Letter from the table: A warning is not a remedy

RC/FP/2026/T.38 · 2 May 2026 · Table letter · Stance: amend

Translated from German by the Secretariat.

To the Fair Play Council

I am writing from Hamburg. I support the purpose of FP-001, but I ask the Council to amend its proposed fix before it becomes a standard. Please do not treat verification of the payee name as if it solves business invoice fraud by itself. It is one important warning at the point of payment. A small business also needs a fast, dependable route to stop or recover a transfer, and a fair answer when the transfer was authorised because the fraud was convincing.

On 16 February 2026, I received an email in an existing correspondence thread about an invoice. It said that payment details had changed. The invoice was for €4,860 and had a due date of 19 February. I had dealt with the other party before. The message was written in the same thread, and there was no obvious sign, to me, that someone else had entered it. I replied to that email asking for confirmation. I did not call a number I had independently checked. That was my mistake. I now understand that a compromised thread can make a false instruction feel like an ordinary continuation of work.

On 17 February, I entered the new IBAN and the payee name in my bank’s payment process. A payee-check warning appeared: the name and account details did not match. I paused, but I was under pressure to meet the invoice deadline. I had already been told that the payment details had changed, and I treated the warning as a possible administrative mismatch. I confirmed the transfer. It was €4,860—enough to affect what I could pay

and when, but not an amount that would make the business’s loss disappear into a larger balance.

On 18 February, after I could not get confirmation through the correspondence thread, I contacted the intended recipient using contact details I had used before. They had not changed their bank details and had not received the money. I called my bank’s fraud team and asked it to recall the transfer. I also reported the matter to the police in Hamburg and sent the bank the invoice, the email thread and the report details. My bank submitted a recall request. The money was not returned. I was not given a reliable means of knowing, in the first hours, whether the receiving side had been reached or whether the funds could still be stopped.

German and European rules make the difference between an unauthorised payment and a payment I authorised under deception important. Under the German Civil Code, the payment-service rules require a refund in cases of an unauthorised payment, subject to the applicable conditions. But I had personally confirmed this transfer. That does not make the fraud harmless; it means the statutory route for an unauthorised payment does not automatically answer my case. A transfer based on an IBAN can also be processed by reference to that identifier, so a name appearing on an invoice is not, by itself, a guarantee that the money will reach the intended business.

There is already a relevant safeguard in the euro area. Under the EU Instant Payments Regulation, payment providers in the euro area have been required since October 2025 to offer verification of the payee for euro credit transfers. In my case, a warning appeared, and I chose to proceed. That is precisely why I do not want FP-001 simply to repeat “check the name” as though every business can identify a sophisticated fraud and make the right decision under pressure. A verification warning can prevent some losses. It cannot retrieve money after an authorised payment has gone, and it cannot fairly decide every case in which a warning was missed, misunderstood or overridden.

I ask the Council to amend the fix in three ways:

• Require providers to make the payee-check result clear and actionable before confirmation, including a plain explanation of a mismatch and a safe way to pause or verify the instruction.

• Require a rapid fraud-recall process, with a named contact route and prompt communication between the sending and receiving providers. A customer should not have to spend the first critical hours trying to discover whether anyone has acted.

• Set a clear reimbursement principle for small businesses harmed by authorised push-payment or business-email-compromise fraud, including cross-border cases. The standard should distinguish deliberate participation from a customer’s reasonable mistake under deception, and should not leave the outcome to an unexplained, case-by-case refusal.

I do not ask the Council to say that every payment must be reimbursed without review. Providers need to consider the facts, including whether a customer ignored a clear warning or failed to take reasonable care. But a warning should not become a complete defence for the institutions that design the payment journey, and a business’s act of confirming a transfer should not end the inquiry when the instruction was fraudulent.