Practical guide

A supplier’s change of bank details: an SME’s control procedure.

By Yann Grumbach,

An email tells you that your supplier has changed banks, new bank details attached. This is the typical scenario of fake bank details fraud1. Here is the procedure to follow before recording the change, what your bank has checked since October 2025, and a checklist to print.

The checklist The transfer has already gone

Up to date as at 12 October 2026, based on the sources cited at the bottom of the page. This page describes a general procedure: it does not replace a lawyer’s advice on your case.

The fraud

What does change of bank details fraud look like?

The fraudster poses as one of your suppliers and gives you new bank details, to which an invoice must be paid2. They target an expected payment, an imminent or recurring transaction, which they have often spotted by hacking the email of the supplier or of the company that pays. Their message usually attaches an invoice and falsified bank details1.

The fraudster’s account is often located abroad, and the request arrives by email, by phone, or both2. The sender’s address can fool an attentive eye: in the case decided by the Cour de cassation on 17 June 2026, it differed from the real one by a single letter3.

What should stop you

  • new bank details received by message, even attached to an invoice you were expecting;
  • a sender’s address almost identical to the one you know;
  • a pressing request, or one presented as urgent and confidential;
  • a new account opened abroad.

What the law says

If you pay the fraudster, you still owe your supplier

The French Civil Code (code civil) protects anyone who pays an “apparent creditor” in good faith4. But on 17 June 2026, the Cour de cassation ruled that “a third party who usurps the creditor’s identity is not an apparent creditor within the meaning of this text”3. The payment made to the fraudster therefore does not release you from your debt to the real supplier.

In this case, the court of appeal had accepted that the buyer could legitimately believe it was paying its creditor. That was not enough: its decision has been quashed3.

The ruling of 17 June 2026 explained

The procedure

What procedure should you follow when a supplier changes its bank details?

Cybermalveillance.gouv.fr2 and the gendarmerie5 recommend the same thing: a “non-negotiable” internal verification and approval procedure for any change of bank details. Here is how to keep to it in an SME, in six steps.

1. Change nothing on the strength of a message

An email, a letter or a call is never enough to change bank details, either in your software or at your bank. The request waits, and the invoice concerned waits with it, until the check is complete.

2. Call the supplier back on the number you already know

Call your usual contact on the number you had before the request: the one in your supplier record, in a contract, in a previous exchange. Never the one in the message. Have them confirm the request and the new bank details1, reading the IBAN through together, digit by digit.

3. Have a second person approve

The person who called the supplier back is not the one who approves. A second person, designated in advance, reviews the file and authorises the recording. In a small team, this can be the head of the company. No exception for urgency: being presented as “urgent and confidential” is precisely one of the levers of these scams2.

4. Enter the right name, and read the bank’s response

Before each transfer, your bank verifies the payee (see the next section). Enter your supplier’s name as you know it, its registered name, and not the name printed on the new bank details. If the response is not a match, nothing goes out before a new call back.

5. Keep a record of the check

Note in the supplier’s file the date of the request, the number called, the name of the person you reached and the name of the person who approved. Keep the message received and the old bank details. In the event of fraud, these items will serve as evidence2.

6. Protect what makes the fraud possible

Do not publish who, in your company, can request a transfer or change bank details: the identity of these people must be protected5. Protect email accounts with strong passwords and two-factor authentication, and make your teams aware of phishing2.

Verification of payee

What does your bank check with VoP?

Since 9 October 2025, all banks in the euro area must verify the payee of a transfer: VoP (Verification of Payee)6. They do so before you authorise the transfer, whatever the channel used, and free of charge7.

What it checks

Your bank queries the payee’s bank: does the name you entered match the holder of the account identified by the IBAN?8 For a company, this name is its registered name or its trade name7. An identifier such as the SIREN number or the intra-EU VAT number can be used instead, if both banks allow it8.

The four possible responses

  • Match: the name and the account correspond.
  • Close match: the name is close, and the bank tells you the account holder’s name.
  • No match: you are warned before the transfer is executed.
  • Verification not possible: the bank was unable to carry out the check6.

You keep control: the verification does not prevent you from authorising the transfer. In the event of an alert, the bank warns you that the funds could arrive in an account that does not belong to the payee you indicated7. According to the guide of the Comité français d’organisation et de normalisation bancaires (CFONB), you are the one responsible for the consequences of this decision8.

What it does not do

It compares a name and an account. It does not tell you who sent you the bank details. If you enter the name written on fake bank details, and it is that of the holder of the fraudulent account, it may answer “match”. The CFONB writes that it “contributes to the fight against fraud”8: it complements calling the supplier back, it does not replace it.

Watch out for batch transfers

A company can opt out of the verification when it sends several transfers as a batch, and reverse this choice at any time7. It “gives up the benefit of a service that helps to secure its payments, and accepts this”, writes the CFONB8. Ask your bank whether your batch submissions are verified.

If it is too late

What should you do if the transfer has already gone?

Act straight away: “Every second that passes drastically reduces the chances of recovering your money”, warns the gendarmerie5. The steps recommended by cybermalveillance.gouv.fr2 and by the gendarmerie:

  1. Call your bank to ask for the funds to be returned, or for the transfer to be stopped if it has not yet been executed1.
  2. Identify all the transfers executed, pending or upcoming to the fraudulent account, and have these bank details blocked in your software.
  3. Inform your management and your accounts department, or your accounting firm.
  4. Inform the real supplier: one of its email accounts may have been hacked1.
  5. Keep the evidence: messages, phone numbers, transfer orders, invoices.
  6. If an email account has been hacked, change its password and turn on two-factor authentication.
  7. File a complaint at the police station, at the gendarmerie or in writing to the public prosecutor (procureur de la République). Your complaint will be needed by your bank, and will improve your chances of recovering the funds.
  8. Find the flaw that made the fraud possible, and fix it5.

If the funds have gone abroad, a specialist lawyer can help you take action with the bank of the country concerned2.

To print

The checklist for a change of bank details

One list per request, to fill in and keep in the supplier’s file. When printed, it starts on a new page, without the site’s header or footer.

  • Supplier
  • Request received on, and by what means
  • Check carried out by
  • Approved by
  1. No one changed the bank details before the end of the check, and the invoice is waiting.
  2. The sender’s address was reread letter by letter.
  3. The supplier was called back on the number we already had, not on the one in the message.
  4. Our usual contact confirmed the request and the new IBAN, digit by digit.
  5. A second person approved the change before anything was recorded.
  6. The name entered for the transfer is the supplier’s registered name, taken from our record.
  7. The bank answered “match”; otherwise, nothing went out before a new call back.
  8. If the transfer goes out in a batch submission, we know whether the bank verifies the payee in it.
  9. The date, the number called, the person reached and the person who approved are noted in the file.
  10. The message received and the old bank details are kept.

And in your company?

Reviewing who checks and who approves your suppliers’ payments can be the subject of a Diagnostic. There is also the Pre-payment control worker, which we build with you.

Sources

  1. Cybermalveillance.gouv.fr, Fraude au virement (faux RIB) (in French), quick-reference sheet in PDF, version V240201. ↑ ↑ ↑ ↑ ↑
  2. Cybermalveillance.gouv.fr, La fraude au virement bancaire (FOVI) ou au faux ordre de virement (in French), page updated on 15 September 2026. ↑ ↑ ↑ ↑ ↑ ↑ ↑ ↑
  3. Cour de cassation, Commercial Chamber, ruling of 17 June 2026, no. 24-13.306, published in the Bulletin (Légifrance, in French). ↑ ↑ ↑
  4. French Civil Code (code civil), article 1342-3, in force since 1 October 2016 (Légifrance, in French). ↑
  5. Gendarmerie nationale, Comment se prémunir contre les escroqueries aux faux ordres de virement ? (in French), page updated on 9 October 2026. ↑ ↑ ↑ ↑
  6. Service Public, Les virements bancaires plus sécurisés grâce à une nouvelle étape de vérification (in French), published on 29 September 2025. ↑ ↑
  7. Regulation (EU) 2024/886 of 13 March 2024, article 1, which inserts articles 5b and 5c into Regulation (EU) No 260/2012 (EUR-Lex, in French): verification of payee, the fact that it is free of charge, and the opt-out for batch submissions. ↑ ↑ ↑ ↑
  8. CFONB, La vérification de bénéficiaire dans les échanges informatisés entre utilisateurs et prestataires de services de paiement (in French), version 1.0, September 2025. The guide states that, as regards responsibilities, “only the regulation is authoritative”. ↑ ↑ ↑ ↑ ↑
Request a call back