FPS Finance) about phishing targeting Peppol. The FPS Finance does regularly warn about fake eBox emails and fake text messages demanding payment of a debt. It reminds the public that it never asks for banking details. Its payments go through MyMinfin or its official accounts.

The seven-step anti-fraud procedure

Febelfin calls accounting staff the "first line of defence". These seven steps follow its recommendations, adapted to the Peppol context.

What your accounts team should pin next to the screen

These rules need no investment. Above all, they need everyone to know them and to feel able to slow a payment down. Febelfin also recommends sharing these instructions with accounts staff and management. They also apply to anyone holding a power of attorney over the company's accounts. A short cyber awareness session with concrete examples helps make them stick.