A payment can be lost twice

Letter from the table — RC/FP/2026/T.42

To the Fair Play Council,

I support the direction of FP-001, but I ask the Council to amend it. A fraudulent payment can take money from a small business twice: first when the transfer goes to the wrong account, and again when the business has to find the money to pay the genuine bill. The second loss is a cashflow problem, and it should be visible in a fraud standard.

On 12 February, I received a message in an existing email thread about an invoice for €4,860. It said the bank details had changed. The invoice was due on 16 February. The message looked consistent with the thread, and I had no reason at that moment to think the request was false. I made a SEPA credit transfer from my Portuguese bank account on 13 February. I cannot tell whether a sender’s mailbox had been compromised or how the message entered the thread. I can say that I authorised the transfer believing I was paying the intended recipient.

On 16 February, I was contacted about the unpaid invoice. I checked the earlier message, understood what had happened, and called my bank as soon as I could. I asked it to recall the transfer and reported the fraud to the police. I also made a formal complaint to the bank. The payment had left my account; a request to recall it was not the same thing as getting the money back. By 30 April, I had not recovered the €4,860.

The distinction in Portugal’s payment-services framework matters here. A payment I did not authorise is not the same case as a transfer I authenticated after being deceived about who would receive it. My bank could treat the transfer as authorised even though the payment was

induced by fraud. That distinction may describe how the payment was made; it does not describe the harm. For a small business, the money is gone either way.

The supplier still had a valid invoice. I could not ask an innocent supplier to carry the whole loss while the bank and the receiving institution considered a recall. I paid €3,000 on 20 February and the remaining €1,860 on 6 March. To meet those dates, I used €2,000 of my overdraft and delayed paying myself €1,200. That did not make the fraud smaller. It moved the cost into borrowing, postponed income I needed, and left me managing two obligations created by one false change of bank details.

This is where Fair Play and Cashflow meet. The fraud standard should not stop at identifying a suspicious transfer or recording that a recall was attempted. It should recognise that an unpaid supplier invoice can become an immediate working-capital crisis. A small business may not have reserves to replace thousands of euros while institutions exchange requests, check account trails, or decide which side is responsible. For many of us, a delay of weeks is not an administrative inconvenience; it changes which bills can be paid on time.

I followed the steps I could identify: I contacted my bank promptly, asked for a recall, reported the fraud, and made a formal complaint. I kept the email and payment records. I could not make the receiving institution act faster, see what checks had been made before the money was accepted, or obtain the funds while the matter was being examined. At the payment stage, I also had no practical certainty that the account belonged to the person I intended to pay. I cannot say whether a name check was performed. A standard should make that kind of verification clear to the payer and should require a usable warning when the payee details do not match.

I would amend FP-001 in three ways:

• Require prompt action on a reported business payment fraud: a traceable recall request, a named case reference, and clear updates on what has been done and what remains outstanding.

• Set a fair reimbursement route for evidence-backed authorised push-payment and business email compromise fraud, including cross-border transfers. Authentication alone should not settle whether a small business is entitled to reimbursement; the circumstances of the deception and the steps taken after discovery should be considered.

• Address the cashflow gap while a claim is unresolved. The standard should require providers to consider timely provisional support for a small business facing a verified fraud loss, with a clear review and correction process. The business should not have to bear an open-ended wait simply because institutions are still establishing responsibility.

I am not asking the Council to turn every disputed invoice or mistaken payment into a fraud claim. Evidence matters. So do reasonable safeguards and a way to challenge a decision. But where a small business promptly reports a credible invoice-redirection fraud, the process should not leave it alone with the full loss while the institutions investigate at their own pace.