What You Just Discovered — and What It Really Means
Your accounting team just called your supplier to confirm payment. The answer: they received nothing. Yet the wire transfer left your account days ago. You've just realised you paid into a fraudulent bank account.
The bad news: a wire transfer sent to a fake IBAN does not settle your debt to your real supplier. The French Court of Cassation confirmed this on 17 June 2026: paying a fraudster who impersonates your creditor does not release you from your obligation. The invoice remains due, and late payment interest keeps accruing.
The good news: you have recourse. But it must be activated within the first few hours.
This article applies exclusively to companies subject to French law.
Understanding the Legal Situation: Two Debts Instead of One
Supplier bank account fraud — also known as payment redirection fraud or CEO/supplier fraud — mechanically creates two debts:
- The unpaid invoice: your real supplier can still demand payment. The Court of Cassation ruling of 17 June 2026 leaves no room for doubt on this point.
- The diverted transfer: the funds have gone to the fraudster, and you must recover them by activating the right levers.
In other words, you risk paying twice if you do not act quickly.
Is Your Bank Automatically Required to Reimburse You?
Not necessarily — and this is where the law becomes nuanced.
Two situations must be distinguished:
-
If the IBAN was modified without your knowledge (by a third party who hacked your inbox or your supplier's, or intercepted the document): the order is not the one you actually gave. The Court of Cassation, in a ruling dated 9 September 2026, states that the bank must then prove authorisation of the transfer and produce the payment order. It cannot simply claim to have executed an authenticated instruction. The Paris Civil Court went further on 1 July 2026, ordering a bank to reimburse a victim in a similar case.
-
If you yourself entered or validated the fake IBAN (deceived by a fraudulent e-mail): legally, the transaction may be classified as authorised, and automatic reimbursement does not apply. The focus then shifts to the bank's duty of vigilance, the liability of the supplier whose inbox was compromised, and your insurance coverage.
The Emergency Protocol — Act Within 72 Hours
The first hour after discovering the fraud often determines the outcome of the case.
1. Call Your Bank Immediately
Request a wire recall and ask for the funds to be frozen before they are dispersed. Follow up in writing — registered letter or a secure message through your online banking portal. A phone call alone is not enough.
Compile your file immediately:
- A precise timeline of events
- A copy of the fake bank details and the fraudulent message (including technical e-mail headers if applicable)
- Proof of the wire transfer with the destination IBAN
- Bank execution references
- Your real supplier's identity and the original invoice amount
2. Notify Your Supplier in Writing, Through an Authenticated Channel
Contact them by phone (a known, pre-verified number — not the one given in the fraudulent e-mail), then confirm in writing. Send them a copy of your police report and the wire recall submitted to your bank. Propose a realistic payment plan: your supplier bears no responsibility for the fraud, but they are legally entitled to be paid.
3. File a Police Report for Fraud
Go to your local police station or gendarmerie with your complete file. This report is essential to:
- Activate your fraud insurance (if covered under your policy)
- Support your reimbursement claim against the bank
- Potentially join proceedings as a civil claimant and trigger a criminal investigation
4. Check Your Insurance Coverage
Some business or cyber-risk insurance policies cover payment fraud. Contact your broker within the first few hours.
Available Recourse — Who Can You Act Against?
You have several levers, which should be activated in parallel:
Against Your Bank
If the bank executed a transfer to an IBAN you did not provide, or cannot produce the authenticated payment order as you gave it, you are in a strong position. The Court of Cassation ruling of 9 September 2026 sets out clear responsibilities: the bank cannot simply assert that it correctly executed your instruction — it must prove it.
If the bank refuses, the escalation path is: formal written notice → Banking Mediator → Civil Court.
Against the Supplier Whose Inbox Was Compromised
If the fake bank details were sent from your supplier's real (but hacked) e-mail address, their civil liability may be engaged under general tort law. They had an obligation to secure their professional communications.
Against the Fraudster — Criminal Route
Filing a police report opens the door to an investigation, potential freezing of funds if the fraudster has not yet emptied the account, and possible compensation through the criminal proceedings.
Internal Controls to Make Sure This Never Happens Again
Supplier bank account fraud is on the rise and becoming increasingly sophisticated: fraudulent e-mails are written in perfect French, with the right invoice references, the right logo, the right tone.
The internal procedures that make the difference:
- No bank detail changes by e-mail: any request to update a supplier's banking information triggers a mandatory phone call to a known, pre-registered number — never the one in the e-mail.
- Dual human approval for any transfer above a defined threshold (typically €5,000 or €10,000).
- IBAN verification before every first payment to a new beneficiary, or after any bank detail update.
- Training for accounting teams: fraudsters specifically target staff who are isolated from their manager, working under time pressure, or handling payments autonomously.
- Email security audit: mandatory multi-factor authentication (MFA) on all professional email accounts, especially for finance functions.
How Trevys Can Help
A supplier bank account fraud is a trial — financial, operational, and human. It almost always reveals weaknesses in internal payment approval processes.
Our teams can support you at two levels:
- In a crisis: structuring your recourse file, coordinating with your legal advisors, managing dialogue with your bank and your supplier.
- In prevention: auditing your payment procedures, formalising a validation protocol, training your accounting and finance teams.
Disclaimer: this article is provided for informational and educational purposes only. It does not constitute legal advice. In the event of confirmed fraud, contact a specialist lawyer and your accountant without delay.
Have you been the victim of fraud, or do you want to secure your payment procedures?
Trevys — Chartered Accountants & Advisory