Got a final statement by email — real or phishing?
Real final statements arrive by email too. But phishers exploit that exact expectation. 5 verification points prevent damage.
Phishing around final statements spikes around moves and switching moments — exactly when you expect a statement. Five checks: (1) Sender domain — exact "supplier.nl" or subdomain, no "supplier-payment.com" or "invoice-supplier.nl"; (2) Greeting — your name (real) vs "Dear customer" (suspicious); (3) Amount plausible? Compare with your expectation on move/switch — unexpectedly high or low is a red flag; (4) Payment request with IBAN — compare with IBAN on previous invoices; new IBAN with urgency = phishing; (5) NEVER click "pay now" links — log into the official portal or call customer service. When in doubt: forward to customer service for verification, report to Fraudehelpdesk.nl. If paid: immediately call your bank for chargeback.