An IBAN swap is fraud that changes the intended bank account number in a payment flow, usually by replacing the recipient’s International Bank Account Number before the transfer is confirmed. The victim may still believe the payment is going to a trusted payee, while the funds are redirected to an attacker-controlled account.
This matters because it attacks the transaction itself, not just the login. In real intrusions, an attacker may alter web pages with injected JavaScript, compromise a browser session, or manipulate payment details at the last moment. Defenders look for unusual script activity, unexpected changes to beneficiary fields, and verification steps that compare payment data outside the browser. Strong approval workflows, out-of-band confirmation, and anti-tamper controls reduce the risk.