Fake bank details fraud
You paid. But legally, your debt may still exist.
What are we talking about exactly ?
Fake bank details fraud diverts a payment by replacing the real creditor's bank details with ones controlled by a fraudster.
The trap can take several forms: fake domain, identity theft, a compromised mailbox, or a document altered in transit by email.
The specific danger: the debtor may be convinced they paid correctly while the real creditor never received the funds.
Since the French Supreme Court (Cour de cassation) ruling of 17 June 2026, a third party who impersonates the creditor cannot be regarded as an "apparent creditor". A payment made to their account is therefore not discharging on that basis. (Cass. com., 17 juin 2026, n° 24-13.306)
How it works
- 1Spotting the payment
The attacker identifies a real transaction: a supplier invoice, a property sale, compensation, a deposit or a major payment.
- 2Impersonation or compromise
They imitate the creditor's address or exploit a compromised mailbox to insert themselves into a credible exchange.
- 3Bank details substitution
The legitimate bank details are replaced with the fraudster's. The rest of the message can stay perfectly consistent.
- 4Payment
The debtor makes the transfer believing they're paying the real creditor. The fraud is often only discovered when the real creditor asks for payment.
What the data tells us
Concrete examples
A buyer receives an email from an address differing by just one letter from the real supplier's. A genuine invoice is attached, with the fraudster's bank details. They transfer €103,375.64 to the account given. The funds are never recovered. In June 2026, the Cour de cassation ruled that a fraudster who impersonated the creditor cannot be regarded as an "apparent creditor". (Cass. com., 17 juin 2026, n° 24-13.306)
An individual receives their provider's new bank details by email, from the genuine address. The email is intercepted in transit and the bank details altered before delivery. The provider had themselves called to announce the change, which legitimised the request and short-circuited the reflex to double-check. €12,000 transferred to the fraudster's account. The exact source of the compromise was never established. (Toulon Commercial Court, 2026)
What works, and what falls short
- Relying on the displayed name in the mailbox: it can be imitated.
- Checking only the email address: insufficient if a legitimate mailbox has been compromised and the address is identical.
- Relying on a prior call from the provider: a genuine call announcing a bank detail change can precede and legitimise the fraudulent email that follows, short-circuiting the double-check reflex.
- Confirming any bank detail change via an independent channel: a already-known number, a defined internal procedure, a previously identified contact.
- Cryptographically verifying the origin and integrity of the message before any payment.
How STEGA TRUST responds to this threat
STEGA TRUST cryptographically certifies the email at the moment it is sent.
The recipient can verify two things: who sent it, and whether the certified content still matches the content received.
If an element covered by the certification is modified after signing, the verification no longer matches: STEGA TRUST displays "Content modified".
And when a message claims to come from an organisation that usually uses STEGA TRUST without presenting valid certification, the absence of proof itself becomes a warning sign.
Before the transfer, the question is no longer just: "does this email look legitimate?" It becomes: "can I prove it?"