Transfer fraud in France hit €351 million — and the courts say the bank doesn't pay.

France is one of the few countries in Europe that counts this crime properly. The Banque de France's payment-security observatory (OSMP) reports fraud by payment instrument, and it puts credit-transfer fraud — the rail every supplier invoice rides on — at €351 million in 2024, up 12% in value in a single year. The EU's own supervisory data independently reports almost exactly the same figure for France, at €350,992,884.

The business-specific number is the one to watch. French police (DNPJ) log "faux ordres de virement" — FOVI — as a distinct category covering supplier bank-detail substitution and CEO fraud. In 2024 they recorded 649 such cases against businesses, public administrations and local authorities, worth €34 million. The Banque de France cautions that DNPJ figures are revised upward as late complaints arrive, and describes them as a representative but not exhaustive sample.

The government's own victim-support service shows the trend sharply. Cybermalveillance.gouv.fr logged around 13,000 requests for help with transfer fraud in 2025 — a 170% increase in a year — and for businesses and associations specifically, transfer fraud rose 93% to become one of the top three threats they seek help with. Its definition is precisely our subject: impersonating a creditor, CEO fraud, and hacking a mailbox to send a bank-detail change or an invoice carrying a substituted account.

Survey data fills in the rest. In Allianz Trade's 2026 barometer of 315 French business leaders and finance directors, 60% of SMEs had faced at least one fraud attempt in the past year, and fake-supplier fraud was the single most common external technique, cited by 42% of victim companies.

The pattern in the French survey data is consistent: 60% of SMEs faced a fraud attempt in the past year, fake-supplier fraud is the most common external technique against companies that get hit, and only 27% of micro-enterprises carry any fraud insurance — against 74% of large companies. Smaller firms absorb the same attacks with a fraction of the backstop.

The FOVI numbers are not broken down by company size, so no French source isolates SME-only losses — but the mechanism does not care how big you are. A compromised mailbox, a plausible "nous avons changé de banque" message mid-invoice-run, and a valid transfer leaves the account. After the Cour de cassation's 2025 rulings, that transfer looks entirely regular to the bank, and the loss stays with the company.

Verification of Payee helps at the keystroke. It cannot help when the fraudster supplies a name and an IBAN that match each other perfectly — which is exactly what happens when a supplier's own email thread is hijacked. That is the gap PayHQ closes: every incoming invoice is checked against the supplier record your team already verified, and a changed account is flagged for a human before the payment run.