eInvoice Viewer — Inbound Check – Manual

1 · Overview

The Inbound Check is an add-on for the WordPress plugin "eInvoice Viewer for PEPPOL & EN16931". It adds the button Inbound Check to the viewer's result view. The viewer answers the question whether an invoice can be read. The Inbound Check answers a different question: does this invoice fit you? It compares the invoice with your own company data and with a supplier list that you keep on your own site.

The add-on is meant for everyone who looks at incoming invoices before payment, such as accounts payable or the management of a small business.

What the Inbound Check does:

• It compares the buyer's name, VAT ID and address on the invoice with your company.
• It checks whether the mandatory details under VAT law are present, according to EU law and, depending on the setting, additionally according to the German or Austrian VAT act.
• It looks for the seller in your supplier list and checks whether the invoice's bank account is already known there.
• It reports when the invoice names a different payee than the seller.
• It compares the purchase order reference and the contract reference with the patterns you have stored.
• It compares currency, due date and the seller's country with what you have stored about the supplier.
• It lets an administrator adopt a new bank account into the supplier list with one click.
• It reads and writes the supplier list as a CSV file.

What the Inbound Check does not do:

• It does not read the invoice itself. It works with the invoice data the viewer has already read.
• It calls no outside service. So it does not check whether a VAT ID or an IBAN actually exists, only whether it fits your stored data.
• It stores no invoice and keeps no record of the checks.
• It does not compare the bank account of a separate payee. For a payee of its own, only the name is compared.
• The check of the mandatory details is a formal check and not tax advice.

Requirements:

2 · Installation

The Inbound Check is a paid product. You receive it as a ZIP file from the shop on invoicePress.de. It is not on wordpress.org.

Option A: upload the ZIP file

1. Make sure the plugin "eInvoice Viewer for PEPPOL & EN16931" is installed and active.
2. In WordPress, open Plugins → Add New Plugin and choose Upload Plugin.
3. Select the ZIP file from the shop and start the installation.
4. Activate "eInvoice Viewer — Inbound Check".
5. Open eInvoice Viewer → Inbound Check.
6. In the section Access, decide whether only logged-in users may check, and save.
7. Enter your company data and save.
8. Create your suppliers by hand or import them as a CSV file.

Option B: copy the folder

1. Make sure the eInvoice Viewer is installed and active.
2. Unzip the ZIP file and upload the plugin folder to /wp-content/plugins/.
3. Activate "eInvoice Viewer — Inbound Check" under Plugins.
4. Continue with steps 5 to 8 of option A.

Option C: in the viewer app

For the viewer app the Inbound Check comes as a ZIP file of its own from the shop. There it works entirely in the browser, without WordPress and without a server.

1. Unzip the ZIP file into the folder of the app, where its start file lies. Afterwards the file einvoice-viewer-inbound-check.js lies next to the start file, with the manual and the German and French texts in the folder addons/inbound-check/. The same file also works next to the one-file app of the viewer; there it is enough to lay just this file next to it. Without the folder it fetches the texts of the chosen language from invoicePress.de when needed.
2. Reload the app in the browser.
3. Open Settings in the viewer. The section Inbound Check now stands there.
4. Enter your company. You keep the suppliers in a window of their own, which the button Supplier list next to Settings opens; Done closes it again. Everything is stored with Save in the settings dialog. With a viewer older than 2.37.1 that button is missing; the section then shows the group Supplier list with the button Open supplier list.

The add-on needs the viewer app from version 2.36.0.

Updating

You get the new version as a ZIP file from the shop and install it over the old one. WordPress does not announce a new version by itself, because the plugin brings no update check of its own. Your settings, your company data and your supplier list are stored in the database and not in the plugin folder. Anyone coming from a version before 1.2.0 keeps the previous behaviour: the check stays open to visitors until you tick Logged-in users only.

In the viewer app you unzip the new ZIP file into the same place and let it replace the existing files.

Removing

You deactivate the plugin under Plugins and delete it there. The button "Inbound Check" then disappears from the viewer. The plugin cleans up nothing on deletion. The two settings, your company data and the supplier list remain in the WordPress database. For the supplier list that is intended, because it does not belong to the Inbound Check alone: the plugin "eInvoice Inbound" reads the same list (see chapter 7). Anyone wanting to remove all traces deletes every supplier in the table beforehand and empties the company data fields.

In the viewer app you delete the file einvoice-viewer-inbound-check.js and the folder addons/inbound-check/. Your entries stay stored in the browser until you empty them in the settings dialog.

3 · First steps

1. Open eInvoice Viewer → Inbound Check and, in the section "Your company ( role "Inbound" )", enter at least your company's name and VAT ID. Save the section.

1. In the section Supplier list, create a supplier from whom you have an invoice at hand: name, the identifier VAT: with their VAT ID, and their bank account.
2. Open the page of your site on which the viewer stands, and open this supplier's invoice there.
3. In the toolbar of the result view, click Inbound Check.

1. Read the list of findings. Every finding has a heading and an explanation, and its colour shows how serious it is.

4 · Working with Inbound Check

Starting the Inbound Check

You open an invoice in the viewer and click Inbound Check. The check runs in the browser. Your site only supplies your company data and says which supplier the invoice belongs to and whether its bank account is known; the invoice itself does not go to the server.

The findings appear as a list in the tab "Inbound Check", which opens after the check ( from version 2.38.0 of the viewer; with an older viewer the list stands next to the invoice ). A second click on the button opens the tab again. With button_spiv_inbound="no" in the shortcode of the viewer the button does not appear on that page. Red findings and warnings also stand directly at the affected field of the invoice, and above the invoice it says how many fields are marked.

Reading the findings

Every finding carries an explanation in full sentences. There are four levels:

The findings always stand in the same order: buyer, mandatory details, bank account, payee, references, supplier profile.

Buyer: is the invoice addressed to you?

The buyer's name (BT-44) and VAT ID (BT-48) are compared with your company data. Differences in upper and lower case and in spaces are ignored. If the name or the VAT ID differs, you get a red finding naming both details side by side. In this case the address is no longer checked.

If name and VAT ID match, the address is compared: address line 1 (BT-50), address line 2 (BT-51), postcode (BT-53), city (BT-52), region or state (BT-54) and country (BT-55). The house number belongs to address line 1, because an invoice writes street and house number into the same field. A differing address is a warning, because a wrong address can put your input tax deduction at risk.

If you have entered a Leitweg-ID, it is compared with the buyer reference of the invoice (BT-10). If the buyer reference is missing or differs, you get a warning, because the invoice may then be meant for another office. Without a Leitweg-ID on file, BT-10 is not checked.

Mandatory details under VAT law

The check looks at whether the details VAT law requires are present in the invoice. Which provisions apply you set in the section "Mandatory details under VAT law" of the settings page; by default the check follows the buyer's country on the invoice. It is a formal check and not tax advice.

Every missing detail appears as a finding of its own whose heading names the missing detail. If there is nothing to object to, a single finding "Mandatory details under VAT law" appears with the sentence that the invoice carries all mandatory details.

Rules of the VAT Directive (Art. 226). They apply with every setting except "Do not check the mandatory details". Some rules only apply in particular cases, for example the note on the exemption only for an exempt line.

Additionally under German law (§ 14 UStG). Three of the four rules take the place of an EU rule.

For a total up to 250 euros the relief for small-amount invoices under § 33 UStDV applies. Then only the issuer's name and address, the date of issue, quantity and nature of the service, the tax rate and, where applicable, the note on an exemption are required. The relief appears as a finding of its own, "Small-amount invoice up to EUR 250". It does not apply if the invoice contains an intra-Community supply or a reverse charge.

Additionally under Austrian law (§ 11 UStG 1994).

For a total up to 400 euros the Austrian relief for small-amount invoices under § 11 (6) UStG 1994 applies, which also appears as a finding of its own.

When there is no check at all. If the setting is "Automatic" and the invoice names no buyer's country, or if this country is outside the EU, you get a note that the mandatory details were not checked.

Bank account: does the money go to a known account?

The seller is looked for in your supplier list, first by their VAT ID (BT-31) and the identifier VAT, then by their name (BT-27). Then the invoice's IBAN (BT-84) is compared with the accounts on file.

A known supplier who suddenly names a different account is a classic pattern of invoice fraud. Clarify the new account directly with the supplier, by a route other than this invoice.

Adopting a bank account

For a first invoice and for an unknown bank account the finding carries the button Adopt this account. For a known supplier the account is added to their accounts. For a new seller a supplier with their name and this account is created; today's date is entered as the date. Only administrators can use the button. The check itself never changes the supplier list.

Payee

If the invoice names no payee of its own (BT-59), the seller is the recipient, and the finding is OK. If it names a payee whose name differs from the seller, you get a red finding with both names. A third party as recipient can be legitimate, for example a factoring company, but it is also a common fraud pattern.

References: purchase order number and contract number

The purchase order reference (BT-13) and the contract reference (BT-12) are compared with your patterns. The check takes the fixed beginning of the pattern, that is everything before the first digit or the first #, and looks for it in the invoice's reference. From the pattern PO-2026-#####, PO- is looked for, regardless of upper and lower case. If this beginning is missing, you get a warning, never a red finding. If you have stored no pattern or the invoice does not carry the reference, you get a note.

Supplier profile

This check only runs for a supplier found by their VAT ID. It compares three things:

• Currency: the invoice currency (BT-5) with the supplier's usual currency.
• Due date: the due date (BT-9) with the invoice date (BT-2) plus the usual payment term. If it differs by more than three days, you get a warning.
• Country: the seller's country (BT-40) with the countries of the accounts on file, recognised by the first two letters of the IBAN.

If the supplier is not known by their VAT ID, a note says that there is no supplier profile yet.

Maintaining the supplier list

On the page with the viewer. As an administrator you see the buttons Supplier list and Settings above the drop area as soon as viewer 2.37.1 or later is active. Settings opens the section Inbound Check with your company and the mandatory details; Supplier list opens the same dialog right with the window of the list, which is no longer shown inside the section. In the window you add, edit and delete suppliers and read in a CSV file. Nothing is stored until Save in the dialog. It is the same data as on the settings page in the wp-admin; what you save in one place stands in the other. If somebody saved the data while your dialog was open, the dialog says so instead of overwriting their change. Other visitors see neither button.

From a bookkeeping program. Instead of a file of your own you can read in the export of your bookkeeping program. Recognised are the DATEV export of debtor and creditor master data ( a file whose first line starts with EXTF and names "Debitoren/Kreditoren" ) and lists with the usual column names, such as "Firma" or "Organisation", "USt-IdNr.", "Steuernummer", "IBAN" and "BIC", as Lexware and sevdesk write them. The file may be separated by semicolon, comma or tab and may end in .csv or .txt. From a DATEV file only the creditors are taken, that is the personal accounts starting with 7, 8 or 9; customer accounts are left out and counted in the message. An entry without VAT identifier and without tax number cannot be matched to any invoice and is skipped. A supplier already on the list is recognised by its VAT identifier or tax number; its known accounts stay, and new ones are added.

In the wp-admin. Under eInvoice Viewer → Inbound Check, the section Supplier list has a table of all suppliers with the columns Name, Identifiers, Accounts, Currency, Payment terms and Actions. The column "Accounts" only shows the number of bank accounts on file. In every row you can open the supplier with Edit or remove it with Delete; you have to confirm deleting at the question "Remove this supplier?". Below the table is the form "Add a supplier" with the button Add supplier; when editing, it is called "Edit supplier" and the button Save supplier.

On saving, the plugin normalises some details. The IBAN is stored in upper case and without spaces, and the invoice's IBAN is rewritten the same way before the comparison; so an IBAN with spaces is still recognised. BIC, currency and an identifier's scheme are stored in upper case. An identifier's value, on the other hand, stays exactly as you enter it: VAT:de123456789 does not find an invoice with DE123456789.

Reading in and writing out suppliers as a CSV file

Under CSV import / export you choose a CSV file and read it in with Import CSV, or you download the whole list as the file suppliers.csv with Export CSV.

The file is comma-separated and begins with a header row. The file written out has these columns:

The order of the columns does not matter on import, because the plugin reads them by the header row. If the file lacks a column, such as accounts, the stored value stays for a supplier that already exists. So you can, for example, add only the currencies with a file of id, name and currency. A column that is present but empty, on the other hand, clears the field.

After reading in, the page reports "Suppliers imported: … Rows skipped: …". Every row without a name is skipped. If the file cannot be read at all, "The file could not be read. Please choose a CSV file." appears.

Switching it off on one page

In the shortcode of the viewer you switch off on a single page what this add-on shows, for example [spev_einvoice_viewer button_spiv_inbound="no"]. Without the attribute everything stays on.

A switch only takes something off this page. Who may use the add-on at all is set with "Available from role" in the settings of the viewer. The viewer app uses the same names in config.js, for example features: { button_spiv_inbound: false }. Only the value false without quotes switches off.

5 · Settings

All settings are on one page: eInvoice Viewer → Inbound Check. The page is only visible to administrators. Every section has its own save button and is saved on its own. From viewer 2.37.1 on, an administrator also keeps company, mandatory details and supplier list in the settings dialog on the page with the viewer (chapter 4, "Maintaining the supplier list").

Section "Access"

Section "Your company ( role "Inbound" )"

All fields are empty by default.

Section "Mandatory details under VAT law"

There are five values to choose from:

Section "Supplier list"

Example for the field "Identifiers":

VAT:DE123456789; GLN:4012345000009

Structure of the field "Accounts":

IBAN|BIC|2026-01-15

Shortcodes

The Inbound Check has no shortcode of its own. It shows itself solely through the button in the viewer's result view. How to put the viewer on a page is in the viewer's manual.

6 · Special cases

You want to offer the viewer publicly, but the check only in-house. Tick Logged-in users only. The viewer stays usable for everyone; visitors who are not logged in see it without the button. If the check is to be restricted to users with a particular capability, this can be set up through the filter spiv_capability, see chapter 10.

You want to record a new supplier completely after the first invoice. First make sure the invoice is genuine. Then click Adopt this account as an administrator. The new supplier is created with name and account. Afterwards open it in the supplier list and add the identifier VAT: with their VAT ID, the usual currency and the payment term. Only with the VAT ID does the supplier profile check also run on the next invoice.

Your supplier has changed their account. The next invoice leads to a red finding. Have the account confirmed at a telephone number you already know. Afterwards an administrator adopts the account with the button in the finding.

Your service is taxed in a different country from the country of your address. In the section "Mandatory details under VAT law", set the matching rule set instead of "Automatic".

Your purchase order numbers begin with a digit. A pattern beginning with a digit or with # has no fixed beginning the check could look for. Every reference then counts as plausible. The check is only meaningful for patterns with a fixed beginning of letters or characters, such as PO-.

7 · Working with other packages

Without the viewer, the Inbound Check has no interface of its own apart from its settings page.

8 · Troubleshooting

9 · Privacy and security

What stays in the browser. The invoice file itself. The viewer reads it in the browser; the Inbound Check does not upload it.

What goes to the server. The check itself runs in the browser. On a click on "Inbound Check" the browser sends only the details that identify the supplier to the server of your own WordPress site: the seller's name, GLN, VAT ID and tax number, the country, postcode and city of the seller's address, and the IBAN of the invoice. The server answers with your company data and the matching entry of the supplier list; it does not receive the rest of the invoice data. On a click on "Adopt this account" the supplier's name, identifiers and address, the IBAN and the BIC go to the same server, which writes them into the supplier list. When an administrator opens the settings dialog on the page with the viewer, the browser loads your company data and the supplier list with its bank accounts from your site, and Save sends them back there; other visitors receive none of it.

What does not happen. No outside service is called. The details used to find the supplier are discarded after the answer and not stored.

What is stored. The WordPress database of your site holds the access setting, the setting for the mandatory details, your company data and the supplier list with names, identifiers, bank accounts, usual currency and usual payment term. The suppliers' IBAN and BIC are stored encrypted in the database; the key is formed from the security keys in wp-config.php. The CSV file you write out, on the other hand, contains them in plain text. On deleting the plugin, everything stays in the database (see chapter 2).

What users of the check see. The findings can name your company name, your reference patterns and the names, usual currencies and payment terms of your suppliers. Without the restriction to logged-in users, anyone who opens and checks an invoice on your page sees this.

How it is protected. Settings page, import, export and adopting an account are reserved for administrators. Every request carries a security token, which the server checks.

In the viewer app. There the check runs entirely in the browser. Your company data and the supplier list lie in the storage of this browser, and no server gets to see them. The backup file of the settings dialog contains them, bank details included, in plain text; keep it like a bank statement.

10 · For developers

The filter must be registered before the hook init with priority 1, that is in a plugin or in the theme's functions.php, not in an init callback of your own:

add_filter( 'spiv_capability', function () {
	return 'edit_posts';
} );

If access is blocked, the three AJAX actions answer with 401 (not logged in) or 403 (no capability).

Every finding is an array with code, level (fatal, warning, info, ok), title, explanation and usually bt. Findings that can be adopted additionally carry adoptable, supplier_id, iban and bic. The finding codes are: buyer-identity-mismatch, buyer-address-mismatch, buyer-identity-ok, bank-account-missing, bank-account-first-seen, bank-account-known, bank-account-unknown, payee-is-seller, payee-differs-from-seller, purchase-order-reference-… and contract-reference-… (each with -no-pattern, -missing, -ok, -implausible), supplier-profile-none, supplier-currency-unusual, supplier-due-date-unusual, supplier-country-unusual and supplier-profile-ok. The check of the mandatory details returns mandatory-complete, mandatory-scope for a skipped check and, per missing detail, mandatory- with the rule number in lower case, such as mandatory-eu-05c or mandatory-de-01.

11 · Versions

12 · List of images

This list shows which screenshots this manual expects and which were found in the folder screenshots/ of the package. An image is always named key.language.png, for example ib-befunde.en.png. The images show sample data only.