Case law
Fake bank details: who pays? The Cour de cassation ruling of 17 June 2026.
By Yann Grumbach,
You paid an invoice into the account of a fraudster who was posing as your supplier. Do you still have to pay that supplier? For the Cour de cassation, the payment made to the fraudster does not release you from your debt1. Here is the ruling, what it changes for the company that pays, and the reflexes that follow from it.
Up to date as at 12 October 2026. This page explains a court decision: it is not advice on your case, for which a lawyer remains the right person to talk to.
The rule
What does the ruling of 17 June 2026 say?
“A third party who usurps the creditor’s identity is not an apparent creditor within the meaning of this text.”1
In principle, a payment must be made to the creditor or to the person designated to receive it2. The French Civil Code (code civil) adds: “Payment made in good faith to an apparent creditor is valid.”3 It is this text, article 1342-3, that the ruling refers to.
The Cour de cassation holds that this rule does not apply when a third party usurps the creditor’s identity. The official summary of the ruling draws the consequence: the payment of an invoice “made by the debtor to a person fraudulently posing as the creditor is therefore not a valid discharge”. In other words, the debt is not extinguished. The ruling is published in the Bulletin1.
The case
An email address that differed by a single letter
A seller of diesel fuel supplies a ship calling at Marseille, through an Italian company. The buyer is established in the British Virgin Islands.
On 22 May 2018, the intermediary receives an email whose address differs from the seller’s real address by a single letter. It contains the invoice for the sale, for 103,375.64 euros, and bank details. The intermediary passes both on to the buyer, who pays by transfer. The account belonged to a fraudster, and the sum could not be recovered.
The seller then claims payment from the buyer, and failing that, damages from the intermediary1.
What the court of appeal had ruled
On 21 December 2023, the Aix-en-Provence Court of Appeal dismisses the seller’s claim. In its view, the buyer could legitimately believe that it was dealing with its creditor when it made the transfer: its payment had therefore released it1.
What the Cour de cassation rules
The seller argued that the court of appeal had confused two things: legitimately believing in the identity of the creditor, and legitimately believing in the identity of the account holder. The Cour de cassation quashes the appeal decision. The buyer knew that its creditor was the seller. It therefore did not pay an apparent creditor, but “a person fraudulently posing as” the seller1.
As a consequence, the quashing also extends to the dismissal of the claim brought against the intermediary. The Court sends the case back to the Lyon Court of Appeal1.
What this changes
Fake bank details: who is liable?
The company that pays remains the debtor
If you pay an invoice into the account of a fraudster posing as your supplier, the ruling says that this payment does not release you: the sum remains due to your supplier. Your good faith is not enough. In the case decided, the court of appeal had accepted it, and its decision has been quashed1.
Hence the value of checking a change of bank details before paying, not after.
What the ruling does not decide
It does not say whether the intermediary, which had passed on the fake bank details, owes damages: that question goes back before the Lyon Court of Appeal. Nor does it say anything about the bank, which was not a party to the proceedings1.
And the bank?
Since 9 October 2025, your bank must verify the payee before you authorise a transfer: does the name you enter match the account holder? The European regulation provides that it is not liable for a transfer executed in favour of the wrong payee on the basis of an incorrect identifier, provided that it has complied with these rules. If it has not complied with them, and the transfer was incorrectly executed for that reason, it refunds you the amount4.
You can bypass an alert from the verification. Your bank must inform you of the consequences of this choice for its liability and for your right to a refund4. What these rules mean in your case is a question for a lawyer.
The reflexes
What the company that pays can do right now.
- Never change bank details on the strength of a message. Call the supplier back on its usual number, to have it confirm the request and the new bank details5.
- Have any change of bank details approved by a second person, under a “non-negotiable” procedure6.
- Before the transfer, enter the supplier’s registered name as you know it, and read the response of the verification of payee. Do not bypass an alert without a new call back.
- Keep a record of each check: the date, the number called, the person reached, the person who approved.
- If the money has gone, call your bank without delay to ask for the funds to be returned, keep the evidence and file a complaint6.
The full procedure, with a checklist to print: a supplier’s change of bank details, an SME’s control procedure.
And in your company?
Reviewing who checks and who approves your suppliers’ payments can be the subject of a Diagnostic. There is also the Pre-payment control worker, which we build with you.
Sources
- Cour de cassation, Commercial Chamber, ruling of 17 June 2026, no. 24-13.306, published in the Bulletin, and its official summary (“Titrages et résumés”) (Légifrance, in French). ↑ ↑ ↑ ↑ ↑ ↑ ↑ ↑ ↑
- French Civil Code (code civil), article 1342-2, in force since 1 October 2016 (Légifrance, in French). ↑
- French Civil Code (code civil), article 1342-3, in force since 1 October 2016 (Légifrance, in French). ↑
- Regulation (EU) 2024/886 of 13 March 2024, article 1, which inserts article 5c into Regulation (EU) No 260/2012 (EUR-Lex, in French): paragraphs 1, 7, 8 and 9. ↑ ↑
- Cybermalveillance.gouv.fr, Fraude au virement (faux RIB) (in French), quick-reference sheet in PDF, version V240201. ↑
- Cybermalveillance.gouv.fr, La fraude au virement bancaire (FOVI) ou au faux ordre de virement (in French), page updated on 15 September 2026. ↑ ↑