A warning is not the same as protection

Letter from the table · RC/FP/2026/T.43

Translated from German by the Secretariat. Written on 5 April 2026.

Chair, I want to ask a question about our strategy before the Council turns its evidence into a rule. Are we trying to make every business fraud loss reimbursable, or are we trying to make payment systems prevent more of these losses and recover money faster? Those aims can support one another. They are not the same promise. I oppose FP-001 as it is presently framed, because I do not believe a broad reimbursement duty, by itself, is a safe or workable answer for small businesses.

On 17 February, I received what appeared to be a routine message in an existing email conversation with a supplier. It said that the bank details on an invoice had changed. The amount was €4,860. I checked the invoice against the message and made a SEPA credit transfer from my business account. The transfer was authorised by me. That fact matters legally, even though I was deceived into making it.

Before I sent the money, the payment screen gave me a close-match warning for the beneficiary name. I noticed it, but I read it as a minor spelling difference and continued. The invoice had arrived through a conversation I trusted; the warning did not tell me that the email account might have been compromised, or that I should stop and call the supplier using a number I already knew. I accept that I should have paused. I also think a warning that depends on a tired person interpreting a technical name-match result is a thin barrier against a carefully timed fraud.

At 10:18 that morning, after I realised the bank details had been changed without the supplier’s knowledge, I called my bank and asked it to recall the payment. I supplied the invoice, the email chain and the transfer

details. I also reported the matter to Polizei Hamburg and followed the bank’s instructions for submitting the documents. The recall did not bring the money back: by the time the process reached the receiving account, the funds were no longer available. The police report was important to make, but it did not restore working capital that had already left my account.

In Germany, the distinction between an unauthorised payment and a payment that the customer personally authorised after being deceived is consequential. Section 675u of the Bürgerliches Gesetzbuch concerns unauthorised payment transactions; it does not create a general right to reimbursement whenever a business is tricked into approving a transfer. A police report and a prompt request to recall the payment may help with investigation and recovery, but they do not guarantee either. This is why the standard must say clearly what it requires of a bank or payment provider, and what happens when that duty is not met.

There is already a useful prevention measure in the European framework. For euro payments, payment providers in the euro area are required to offer verification of the payee before a transfer is authorised. In my case, a name check produced a close-match warning, but the payment still went through. That experience does not make verification pointless. It shows why a standard should ask whether warnings are understandable, prominent and actionable—and whether customers can pause, check independently and return to the payment without losing the chance to act. A match can confirm the account name; it cannot confirm that the invoice is genuine or that the supplier’s email has not been taken over.

For that reason, I support a strong duty to verify payee details and a fast, properly staffed recall process. A bank should be able to transmit a fraud alert quickly to the receiving provider, preserve the relevant information and tell the business what steps it has taken. The standard should set measurable expectations for speed, cooperation and a clear explanation when recovery fails. It should also require providers to make their

warnings understandable to a small-business customer, not merely to record that a warning appeared.

But reimbursement for every authorised push-payment or business-email-compromise loss, including cross-border cases, is a different and much wider undertaking. If the draft makes reimbursement automatic without distinguishing the provider’s conduct, the quality of the warning, the customer’s actions and the limits of recovery across borders, it may create a promise that small businesses cannot rely on in practice. It may also encourage providers to respond with higher charges or more restrictive account checks. I do not claim that this must happen. I ask the Council to examine that risk before we present reimbursement as the central fix.

Would the Chair consider separating the proposal into two stages? First, set enforceable minimum duties for verification, warning design, rapid recall and cross-border cooperation. Second, gather evidence on when a provider should reimburse a business after an authorised fraud payment, including what evidence is needed and how responsibility should be shared. If the Council concludes that reimbursement should be part of the final standard, it should explain the conditions and the route to a decision, rather than leave businesses with a promise whose limits only become visible after a loss.

The BEC Watch bulletins have helped me understand that an altered invoice is not an isolated mistake but a recurring method. That is valuable work. The Council’s evidence also shows reports from many countries and different business circumstances.¹ We should use that breadth to make a careful standard, not to pretend that a single rule will operate identically in every payment system.

Notes and sources

1. As of 5 April 2026, the Fair Play Council had 39 reports from 18 countries. ↩