EU e-invoicing directive shifts invoice authenticity governance

At a glance

What this is: The directive standardises structured e-invoicing for EU public procurement and reinforces requirements to prove invoice issuer identity and content integrity.

Why it matters: It matters because invoice workflows sit at the boundary of identity verification, fraud prevention, and digital trust, where weak provenance controls can turn routine payments into control failures.

By the numbers:

• 2018 saw 3,280 invoice and bank mandate scam cases involving businesses.
• £29.6 million of the money lost to invoice, invoice fraud was recovered.

👉 Read GlobalSign's analysis of the EU e-invoicing directive and invoice authenticity

Context

E-invoicing is a governance problem as much as a format problem. Once invoices move from paper and PDF handling into structured digital flows, the control question becomes whether the organisation can verify who issued the invoice, whether the content stayed intact, and whether downstream systems can trust it without manual intervention. That creates a genuine identity and fraud intersection, especially for suppliers serving public sector buyers in the EU.

The directive does not force every organisation to abandon paper invoices, but it does create a compliance and interoperability boundary for public authorities and their suppliers. For international businesses, that means invoice acceptance rules, signature assurance, and document provenance now need to be treated as part of the operating model, not as a back-office formatting detail.

Key questions

Q: What breaks when invoice authenticity controls are missing?

A: Without authenticity controls, organisations can accept invoices that look legitimate but were not issued by the real supplier or were altered after creation. That opens the door to bank detail fraud, duplicate payment abuse, and disputes over who authorised the transaction. In practice, the failure is often discovered only after payment has already left the organisation.

Q: Why do structured e-invoices still need strong provenance controls?

A: Structured formats improve processing, but they do not prove who created the invoice or whether the content was changed later. Fraudsters can still impersonate suppliers, manipulate remittance data, or exploit weak exception handling. Provenance controls matter because automation increases the speed of bad decisions as well as good ones.

Q: How can finance teams know invoice integrity controls are working?

A: Look for low rates of manual corrections, a small number of approved override paths, and clear evidence that signature validation and issuer verification happen before payment approval. If invoices regularly bypass controls through email, spreadsheets, or ad hoc approvals, integrity is not being enforced. The signal is not volume, but how often exceptions are needed.

Q: Who is accountable when a fraudulent e-invoice is paid?

A: Accountability usually spans procurement, finance, and security because the failure often sits between document intake, identity verification, and payment execution. Under the EU model, suppliers to public authorities also need to ensure their invoices meet the required standards. The organisation that pays should own the control chain, not assume the supplier or system did.

Technical breakdown

Structured e-invoice formats and acceptance rules

The directive makes a structured e-invoice the relevant trust object, not a PDF or a scanned image. Public authorities in the EU must be able to receive and process invoices that conform to the European standard, which means systems need deterministic parsing, schema validation, and predictable downstream handling. Where invoices arrive in multiple formats, organisations create conversion points that can distort content or create acceptance ambiguity. The real technical issue is not simply transport, but whether the invoice can be validated automatically end to end without reintroducing manual interpretation.

Practical implication: standardise invoice intake and validation so structured invoices are verified before they reach payment or ERP workflows.

Authenticity of origin and integrity of content

The VAT Directive's authenticity and integrity requirements are the core security concepts here. Authenticity of origin means proving who issued the invoice, while integrity of content means proving the invoice has not changed since issuance. In practice, that is a provenance and tamper-evidence problem. Advanced electronic signatures are one method for binding the issuer to the content, and they are especially useful where invoices must cross organisations, jurisdictions, and systems. If the issuer identity is weak or the document can be altered after creation, the invoice cannot be trusted as a business record.

Practical implication: bind issuer identity to invoice content with verifiable signing controls before invoices enter shared procurement workflows.

Why invoice fraud persists in mixed-channel workflows

Invoices are often accepted through paper, email, portals, and scanned attachments, which creates multiple attack surfaces for fraud. An attacker does not need to break the whole payment process if they can substitute bank details, duplicate a legitimate invoice, or insert malicious content into an attachment. Mixed-channel intake also weakens assurance because the receiving organisation has to decide which source of truth to trust. In identity terms, the problem is not only verifying the sender, but preserving the relationship between the sender, the invoice record, and the payment destination.

Practical implication: reduce channel variety and add verification checkpoints for any bank detail or invoice-origin change.

Threat narrative

Attacker objective: The attacker seeks to redirect payment, submit fraudulent invoices, or corrupt invoice trust so that business systems pay the wrong party.

1. Entry occurs when invoice traffic arrives through email, portal uploads, scanned documents, or paper-to-digital conversion paths that are difficult to verify consistently.
2. Credential or trust abuse follows when attackers impersonate suppliers, alter bank mandate details, or exploit duplicate invoice handling to redirect payments.
3. Impact occurs through fraudulent payment execution, invoice corruption, or loss of confidence in document provenance across procurement workflows.

NHI Mgmt Group analysis

Invoice governance is now an identity problem, not just a compliance problem. The directive makes issuer authenticity and content integrity operational requirements, which pushes invoice handling into the same trust domain as identity verification and digital signatures. When a document can trigger payment, the identity of the sender and the immutability of the record become security controls, not administrative details. Practitioners should treat invoice provenance as a governed trust chain.

Structured e-invoicing creates a useful control point, but it does not remove fraud risk by itself. Standardised formats reduce ambiguity, yet attackers still target the weakest part of the workflow, usually supplier impersonation, bank detail changes, or manual exception handling. The control gap is often the handoff between validated document format and validated business intent. Practitioners should separate format compliance from trust assurance.

Authenticity of origin is the named concept practitioners should operationalise. In this context, it means the organisation can prove which entity created the invoice and that the invoice has not been altered in transit or after issuance. That concept matters because financial controls often assume the document is legitimate once it is machine-readable. Practitioners should require provenance evidence before payment approval.

Outside the EU, suppliers still inherit the governance burden when they invoice public authorities inside the EU. The directive extends practical compliance expectations across borders, which means international billing flows need consistent signing, validation, and evidence retention. This is especially relevant where invoice generation is automated or integrated with ERP and procurement systems. Practitioners should validate cross-border invoicing as part of trust architecture, not local formatting.

Fraud resistance depends on shrinking the number of places where invoice identity can be altered. The more systems that touch the invoice before payment, the more opportunities attackers have to manipulate origin or destination data. Advanced signatures help, but only if the organisation also constrains exception paths and manual overrides. Practitioners should design invoice workflows so trust does not depend on human memory or ad hoc checks.

What this signals

The practical signal for practitioners is that document trust is becoming a programmable control surface. As organisations automate procurement and billing, the boundary between identity proof, document integrity, and payment authorisation gets narrower, which raises the value of evidence-led controls and standardised signing. For teams already managing privileged workflows, the lesson is familiar: trust should be explicit, logged, and revocable, not assumed.

Provenance control gap: invoice workflows fail when organisations cannot prove who originated the document and whether the content stayed unchanged across handoffs. That same pattern appears in other identity-dependent workflows, from supplier onboarding to delegated access approvals, where the absence of verifiable origin creates fraud opportunity. Practitioners should treat provenance as a control objective, not a document feature.

Where invoice systems intersect with digital identity and signed workflows, the governance pattern aligns closely with broader identity assurance thinking. For teams responsible for IAM-adjacent processes, the next step is to align invoice approval, supplier verification, and exception management with controls that can be audited and replayed. A workflow that cannot explain its own trust decisions will not withstand scale.

For practitioners

• Map invoice provenance controls to payment risk Identify where issuer identity, document integrity, and bank detail changes are validated today. Document every manual override between invoice receipt and payment release, then assign an accountable owner for each trust decision.
• Standardise structured invoice intake Use one validated intake path for structured e-invoices and isolate conversion from unstructured formats into a controlled staging step. Reject ambiguous records before they reach ERP or accounts payable workflows.
• Bind signatures to invoice generation workflows Apply advanced electronic signatures at the point of invoice creation so authenticity of origin and integrity of content are preserved before transmission. Ensure signing keys and certificate lifecycle are governed with the same discipline as other sensitive credentials.
• Reduce bank detail change exposure Treat supplier bank mandate updates as high-risk events that require independent verification and dual approval. Compare the change request against known supplier identity data and retain evidence for audit and dispute handling.
• Test exception handling for fraud paths Simulate duplicate invoices, altered remittance fields, and malformed attachments to see where controls fail under pressure. Use those tests to harden manual review thresholds and escalation rules.

Key takeaways

• The directive turns e-invoicing into a provenance and identity assurance problem, not just a format-compliance issue.
• Invoice and bank mandate fraud remains material, with 3,280 reported business cases in 2018 and average losses of £28,000 per case.
• Practitioners should verify issuer identity, lock down exception handling, and make invoice signing part of the control chain before payment is authorised.

Key terms

• Authenticity Of Origin: The assurance that a document or transaction was created by the entity it claims to represent. In e-invoicing, this means the buyer can trust the supplier identity behind the invoice and treat the record as a valid business instrument rather than an unverified message.
• Integrity Of Content: The assurance that a document has not been altered since it was issued. For invoices, this is the control that preserves the business meaning of the record across transport, storage, and processing so that amounts, bank details, and line items remain trustworthy.
• Advanced Electronic Signature: A cryptographic signature designed to bind a signer to a document in a way that can be verified and tamper-evident. In regulated invoice workflows, it helps prove origin and preserve integrity, provided the signing keys and certificate lifecycle are properly governed.
• Invoice Provenance: The traceable path showing where an invoice came from, how it was created, and whether it changed before payment. It combines identity, integrity, and workflow evidence so finance teams can distinguish a legitimate supplier record from a manipulated or fraudulent one.

What's in the full article

GlobalSign's full article covers the operational detail this post intentionally leaves for the source:

• How the EU standard maps to public sector acceptance requirements across member states and cross-border suppliers
• Where advanced electronic signatures fit into invoice generation workflows and what that means for PKI governance
• Which invoice formats qualify as valid e-invoices and how organisations can test interoperability before rollout
• Why GlobalSign's document signing service is positioned for integration into existing invoicing systems

👉 GlobalSign's full article covers directive scope, authenticity requirements, and document signing details.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management in the context of operational trust. It helps practitioners translate identity controls into audit-ready processes across business workflows and security programmes.