Reshare — content by Romaric PINSET LEPRETRE
I wanted to test the security of electronic invoicing, and here is what I found.
Right format, right supplier, wrong bank account and wrong sender!
The scenario is simple.
A fraudster impersonates your real supplier. Their electronic invoice uses their name, their SIREN and their VAT number. Only one thing changes: the IBAN, which is theirs.
If it gets past your internal controls, they get paid.
It reaches you because the approved platform authenticates the sender of the file. But in the invoice itself (UBL, CII or Factur-X), the seller is simply declared. And standard Odoo never compares the two.
This is what is called SPOOFING: a fraudulent way of falsifying the sender.
Odoo creates the IBAN on the contact record, with no enhanced verification procedure; you validate based on the invoice and you pay.
Detection is technical and invisible to you:
– you have to look at who actually sent the invoice: the sender authenticated by the platform
– compare their SIREN with the legal identity of the seller written in the invoice (identifier, legal entity, VAT)
– if they do not match, block the invoice before paying it
This is exactly what my module does, for Odoo 17 to 20:
– in case of a discrepancy: red banner, note in the history and double validation before confirmation/accounting
Do you want the module?
Comment SPOOFING and I will send you the Odoo module
#Odoo #RFE #CyberSecurity FNFE #Spoofing #ElectronicInvoicing #Accounting #PEPPOL
Clement Julien Julien
LinkedIn Sources
- Profile: Pierre Jean Duvivier dit Sage (LinkedIn)
- Shared author: Romaric PINSET LEPRETRE (LinkedIn)
The post I wanted to test the security of electronic invoicing, and here is what I found. appeared first on les plumes qui mordent.
Frequently Asked Questions
FAQs Testing the Security of Electronic Invoicing
1 What is electronic invoicing
Electronic invoicing is the automated creation sending and processing of invoices in a digital format between businesses or between a business and a government systemno paper involved
2 Why would someone test the security of an einvoicing system
To find weaknesses before attackers do Invoices carry sensitive financial and personal data so testing helps prevent fraud data leaks and tampering
3 What are the most common security problems in einvoicing systems
Weak authentication unencrypted data in transit or at rest missing signature verification invoice tampering and phishingstyle fake invoice injection
4 What does invoice tampering mean
Its when someone changes invoice detailslike amounts bank account numbers or recipient infoeither in transit or in storage so the payment goes somewhere it shouldnt
5 How can I tell if an invoice has been tampered with
Check for a valid digital signature and verify it against the senders certificate If the signature is missing invalid or doesnt match the content treat the invoice as suspicious
6 What is a digital signature in einvoicing
A cryptographic seal that proves who created the invoice and that it hasnt been altered since Its the main defense against tampering and impersonation
7 Do I need encryption if I already use digital signatures
Yes Signatures prove integrity and origin encryption protects confidentiality You generally need both
8 Whats the difference between authentication and authorization here
Authentication confirms who a user or system is Authorization decides what theyre allowed to do once verified
9 What is a common beginner mistake when testing einvoicing security
Only testing the happy pathsending a valid invoice and confirming it arrives Real testing means trying invalid signatures malformed files duplicate invoices and unauthorized access
10 How do I test whether an einvoicing system rejects fake invoices
Send test invoices with invalid or missing signatures altered amounts and spoofed sender details The system should reject or flag every one of them
11 What is invoice fraud and how does it relate to security testing
Invoice fraud is tricking a business
