Elizaveta SavchenkoAn invoice has landed in your accounting software through Peppol, and you don't recognise the company. Start with the sender's enterprise number: it is in the sender's Peppol ID, usually written as 0208: followed by ten digits. Look that number up in the free KBO Public Search and compare the name, address and status with the invoice. Then check the bank account and, most important, whether you ever ordered what is being billed. Peppol tells you fairly reliably who sent the invoice. It does not tell you that you owe the money.
What Peppol proves, and what it does not
Since 1 January 2026, Belgian VAT-registered businesses have had to exchange structured electronic invoices with each other, and in practice that means Peppol. You cannot join Peppol on your own. A company connects through a certified service provider, also called an access point, and before it does, the provider has to identify it.
The federal e-invoicing portal explains this in Is e-invoicing safe? During registration, the software provider asks for documents confirming the company's identity and checks that the person registering may act for it. A provider that ignores those rules risks losing its certification. That is a real step up from a PDF attached to an e-mail, which anyone can edit.
The same page is frank about the limits. Identification "never eliminates the risk of identity fraud in every transaction if someone gains illegal access to the IT system of the sender or recipient." It describes three measures that work together:
- the service provider identifies the company that sends;
- the bank checks the beneficiary's name against the account;
- you, the recipient, check the substance: were the goods delivered, was the service performed?
Nobody but you can do the third. A real company, correctly registered on Peppol, can still send you an invoice for something you never agreed to.
Read the sender's Peppol ID
A Peppol ID works like a phone number on the network. In Belgium the agreed rule is that every company is registered at least under its enterprise number from the Crossroads Bank for Enterprises (KBO/BCE), with scheme code 0208. Service providers are contractually required to do this (e-invoicing FAQ, question 4). So a Belgian sender's ID typically reads 0208:0123456789, and the ten digits are its enterprise number.
You may also see 9925:BE0123456789. Code 9925 is the Belgian VAT number in the Peppol list of identifier schemes. The FAQ says other identifiers, the VAT number among them, can be used in addition and on a voluntary basis. A Belgian VAT number is the enterprise number with BE in front of it: the notaries' FAQ puts it as the same combination of digits, though the two are not the same thing.
Compare the number in the Peppol ID with the enterprise or VAT number printed on the invoice. If they differ, ask the sender why before you go further.
To see whether a company is on Peppol, the FAQ (question 6) points to Lookup Peppol. Search with 0208: plus the enterprise number; the FAQ's own example is 0208:0308357159, the FPS Finance's registration. Two caveats from the FAQ itself: the tool shows companies that can receive documents over Peppol, and it does not show whether a company can send. A hit confirms the number is registered on the network. It says nothing about the invoice.
Look the company up in KBO
KBO Public Search is free and needs no account. Search by enterprise number rather than by name, so you land on the right company and not on one with a similar name. Then check:
| Field | What to look for |
|---|---|
| Status | Active, or stopped. A stopped company should not be invoicing you. |
| Legal situation | "Normal situation", or a bankruptcy, reorganisation or liquidation. |
| Name, Registered seat's address | The same as on the invoice? |
| Start date | A company set up three weeks ago claiming a long relationship with you is worth a question. |
| Characteristics | "Subject to VAT" if the company is VAT-registered. A company that charges you VAT should have it. |
| Functions | Who runs the company. Useful to know when you call. |
KBO shows what the company registered. It does not show whether the company did any work for you.
Check the VAT number in VIES
For a sender outside Belgium, or as a second check on a Belgian one, the European Commission's VIES tells you whether a VAT number is currently valid. Enter the country code and the number. An invalid result on an invoice that charges VAT is a reason to stop and ask.
Check the bank account
The classic invoice fraud does not need a fake company at all. Fraudsters intercept a genuine invoice, swap the account number for their own and send it on (FPS Economy, in Dutch). Febelfin's advice is plain: compare the account number on the invoice with the one on your order form or the supplier's official website, be extra careful when an invoice mentions a new account number, and be wary of a first invoice from a supplier.
Your bank also helps now. Since 9 October 2025, banks in the eurozone have had to check the beneficiary's name against the IBAN for euro transfers, under EU Regulation 2024/886. According to Febelfin's FAQ, for a business the bank shows the registered name when the name you entered does not quite match. Read that warning. If the account belongs to a company with a different name from the one on the invoice, don't pay. You can override a no-match, but then you carry the risk.
The name check has gaps. It does not cover non-euro payments, card payments, direct debits or QR-code payments, and for transfers sent in a file, businesses can opt out. If your accounting software pays invoices in a batch file, find out whether the check runs on it.
Check that you actually owe it
This is the step from the portal's list that only you can do. Match the invoice against something you already have: a purchase order, a signed quote, a contract, a delivery note, an e-mail where you agreed the price. If there is nothing to match it with, don't pay until the sender shows you what the invoice is based on.
When you need to call the supplier, use a number you already had before this invoice arrived: from your records, the contract or their website. Febelfin says the same: call the number in your own database, not the one printed on the invoice.
Checklist before you pay
- The enterprise number in the sender's Peppol ID (
0208:…) matches the number on the invoice. - KBO: status active, normal legal situation, same name and address as on the invoice.
- KBO: "subject to VAT" if the invoice charges VAT; for a foreign sender, VIES says the number is valid.
- The IBAN matches your order form, contract or the supplier's official website.
- The bank's name check shows a match, and you have not overridden a warning.
- You can point to an order, quote or contract for exactly what is billed.
- If anything is new or odd, you called the supplier on a number you already had.
If you already paid
Contact your bank straight away: it can ask the beneficiary's bank to return the money and try to block the transfer. Then file a police complaint, and report it at meldpunt.belgie.be, which is where the FPS Economy now collects fraud reports.
Why we're writing about this
We built and run Dokus, a finance tool for Belgian small businesses with Peppol e-invoicing built in, so we see how these invoices travel from the inside. On Peppol it is much harder to pass yourself off as another company than it is by e-mail, but whether you owe the money is still something you have to check yourself. If an invoice from an unknown sender is sitting in your inbox, send it to us and we'll tell you what the public registries say about the company behind it.
