Certify your office's identity in every communication
For notary offices and practices of all sizes, from sole practices to groups.
Why notarial email is a risk zone
Notaries handle sensitive financial instructions (bank details, escrow transfers) by email every day. Unlike individuals whose identity is verified in person, exchanges with companies, banks or estate agencies rely solely on trust in the received email – with no way to verify that "Jacqueline from accounting" really is Jacqueline.
In a notarial practice, a single spoofed email can be enough to change an escrow bank detail or trigger an irregular transfer, with lasting financial and reputational consequences. The problem is not the quality of internal procedures, but the absence of a technical authenticity signal on the email itself.
A fraudulent instruction can therefore be executed before the impersonation is detected. A posteriori verification, by phone or manual cross-check, often comes too late to prevent the transfer.
The most exposed communications in your sector
Transaction communications with clients (bank details, balances, instructions)
Correspondence with banks and other notaries
Communications with property managers, surveyors and contractors
Summons and deed notifications
The real cost of transfer fraud for professionals
Average loss per transfer fraud for an SME/mid-sized company (Stoïk, 2025). This amount gives the order of magnitude of the direct loss borne by a mid-sized structure in a transfer fraud.
Increase in transfer fraud among French professionals in 2025 (Cybermalveillance.gouv.fr). This increase shows that the risk is growing sharply among high-stakes professional exchanges.
Taken together, these two figures show that the risk is not marginal: it is both costly per incident and rising fast. For a notarial practice, transfer fraud is therefore not a theoretical risk, but a measurable exposure to integrate into its security policy.
Threats targeting your sector
A client receives a fake email from the office announcing new bank details for the balance. They transfer funds to a fraudulent account.
An attacker sends a fake instruction from an address imitating a notary's to a property manager or bank. The operation is executed on a fraudulent instruction.
A fake email from the associate notary asks a staff member for an urgent transfer or a confidential document.
€200,000 diverted in a few days
Our blog post details an illustrative €200,000 scenario: a compromised mailbox, a fake bank detail email sent to the client and an intercepted transfer. This case reflects the real mechanics of IBAN-swap fraud documented in the notarial sector.
It shows how a simple mailbox compromise can be enough to divert a transfer of several hundred thousand euros, without either the sender or the recipient immediately detecting the anomaly. The article also explains why classic controls – anti-spam filters, DMARC, visual address checks – were not enough, because the message came from a compromised legitimate mailbox.
Illustrative scenario
Read the full analysisHow STEGA TRUST responds
- Every outgoing office communication cryptographically certifies the sender's identity. The certification relies on a cryptographic signature generated at send time, not on the appearance of the email address.
- Certification is tied to the terminal the sender usually uses. If an attacker gains access to the office's email account (stolen credentials) but sends from an unrecognised device, the email cannot be certified like the office's legitimate messages, and the absence of valid certification itself becomes a warning signal for the recipient.
- Qualified eIDAS timestamp attached to every certification, providing a reliable date and time for every certified email.
STEGA does not secure the uploaded document, but the invitation email
DocSecure secures the document once it is uploaded to the platform (SMS + email authentication), but the initial invitation email containing the platform link itself travels by ordinary, unprotected email. If the notary's or client's mailbox is compromised, that invitation email can be intercepted and replaced with a link to a fake interface. STEGA certifies precisely this layer: the invitation email itself.
The attacker does not need to bypass DocSecure: they simply intercept the email that precedes the upload. It is in this window, between sending the invitation and opening the platform, that STEGA intervenes by guaranteeing the sender's authenticity.
In other words, STEGA TRUST does not replace DocSecure: it secures the channel that leads to DocSecure. The two tools are complementary and address two different moments in the client journey.
Your frequent questions
Request a demo tailored to my office
Request a demoDiscover the STEGA TRUST solution
Certify your email identity with eIDAS technology. Available for all organisations, compatible with Microsoft 365.
Certified protection
Every outgoing email is cryptographically sealed and timestamped.
Real-time detection
Immediate alert on any anomaly or identity spoofing attempt.
eIDAS timestamp
Qualified eIDAS timestamp, a standard recognised across the European Union.
Personalised demo by appointment. No commitment.