Dutch tax IBAN fraud risk spikes as Belastingdienst migrates to Rabobank

Dutch taxpayers face a heightened Dutch tax IBAN fraud risk from 1 May 2026, the date the Belastingdienst formally switched its main bank account from ING to Rabobank. The old NL86 INGB 0002 4455 88 has been retired in favour of NL04 RABO 0200 1122 44, an administrative shift that fraud researchers warn creates a textbook social engineering window. Utrecht-based account verification provider SurePay has launched a free public IBAN checker that lets any citizen verify whether an IBAN in a tax payment request actually belongs to the Dutch tax authority.

Why does a bank switch create a fraud window?

Institutional bank migrations are unusual enough that recipients no longer have a stable reference point. When taxpayers expect a new account number, they are conditioned to comply with payment instructions that would normally trigger suspicion. Fraud teams call this an "anticipated change" attack surface, and the same pattern has previously been exploited around supplier switches, corporate mergers, and regulatory cutover dates.

The risk profile matches Authorised Push Payment (APP) fraud, where the victim voluntarily initiates the transfer after being deceived, rather than having credentials stolen. APP fraud has been the dominant payment fraud category in Western Europe for several years because it bypasses traditional bank security controls: the bank sees a legitimate, customer-authorised payment.

SurePay processes more than 20 million IBAN-name checks a day across Europe, a volume that gives a sense of how routinely payment data now needs to be verified before money moves.

How large is the scam problem in the Netherlands?

The Netherlands sits well above the EU average for transfer-based fraud losses. According to the Global Anti-Scam Alliance State of Scams in the Netherlands report, scammers extracted €2.6 billion from Dutch victims in the past year. Twenty-two percent of Dutch adults reported losing money to scams in 2025, and 50% of those losses moved by bank or wire transfer, double the EU average of 25%. That makes bank transfer fraud the single largest loss channel in the country, well ahead of card fraud or cryptocurrency scams.

The threat is also getting harder to detect. A 2025 study by Dutch consultancy

Conclusion found that 78% of Dutch consumers can no longer reliably distinguish AI-generated content from genuine communications. Generative AI has collapsed the production cost of personalised phishing, allowing criminals to send convincing letters, emails, and SMS messages at scale, often with correct branding, accurate citizen reference numbers, and grammatically native Dutch.

What does Verification of Payee actually do?

The structural answer to this category of fraud is Verification of Payee (VOP), a check that matches the entered beneficiary name against the registered account holder before the payment is authorised. The system returns one of four results: match, close match, no match, or unable to verify, and the payer decides whether to proceed.

Since 9 October 2025, VOP has been mandatory for all payment service providers operating in the eurozone under the EU Instant Payments Regulation (Regulation 2024/886). The European Payments Council estimates the VOP rollout could prevent around €2.4 billion in fraud losses annually across the bloc. Non-eurozone PSPs have until July 2027 to comply.

SurePay's free Belastingdienst tool is a consumer-facing application of the same VOP infrastructure it sells to banks and corporates. The checker, which requires no login, returns an instant confirmation of whether a given IBAN matches the Belastingdienst's accounts at Rabobank.

How is SurePay positioned in this market?

Founded in Utrecht in 2016 and originally spun out of Rabobank, SurePay is one of the most established names in European account verification. The company says it serves more than 250 banks and 20,000 organisations across 16 countries. The Belastingdienst itself has been a SurePay client since 2023, using IBAN-name verification on its outbound payments to citizens and businesses. Extending that capability to inbound consumer checks during the migration is a low-cost reputational play that also positions SurePay as the default verification layer for high-profile institutional events.

"This is a textbook fraud window," said David-Jan Janse, founder and CEO of SurePay. "An institution like the tax authority switching bank accounts is a gift to scammers and exactly the moment that criminals thrive on."

Why this matters to FinanceX readers

For finance professionals, the Belastingdienst migration is a live case study in the new economics of payment integrity. APP fraud is now the regulated risk, not the technical one: the EU has decided through the Instant Payments Regulation that payment service providers bear responsibility for preventing transfers to accounts that fail name-IBAN matching, and liability case law is expected to follow through 2026 and 2027.

For banks and PSPs, the question is no longer whether to invest in VOP, but how to differentiate beyond the compliance baseline.

For corporate treasurers, supplier onboarding workflows that do not include account verification now sit outside market practice.

For investors, the regtech and payment-fraud-prevention segment has a clear regulatory tailwind, with incumbents such as SurePay, LSEG Risk Intelligence, and Form3 competing for what is effectively a newly mandatory enterprise software category across the eurozone.