A transfer can be authorised and still be fraud

Letter from the table
RC/FP/2026/T.46 · 19 August 2026

To the Fair Play Council

I support the proposed Business Fraud Standard. I am writing from Warsaw, but what happened to me is not unusual in the conversations I have with other owners here and elsewhere in the region. The amounts and details differ. The helpless part is remarkably similar: the owner sees the fraud, calls the bank, and discovers that speed matters more than almost anything they can do afterwards.

On 17 February, I received an email that appeared to be part of an existing conversation about an invoice. It said the account details had changed. The message did not feel strange enough to stop me. I checked the amount against the invoice and sent 18,740 złoty from my business account to the new account listed in the message.

A little later, I reached the person I expected to be dealing with through a separate channel. They had not changed their account details. I called my bank immediately and asked it to stop or recall the transfer. I gave the bank the payment information and followed its instructions. I also reported the matter to the police. The transfer had already gone through, and a request to recover it was not the same thing as getting the money back. I could not make the receiving bank return the funds myself.

I do not expect a bank to promise that every recall will succeed. Once money has moved, another bank, another country, or a closed account can make recovery difficult. But a business owner should not have to discover the process while watching the clock. There should be a fast, clearly explained route from the first call to a recall request, with the banks sharing the information needed to act promptly.

There is also a difference between a payment I did not make and a payment I was tricked into authorising. Under the payment-services framework in Poland, unauthorised transactions and authorised payments prompted by deception are not the same case. The first has specific refund protections; the second can leave a small business with a loss even when it acted quickly after discovering the fraud. For an owner, the word “authorised” can sound as though the matter is settled. It does not describe what happened: a criminal redirected a payment by impersonating someone I trusted.

Payee-name checks would have helped before the transfer. A warning that the account name did not match the name I intended to pay would have given me a reason to stop and verify the change. The EU’s Verification of Payee requirements are being phased in, and Poland is not in the euro area. I do not assume that a check will protect every domestic złoty transfer today. That is exactly why the standard should ask banks and payment providers to make clear what checks apply to each transfer, rather than letting an owner believe that entering a name is the same as having it verified.

The change I want is practical, not abstract. Before payment, verify the payee name and show a clear warning when it does not match. After a reported scam, make an urgent recall request without delay, keep the owner informed, and coordinate with the receiving provider. Where a small business has been deceived into authorising a payment, provide a fair reimbursement route, including for cross-border cases. If the evidence shows that a bank or provider missed a required step, the business should not carry the whole loss by default.

In Warsaw, owners compare notes quietly. One person tells me about a supplier invoice with a new account number. Another describes an urgent payment that looked routine until the real recipient asked where the money was. People are careful about admitting they were deceived. That silence makes it harder to see how often the same method is being used. The BEC Watch bulletins help by giving owners something concrete to check and share. They should sit alongside stronger protections, not stand in for them.