Infiltrating the accounting systems of companies and planting huge numbers of fictitious invoices worth tens of millions of shekels within legitimate activity cycles is a new modus operandi of criminal organizations. The aim is clear - to bypass the control mechanisms of the 'Israel Invoices' program, which fights the phenomenon of fictitious invoices, and to continue plundering the state coffers under the guise of innocent business activity.
The method, now being revealed by "Globes," involves hacking into the personal areas of the GOV.IL website of office holders in legitimate companies and using their identities to infiltrate the organizational invoice systems - a trend that has been gaining momentum in recent months.
Company owners and CFOs have reported discovering invoices in their systems that were not issued by them, sometimes for huge amounts of tens of millions of shekels. Others discover the fraud following a request from the Tax Authority for clarification regarding a debt of millions arising from VAT on an unapproved transaction and thus they discover in retrospect that a transaction was carried out in their name that did not take place.
The war on ghost invoices
A tax invoice is the document that allows a buyer to offset VAT and report their expenses for reduced income tax. Every invoice translates into a tax reduction. In a "fictitious invoice", on the other hand, there is no real transaction on paper, or the amount in it is inflated to illegally increase the tax offset.
The phenomenon, which is considered a scourge of the state and a central target in the fight against black money, robs the state treasury of billions of shekels every year. To combat this practice, the "Israel Invoices" program was launched, which allows real-time tracking by assigning approval numbers to invoices. Without approval, the dealer is not allowed to offset VAT or recognize the invoice as a legitimate expense in reports.
The program was introduced as a pilot in May 2024, and entered into full force in January 2025. Since then, the Tax Authority has succeeded in blocking fictitious invoices worth an estimated tax NIS 25 billion in tax - an amount that, if not for the system, would have been stolen from the state coffers. Every month, invoices with a VAT value of about NIS 1 billion are halted, and every week about 1,000 suspicious invoices from about 150 different businesses are blocked. Also, this year, dozens of investigation files were opened in the investigation and assessment units, while at the same time the Israel Police is working to expose these forgery offenses. The success of the program has compelled criminal organizations to change course and develop new and sophisticated methods. The main is hacking into the accounting systems of legitimate and reliable businesses and issuing fictitious invoices from them.
"The country needs to wake up about this."
"We identified that the phenomenon began with the program coming into effect in 2025 and gained momentum," says Yaron Gindi, president of the Tax Consultants Institute. "During the year, tax consultants contacted us and reported that company owners were complaining about invoice hacking. At first, they didn't understand how it was done, and that the criminals had simply entered the personal area and generated invoices through their account."
As part of the new method, the criminals are looking for legitimate and reliable companies, whose invoices the Tax Authority is not inclined to stop. The infiltration is carried out in a variety of ways: hacking into the emails or phones of officials and stealing passwords, identity theft, or fraudulently obtaining access details. Once access is gained, the "infiltrator" enters the personal area and generates fictitious invoices without hindrance.
This has already happened three times to Shimon, a building contractor in central Israel. "In July, they broke into my personal area and in one night they generated invoices worth NIS 16 million shekels," he recalls. "As a result, the Tax Authority canceled my automatic approvals, and now I am required to attend a hearing for every invoice I issue. You can't run a business like that."
Three weeks ago it happened again, when he discovered 'ghost invoices' totaling NIS 7.5 million that were issued overnight. "I filed a complaint with the police and reported it to VAT, but they told me there was nothing they could do and that I would have to prove at a hearing that every transaction I made was genuine."
This week, the third attempted break-in was recorded. "On Friday morning, I received an email from the National Insurance Institute with a one-time login code. My IT guy immediately realized that I had been hacked and ordered me to change all my passwords. It turns out that they had extracted all the information from there. That same day at noon, they had already tried to connect to the Tax Authority through my email again." According to Shimon, this is a national disaster: "The criminals are celebrating and my business is stuck. Every day I hear about more contractors who have been hacked. The country needs to wake up about this."
Proof that 'Invoices for Israel' is effective
If initially the scope of the "infiltrating" invoices was limited, today the criminals are acting with increasing boldness. "In the past, we identified this with small customers, where they issued invoices in their names for small amounts so that they would not be noticed," says Gindi. "Recently, we are seeing it in huge companies, where invoices for tens and hundreds of millions of shekels are issued that are swallowed into ongoing activity."
Gindi describes a case that came to his office not long ago: "A large and well-known contracting company, which routinely issues invoices for millions, discovered that fictitious invoices for huge amounts had been issued in its name. I immediately contacted the Tax Authority and they were able to stop them in time. There were also cases where company owners reported that they saw in real time someone issuing invoices from their account in the middle of the night."
According to him, the phenomenon is ironically evidence of the success of the system: "This proves that the 'Israel Invoices' program works. The criminal organizations that generate black money have been pushed into a corner and are looking for creative ways to circumvent the new mechanism. Hacking legitimate businesses is one of them, and business owners must be vigilant."
"We don't wait for reports - we act"
A series of similar cases also reached the desk of Adv. Uri Goldman, an expert in the prohibition of money laundering and taxes. "Many company owners are currently dealing with this loophole," he says. A notable case is of a company owner who wanted to sell it as a "skeleton" and fell victim to a scam: "A person posing as a lawyer claimed that he was interested in purchasing it. While the company owner was in the army reserves, the impostor asked him for the smart card code to 'check details in the Companies Registry.' The company owner trusted him and gave him the password. Within three minutes, the criminal took control of the company, appointed a front man as director and issued fictitious invoices for NIS 7 million." The young reservist was summoned for questioning on suspicion of fraud, and only after an effort was he able to convince the Tax Authority that he had fallen victim to a sting.
"We are aware of the phenomenon of criminals entering the shoes of legitimate companies through phishing or identity theft," confirms a senior official at the Tax Authority. "This is not a hack into the authority's systems, but rather 'proper' identity theft. Once the door is open, they can submit reports and create fictitious invoices without hindrance."
According to the official, the financial scope of this method is still relatively low: "Today, it concerns only one percent of all fictitious invoices that we expose. We expose invoices worth about a billion shekels of VAT per month. We don't wait for reports but rather use AI and cyber tools to identify phishing and identity theft sites in real time. In many cases, we manage to take down these infrastructures before a single identity is stolen."
Published by Globes, Israel business news - en.globes.co.il - on February 4, 2026.
© Copyright of Globes Publisher Itonut (1983) Ltd., 2026.