Missing Trader Fraud: How to Prove the Transaction Behind the Invoice Was Real

Updated on September 15, 2026

Every business receives supplier invoices and uses them to recover input VAT and deduct the cost. For most finance teams the invoice, the purchase order and the bank transfer close the file. Missing trader fraud breaks that habit. When a supplier turns out to be a company that charged VAT, kept it and vanished, the tax authority does not stop at the fraudster: it looks at every buyer in the chain, including the ones that acted in good faith.

Two cases closed by the Italian financial police in September 2026 show how quickly the question reaches your desk: a EUR 60 million carousel run through ten shell companies, and building works genuinely carried out but re-documented afterwards under fictitious contractors. In both, the invoices were formally impeccable. What was contested was whether the transaction behind them was real: who performed it, when, and with which goods or people.

The defence is not a thicker folder assembled once the audit letter arrives. It is evidence acquired at the source while the supply happens, with a date nobody can move: the delivery photographed at unloading, the site progress recorded week by week, the supplier’s website captured on the day you relied on it. That is the distinction TrueScreen is built around: it does not certify the invoice, it certifies that the supply behind the invoice existed.

What missing trader fraud is and why it reaches honest buyers

Missing trader fraud is a VAT fraud in which a supplier charges VAT on a sale, keeps it instead of remitting it, and disappears. The buyer normally recovers that VAT as input tax, so the treasury refunds money it never received. Authorities then seek recovery from whoever is still trading, and that is frequently the buyer.

Missing trader fraud is a scheme in which a VAT-registered business, the “missing trader”, buys goods VAT-free from another EU member state, sells them domestically with VAT, and disappears without paying that VAT to the state. Europol describes the standard cast: the missing trader, one or more buffer companies that add layers of apparently normal trading, a broker that sells the goods on or re-exports them and claims a VAT refund, and a conduit company in another member state that restarts the loop. Europol calls it MTIC, missing trader intra-community fraud. The European Commission’s VAT gap study on 2023 data puts the EU compliance gap at EUR 128 billion, 9.5% of the VAT theoretically due, and estimates MTIC alone at EUR 12.5 to 32.8 billion a year over 2010-2023. Recovery begins with the invoices found in the books of buffers and brokers, which is why honest buyers end up defending purchases they thought were closed.

Fictitious supplies, wrong counterparty, inflated amounts

False invoices fall into three groups, and the group decides what you will have to prove. The missing trader and buffer scenario is the hardest for a buyer: the goods are usually real, the seller is a front, and the paperwork looks ordinary. In many jurisdictions the consequences are the same whichever group applies: VAT deduction refused, cost challenged, penalties, and criminal exposure where intent is shown.

Carousel fraud and shell companies: the September 2026 cases

Carousel fraud is missing trader fraud run in a loop: the same goods, or the same invoices, cross a border, pass through a missing trader and a buffer, are sold by a broker who reclaims the VAT, and return through a conduit company to start again. Each turn extracts VAT that was never paid. On 11 September 2026 the Italian financial police in Avellino closed a tax audit on a carousel worth more than EUR 60 million: ten shell companies across Italy issued invoices for non-existent transactions to an electronics retailer with several stores, and more than EUR 7 million of VAT was evaded. The shell companies fit the usual profile of a shell company supplier: no premises, no staff, no vehicles, directors replaced in quick succession, and a turnover their structure could not have handled.

The second case is more instructive for an honest business. On 3 September 2026 the financial police in Florence and Teramo seized EUR 17.6 million from five suspects. The renovation of two apartment buildings in Trani had actually been done, but the documentation was rewritten after the fact with fictitious companies in place of the real contractor, feeding roughly EUR 100 million of non-existent tax credits. Real work, wrong evidence: once the record had been rebuilt afterwards, nothing in it could be trusted, including the parts that were true.

Why the invoice alone is not enough: burden of proof and good faith

Under EU VAT law the invoice is a formal condition for deduction, not evidence that the supply took place. When your supplier turns out to be a missing trader, the authority has to show that you knew or should have known. Once it produces objective indications, the practical burden moves to you: show the supply was real and that you took reasonable care.

The right to deduct input VAT rests on Article 168 of the VAT Directive 2006/112/EC, which requires goods or services actually supplied to you for your taxable activity; Article 178 adds the invoice as a formal requirement for exercising that right. The Court of Justice drew the consequence in Kittel (C-439/04), decided in 2006: deduction may be refused only where the taxable person knew or should have known that the purchase was connected with VAT fraud. In Mahagében (C-80/11), decided in 2012, the Court added that authorities cannot demand generalised checks on suppliers as a condition of deduction, nor refuse it merely because irregularities occurred upstream. HMRC applies the same test in its VAT Fraud Manual, VATF50000, where it is called the Kittel principle. A bank transfer proves that money moved. It does not prove that goods moved, or that work was done.

What the tax authority has to establish

The authority carries the first step. It must show that the supplier was not the real operator behind the supply, and point to objective factors suggesting you knew or should have known: a price below any plausible market level, a new supplier handling large volumes from day one, payments routed to accounts that do not match the invoice. Inference is enough at this stage. What it may not do, following Mahagében, is hold you liable for the supplier’s failings alone.

What you have to show: the supply was real and the supplier was checked

Your side has two limbs, and they need different documents. The first is the reality of the supply: goods arrived, work was done, people were on site, on identifiable dates and in identifiable places. The second is diligence on the counterparty: what you checked, and when. A correct invoice, a clean ledger and a traceable payment prove neither; they are exactly the documents a fraud is designed to generate. Even the integrity of your archived electronic invoices proves that the document is the one you received, not that the supply existed.

What an audit looks for: the signs that the supply took place

An auditor reconstructs the physical and human side of the transaction: where the goods came from, who moved them, who received them, who did the work and with what equipment. That picture is compared with the supplier’s real capacity. Only then comes the question of what you knew at the time.

Evidence of the supply: goods, works, people

For goods, the strongest single document is the delivery note completed at unloading and tied to what was actually on the truck. A certified delivery note photographed with the load, the labels and the vehicle plate answers three questions at once: what arrived, when, and from whom. For works and services, the equivalent is the trail of daily records: site diary, timesheets, progress valuations at each stage. Businesses use TrueScreen to build one evidence file per supplier: photographed deliveries, certified delivery notes and timesheets, and correspondence captured with evidentiary value.

Evidence of your diligence on the supplier

The second limb is about you, and it is judged as of the date you traded. A registry extract pulled during the audit describes the supplier as it is today; the one that helps is the extract you pulled before the first order, showing an office, a director and a capital consistent with the volumes involved. The same goes for the VAT number check and the supplier’s website: each loses most of its weight if you cannot show when you looked. You can certify the correspondence with the supplier as it arrives and capture the supplier’s website with evidentiary value on the day of the check. This is ordinary commercial care, not the general investigation Mahagében excludes, fixed in time with TrueScreen, which records the date, content and origin of every element.

How to build an evidence file with a certain date

A certain date is a date a third party cannot dispute because it does not depend on your own systems or your own word. In the EU the instrument for that is the qualified electronic timestamp under the eIDAS Regulation, which carries a legal presumption that the date is accurate and the data unchanged. The file is built per supplier, while the supply happens.

Certain date and integrity: why “afterwards” is not worth “during”

Evidence acquired while a supply happens and evidence reconstructed after an audit begins are not the same thing, even when they describe the same facts. The Florence and Teramo case makes the point: the works in Trani were real, but the record of who had done them was rebuilt afterwards with fictitious contractors, and EUR 17.6 million was seized. A document produced after the contestation carries the suspicion of having been produced for it. Article 41 of the eIDAS Regulation 910/2014 removes that suspicion for anything bearing a qualified electronic timestamp: the date and time are presumed accurate and the data bound to them are presumed intact. Article 35 gives the qualified electronic seal a matching presumption of integrity and origin. A photograph of a pallet sealed and timestamped eighteen months before the audit cannot have been staged for the audit.

None of this requires cryptography in the boardroom. It requires a habit: capture at the moment, in a controlled environment where the file cannot be edited during acquisition, with a record of who captured what, when and from which device. That record is the digital chain of custody; the legal value of qualified electronic timestamps turns the habit into documentation with evidentiary value, and ISO/IEC 27037 supplies the acquisition method.

Worked examples: a construction subcontractor and an electronics reseller

Take a subcontractor who bills the main contractor monthly against progress valuations. Eighteen months later the main contractor is qualified as a shell and the invoices are challenged as documenting work never done. A photo report for each valuation date, a site diary certified entry by entry and timesheets naming the crew put a dated record of the work itself in the way of that challenge. The construction progress photo reports and certified site inspections lenders already rely on serve this purpose, and the way work progress photo evidence has been weighed on appeal shows what a court does with it.

Now take an electronics reseller buying from a new distributor at an attractive price. Before paying, the reseller certifies the order confirmation email, photographs the delivery with labels and serial numbers at goods-in, and captures the distributor’s website the day the account is opened. If the distributor later proves to be a buffer in a carousel, the reseller can show when the goods arrived and that the checks came before the first euro left the account.

How do you certify the evidence that a supply actually took place?

Certifying the evidence of a supply means acquiring photos, videos, documents, emails and web pages with a forensic methodology at the source, so that the content cannot be altered during acquisition and any later change is detectable, and then binding each item to a qualified electronic timestamp and an electronic seal. TrueScreen, the Data Authenticity Platform, lets you do this from the warehouse, the building site and the finance desk, following the ISO/IEC 27037 method for digital evidence. TrueScreen does not certify the invoice: it certifies that the supply behind the invoice existed. Three families of evidence come out of it: certified photos and videos of goods and works with date, time and location; delivery notes, timesheets and progress reports acquired with seal and timestamp; and supplier emails and web pages captured with evidentiary value. Each certification produces a package that anyone can verify without TrueScreen, so the file you hand to an auditor stands on its own.

Certified photos and videos of delivered goods and work in progress

A certified photograph is one acquired in real time by the TrueScreen app in a controlled environment, with date, time and GPS position recorded during capture rather than added afterwards. The warehouse worker at the loading bay and the site manager on the scaffold use the same app, and both can work offline: the acquisition is stored on the device and synchronised later. Real-time capture carries more weight than a file imported from the phone’s gallery, although both are certified.

Delivery notes, reports, emails and supplier web pages acquired with evidentiary value

Documents that already exist in digital form are handled from the desk. The web portal certifies delivery notes, progress reports, timesheets and any file by content and hash. Email certification captures the order confirmation or the supplier’s reply with its headers and attachments, which matters when the question is who agreed what and on which day. For the supplier’s website and any online area you relied on during onboarding, the Forensic Browser acquires the pages in a controlled session and records the network traffic as well, the most robust option for a web page.

A file ready for the tax authority and the court

Every certification produces a ZIP package containing the original files, a PDF report, a JSON report and an XML file carrying the electronic seal and the qualified timestamp. The package is self-contained: an auditor, an opposing expert or a judge can verify its integrity and seal without contacting TrueScreen and without trusting whoever handed it over, and it remains verifiable after the underlying certificate expires. You can also enable a supplier to certify: share the acquisition method by email, and the delivery it documents lands in your workspace already certified and filed.

Picture an electrical contractor receiving forty pallets of electrical material from a new supplier. At unloading, the warehouse worker photographs the load, the labels and the delivery note with the app. In the office, finance certifies the order confirmation email and captures the supplier’s “about us” page and company registry extract. Eighteen months later the supplier is qualified as a missing trader. The file shows goods, date, place and counterparty, and the diligence exercised before the first order, not after the audit letter.

FAQ: missing trader fraud and the evidence buyers need

What is missing trader fraud?
+

Missing trader fraud is a VAT fraud in which a business charges VAT on its sales, keeps the money instead of paying it to the tax authority, and disappears. In its intra-community form, described by Europol as MTIC fraud, the goods are bought VAT-free from another EU member state and sold domestically with VAT. The European Commission estimates MTIC at EUR 12.5 to 32.8 billion a year across the EU.

What is the difference between missing trader fraud and carousel fraud?
+

Missing trader fraud is the basic act: a supplier collects VAT and vanishes. Carousel fraud is the same act repeated in a loop, with the goods or invoices passing through a missing trader, buffer companies and a broker, then re-exported through a conduit company to start again. The roles are set out on Europol’s MTIC page. Every carousel contains missing traders; not every missing trader is part of a carousel.

What does "knew or should have known" (the Kittel principle) mean for a buyer?
+

It is the test the Court of Justice set in Kittel (C-439/04): a buyer loses the right to deduct VAT only if it knew, or should have known from objective factors, that its purchase was connected with fraud. HMRC applies it under the same name in its VAT Fraud Manual. For a buyer, it means the checks you ran, and when you ran them, are what decides the case.

Is a bank transfer enough to prove a transaction was real?
+

No. A bank transfer shows that money left your account for a named payee. It does not show that goods were delivered, that work was performed, or that the payee was the company that actually supplied them. Under Article 178 of the VAT Directive the invoice is a formal condition for deduction; the underlying supply is what has to be shown, with delivery notes, dated photographs, site records and correspondence.

What evidence proves that goods were delivered or work was done?
+

For goods: a delivery note completed at unloading, photographs of the load, labels and serial numbers taken on arrival, and the order confirmation from a named contact. For work: a site diary, timesheets, progress valuations and a photo report at each stage. The evidence weighs more when it carries a qualified electronic timestamp, which under Article 41 of the eIDAS Regulation is presumed accurate as to date and integrity.

Can a business acting in good faith lose its VAT deduction?
+

It should not, but it has to show its good faith. The Court of Justice held in Mahagében (C-80/11) that authorities cannot refuse deduction merely because the supplier committed irregularities, nor require generalised checks from the buyer. The buyer that documented the supply and its supplier checks at the time keeps the deduction; the one relying on invoice and payment alone is exposed. A related risk is invoice fraud with a swapped IBAN.

Does evidence collected after the audit starts carry less weight?
+

Usually yes, because a document created after the contestation can be suspected of having been created for it. The Florence and Teramo case of September 2026, where real works were re-documented afterwards under fictitious contractors, shows how a rebuilt record contaminates even the true parts. A qualified electronic timestamp applied at capture removes the doubt, because the date is presumed accurate under eIDAS Article 41.