From login to payment: how to protect your iBanFirst account from fraud

You probably open iBanFirst to do something routine: check a balance, add a beneficiary, prepare a payment or approve a transaction before the day’s cut-off. But these are exactly the moments fraudsters target.

A fake login page can capture your credentials. A convincing email can redirect a genuine supplier payment to a different account. An attacker may even trigger an approval request and rely on you accepting it without checking the details. The techniques are becoming harder to spot, and one successful attempt can have a devastating impact on your cash flow and day-to-day operations.

That's why security works best as a partnership. iBanFirst provides a secure platform and the controls that help protect your account and payments. You and your team decide who can access the account, what each user can do and whether a payment should go ahead. We take security seriously because your business does too.

To help you make the most of your iBanFirst account, we’ve brought together practical guidance specifically for our clients. We’ll show you how to reach the genuine iBanFirst login page, verify your login in the iBanFirst authentication mobile app, give the right people the right permissions and stop a suspicious payment before it leaves your account.

 Payment fraud rarely starts with a dramatic red flag. It often begins with something familiar: a supplier email, a routine login or an urgent request from a senior colleague. Fraudsters succeed when they make an unusual action feel normal, so the most effective teams build in a pause before anyone approves access or moves money. 

 Florent Gilain, Chief Information Security Officer at iBanFirst  

1. Start with the genuine iBanFirst login page

Your security journey starts before you enter your credentials. An attacker may create a fake website that looks almost identical to the real one and use it to capture your details.

Before you do anything else, make sure you are in the right place.

We recommend bookmarking the official iBanFirst login page and using it whenever you sign in. Do not follow login links in unexpected emails, messages or paid ads on Google.

You should also:

• Check the website address before entering your credentials
• Avoid signing in on shared or public devices
• Never share your iBanFirst user account with a colleague
• Never store your credentials in an email, spreadsheet or shared document
• Contact iBanFirst if you are unsure whether a login page or message is genuine

iBanFirst will never ask you for your user ID, password or authentication approval. If someone requests these details, do not share them. Always contact your Account Manager through a trusted channel.

iBanFirst protects the platform. You help protect your account by making sure you access the genuine one.

Bonus tip: Don’t save your password in your browser

Browser password managers are convenient, but saved credentials can be stolen from browsers and appear on the dark web. Avoid saving your iBanFirst password in your browser. Use a company-approved password manager instead.

2. Verify your login request in the iBanFirst mobile app

Once you have reached the official login page, look at your phone before you continue.

The iBanFirst authentication mobile app handles every authentication on the platform. It sends you a separate notification for each request and shows you what you are being asked to approve.

You can use the mobile app to approve or deny:

• Login attempts
• Payments
• Currency exchanges
• Beneficiary creation or updates
• New users and entities

This gives you a clear view of each operation instead of approving several actions with one general code.

If you receive a login notification that you did not initiate and do not recognise:

• Deny the request

• Check whether someone in your organisation may have triggered it

• Review recent login activity and connected devices

• Contact your Account Manager or the iBanFirst support team if you do not recognise the activity

You can find more information about our mobile app in the Help Centre:

• How to install and use the iBanFirst authentication mobile app
• iBanFirst authentication app FAQs

 iBanFirst shows you what is happening. You decide whether the request is genuine.

3. Check who can access your account

Getting through the door is only the first check. Next, take a look at who else has access to your iBanFirst account and what they can do.

Not everyone on your team needs the same permissions. The colleague who checks balances does not need to create beneficiaries. The person who prepares payments does not necessarily need to approve them.

Use your iBanFirst user roles to match access to each person’s responsibilities:

• Give administrators access to user management and account settings
• Give payment users access to the payment and currency exchange functions they need
• Create custom permissions for specific responsibilities
• Use read-only access for colleagues who only need to view accounts, transactions or documents

Review your user list regularly. Remove access as soon as someone leaves your organisation or changes role. Individual accounts also make it easier to identify who initiated or approved an operation, so avoid shared logins.

iBanFirst gives you control over access. Your team keeps that access accurate and up to date.

4. Review your connected devices

Your account security also depends on the devices linked to it.

In Security and devices, you can review recent login activity and look for anything that does not match your team’s usual activity. That might include an unfamiliar device, location, operating system, browser or login time.

If a device is lost, stolen or no longer in use, lock it promptly. If you do not recognise a login attempt, deny it in the iBanFirst app and contact iBanFirst through a trusted channel.

Ask your team to report lost phones or suspicious activity immediately. The faster you know about a problem, the faster you can take action.

5. Prepare payments using your validation rules

Security isn't only about keeping the wrong people out. It's also about making sure the right people can only do what their role requires. Your iBanFirst payment validation rules can help you build those checks into the payment process. You can use them to:

• Separate payment creation from payment validation
• Require more than one signature
• Set payment thresholds for individual users
• Require approval from different teams, entities or locations

A payment should not depend on one person spotting everything at the last minute. For example, one colleague could prepare a payment while a finance manager validates it. A high-value payment could also require approval from both a local entity and your central finance team.

These rules make the secure process part of your normal workflow. They also help prevent one person from creating and approving a payment without an additional check.

Remember that collecting the required signatures does not automatically execute the payment. Your team must still complete the final validation on the platform.

Review your validation rules whenever someone joins or leaves the finance team, a colleague changes role, you add a new entity or your approval structure changes.

iBanFirst gives you the controls. Your team applies them consistently.

 Strong payment security does not depend on one tool or one vigilant employee. It comes from several controls working together: individual access, clear permissions, separate payment preparation and approval, and independent checks on beneficiary details. When those controls become part of the workflow, the safe decision becomes the easy decision. 

 Florent Gilain, Chief Information Security Officer at iBanFirst

6. Verify every new or changed beneficiary

Here’s the uncomfortable part: a genuine supplier payment can still become a fraudulent payment if someone changes the bank details.

A fraudster may impersonate a supplier, compromise an email account or alter the payment details on a genuine invoice. The supplier name may look correct and the invoice may appear familiar. Only the beneficiary details have changed.

That is why the beneficiary check matters before you approve the payment. Whenever you add a beneficiary or modify an existing one, use Verification of Beneficiaries (VoB) in iBanFirst where available. VoB checks whether the beneficiary’s account details match the name you entered. You may receive one of three results:

• Match: the account details match the information provided.
• Partial match: some details require further review.
• No match: the account details do not match the information provided.

VoB applies to EUR and GBP payments involving recipients in the Eurozone or the UK, including certain cross-currency scenarios. When payment details do not match and for payments outside SEPA, confirm the details directly with your contact before initiating the transfer.

If you receive a partial match or no match, pause the payment. Contact your supplier through an independent channel and confirm the details using a telephone number or email address already held in your records

Do not use the contact details included in the request. A fraudster may have provided them or compromised the sender’s mailbox.

iBanFirst checks beneficiary details where the service applies. You investigate anything that does not match.

Read more about preventing beneficiary fraud.

7. Do not let urgency override your process

Fraudsters know that finance teams work to tight deadlines. They may claim that a payment needs to go out immediately because of a missed deadline, a supplier emergency or a request from a senior executive.

Be careful when a payment request includes:

• Pressure to pay immediately
• A request for confidentiality
• A sudden change to bank details
• A new supplier contact
• A new account, country or currency
• A request to bypass a second approval
• A change in tone, writing style or email address
• A lookalike domain or unfamiliar reply-to address

That pressure is part of the attack. It's designed to make you skip the checks you would normally complete. A senior colleague’s name does not replace your approval process. A familiar supplier name does not guarantee that the bank details are correct.

If a request feels unusual, pause it. Contact the person or supplier through a known channel and ask another colleague to review the request.

A short delay to verify the details is better than sending a payment to the wrong account.

8. Review each payment before you approve it

When you receive a payment approval request in the iBanFirst app, take a moment to review what you are authorising. The request may look familiar but that's not a reason to click through automatically. Check the details against the invoice, the supplier relationship and your usual payment process.

Remember to check:

• The beneficiary details
• The payment amount
• The currency
• The payment reference and/or purpose
• Any recent changes to the supplier’s instructions
• Whether the payment has received the required approvals