Bank-detail fraud in notarial practice: anatomy of a €200,000 attack

The following scenario is an illustrative case, built from the IBAN-swap fraud mechanisms documented in the notarial sector (CERT-FR reports, field feedback, case law). The names, practice and amounts are fictional, but the sequence faithfully reflects the real mechanics of this type of attack. It shows how mundane an IBAN-swap fraud can look, and how hard it is to detect without a cryptographic signal.

The context

A mid-sized regional notarial practice is handling a preliminary sale agreement for a Paris flat worth €850,000. The buyer, N. A., lives abroad for work. All communication happens by email over several weeks, at a steady pace: documents, proof of funds, certificates, deadlines.

Day -21: the silent breach

Twenty-one days before signing, a staff member's mailbox at the practice is compromised. The password had been reused between the mailbox and a consumer service hit by a recent leak. The attacker does nothing visible. They set up a discreet filtering rule, review the ongoing files, identify N. A.'s case, and note the signing schedule and amounts.

Day -3: the fraudulent message

Three days before the appointment, N. A. receives a perfectly credible email. It comes from the real staff member's mailbox, with their signature, tone, and exact case references. The message announces an administrative IBAN change for the escrow account, due to an "internal reorganisation of the CARPA account". The new bank details, in French format, are attached as a PDF.

Everything looks normal. The conversation is real. The tone is right. So is the context. No technical signal fires.

Day -2: the transfer

N. A. transfers the fee provision and the requested balance: 
€197,400. The bank doesn't flag anything unusual, as the IBAN is a recent account at a French institution.

Day 0: the appointment

While preparing for the appointment, the notary notices no funds have reached the usual CARPA account. Discussing it with N. A. reveals the fraudulent email. A complaint is filed the same day. Some funds are frozen, but most have already been dispersed.

Why this fraud succeeded

• The email came from a genuine, legitimate mailbox. No filter, no DMARC rule could have blocked it.
• The conversation had real history. The recipient had no reason to doubt it.
• The visual signature was authentic, copied from a previous email.
• The bank-details PDF was perfectly formatted, with a credible French IBAN.

What would have prevented it

1. A strict practice policy: no IBAN change on email alone, without phone confirmation using a number already on file.
2. A cryptographic signature tied to the practice, visible in the mail client. The fraudulent message, even from the real mailbox, would have shown an abnormal signal had financial flows carried an extra authentication layer.
3. Active client education from the start of the case: "any email asking you to change an IBAN must be confirmed by phone".

What this case changes

An emerging best practice is to include, in client documentation, an explicit mention of outbound email cryptographic verification. The badge can thus become part of the trust contract, alongside the "Notarial practice" mention in the footer.

The main lesson isn't technical. It's cultural: trust in a business can no longer be implicit. It must be verifiable in one gesture.