Letter from the table: Protect us without punishing the careful

To the Fair Play Council

I support the purpose of FP-001. A small business that is deceived into sending a payment should not be left alone with the loss simply because the payment was technically authorised. But I ask the Council to amend the standard before it advances. A rule meant to protect us can create a different harm if it treats every unusual payment as suspicious, or if it promises reimbursement without clearly distinguishing what a bank can verify from what it cannot.

On 18 February this year, I received an invoice by email that appeared to be part of an existing business relationship. The message arrived in the same thread as earlier correspondence. It said that payment details had changed and gave a reason that did not look extraordinary. I checked the amount against the work and records I had. On 20 February, I sent €7,460 by SEPA credit transfer from my business account.

I will not describe my business or the other party in a way that could identify either one. What matters is the sequence. The email account or correspondence had been compromised, and the payment details led somewhere other than the intended recipient. I noticed the problem on 23 February, after a follow-up made clear that the invoice had not been received by the party I meant to pay.

I called my bank that day and asked it to try to recover the transfer. I also reported the incident to the police and provided the documents requested by the bank. My bank submitted a recall request. It explained that a transfer already executed could not simply be reversed on my instruction: recovery depended on what could be done through the receiving institution and whether the funds remained recoverable. I do not blame a person at the bank for that limitation. But three days had passed, and every further step felt less useful than the one I had needed immediately.

German law makes a distinction that matters here. Section 675u of the German Civil Code concerns payment transactions that were not authorised by the payer. In my case, I personally entered and approved the transfer, although I did so because I had been deceived. That is not the same situation as a stranger taking money from an account without permission. An authorised transfer induced by invoice fraud can therefore leave a small business without the straightforward statutory refund route that applies to an unauthorised transaction. The practical gap is real, even when the payer acted carefully.

The Council’s proposed requirements for payee-name verification, rapid recall, and reimbursement would help close that gap. I want them to remain in the standard. But verification has a boundary: it can help establish whether a name corresponds to an account, not whether an invoice is genuine, whether an email account has been taken over, or whether a change in payment instructions is legitimate. A matching name must not be presented to customers as proof that the underlying transaction is safe. A mismatch must not automatically become proof of fraud.

A check can verify a detail. It cannot verify the whole business relationship.

This distinction matters especially for small firms. Some legitimate payments involve abbreviations, trading names, group entities, recently changed accounts, or a person paying on behalf of a business. If a bank responds to the standard by blocking every transfer that produces a warning, the cost will fall on people who cannot wait days for a manual review. If a warning is so frequent that customers learn to click through it, it will stop being a warning at all. And if banks respond by making small-business payments slower or harder to access, the people the standard is meant to protect may bear that cost.

I ask the Council to amend FP-001 in four ways. First, require a clear, proportionate payee-name check, but state plainly what it does and does not establish. Second, require an urgent human route for a payer who reports suspected fraud, with a documented attempt to contact the receiving provider and request a hold or recall as quickly as possible. Third, make reimbursement rules clear for authorised payments

induced by business email compromise, including what evidence is reasonably required and how cross-border cases are handled. Fourth, protect ordinary customers from automatic penalties or blanket restrictions when they have followed reasonable steps and a check is inconclusive.

Those safeguards should not become excuses to deny a claim. The person reporting fraud should not have to prove a complicated technical theory about how an email account was compromised. A dated invoice, the payment record, the correspondence, and a prompt report should be a practical starting point. Banks can investigate further without making a small business carry the whole burden while they do.

I have been reading the BEC Watch bulletins because they take the pattern seriously without pretending that one warning solves it. That is the balance I hope the Council preserves. Keep the ambition: check names, move quickly, and reimburse eligible small businesses. Amend the machinery so that verification is not mistaken for certainty, and so that protection does not become another obstacle to paying a legitimate invoice.