A payment I approved was still a fraud

Letter from the table — RC/FP/2026/T.47

To the Fair Play Council,

On 12 January this year, I paid an invoice for €8,460. I had expected the invoice. The amount and reference matched the work already agreed, and the message arrived in an email thread I had used before. What had changed was the bank account information. Someone had interfered with the correspondence and replaced the payment details.

I did not notice the change before I approved the transfer. I had no reason, at that moment, to think I was sending money to a fraudster. This is the difficult part to explain afterwards: I entered the payment myself, but I was acting on information that had been made to look trustworthy. A payment can be authorised in the banking sense without being a free or informed choice in the ordinary sense.

At 10:14, I sent the money. Less than an hour later, I checked the details against an earlier record and saw that the account number did not match. I called my bank using the number on my card, reported the suspected invoice fraud and asked it to stop or recall the payment. I also reported the matter to An Garda Síochána and provided the payment details and email records. The transfer was cross-border, to an account elsewhere in the EU. My bank sought recovery through the receiving institution, but the money had not been returned by the time I wrote this letter.

I did what I understood a careful person should do once the problem was clear: contact the bank immediately, preserve the messages, give the authorities the details, and ask for the payment to be recalled. But speed did not give me control over the receiving account, and there was no assurance that the recall would work. The loss was not made less real by the fact that I had pressed the payment button.

In Ireland, the rules I could find did not give a small business a clear promise of reimbursement for a transfer that it had authorised after being deceived. The European Union (Payment Services) Regulations 2018 set protections around payment services, including rules for unauthorised transactions. My case was different: I had approved the transfer, even though the account details were fraudulent. That distinction matters. It can leave a business bearing the loss while the criminal has used deception to obtain the approval.

There is a useful change underway. Under the EU Instant Payments Regulation, euro-area payment service providers are required to provide a verification-of-payee service for euro credit transfers. A check comparing the payee name with the account information could help expose a changed invoice before money leaves. I welcome that. But a warning is not the same thing as a complete remedy. It cannot guarantee that every business will see, understand or act on a warning, and it does not itself promise that a payment will be recalled quickly or that a defrauded small business will be reimbursed.

That is why I support FP-001. The proposed standard asks banks and payment providers to verify payee names, act quickly on recall requests, and reimburse small businesses harmed by authorised push payment and business email compromise fraud, including cross-border cases. Those parts belong together. Verification can prevent some losses; rapid recalls can improve the chance of recovering funds; reimbursement gives a business a route back when prevention and recovery fail.

A fair standard should not treat every case as identical. It can examine whether the business took reasonable care, whether the provider gave a useful warning, how quickly the report was handled, and what recovery steps were attempted. But the starting point should not be that a business must absorb the whole loss simply because an employee or owner authorised the transfer. That is the precise gap fraudsters exploit: the payment looks authorised, while the instruction was corrupted.

I am writing this as one member, not as a claim that every case is the same. I want the Council to keep the cross-border part in the draft. A business does not get to choose that a fraudulent account sits in another country, and the payment system should not make recovery depend on the victim having influence over institutions on both sides of a border. Please make the standard practical: clear verification, urgent recall handling,

a comprehensible complaint path, and reimbursement rules that do not disappear when the payment crossed a national line.