CEO Fraud in France (Fake Transfer Order): How to Respond and Obtain Redress

When a company falls victim to CEO fraud, it must act on three fronts at once. Contact its bank immediately to try to block or recall the funds. Preserve all the evidence: emails, transfer orders, call logs. File a criminal complaint without waiting, as the 72-hour period is a condition for insurance compensation when the fraud involves a computer intrusion. Remedies against the bank, the insurer or the perpetrators can then be examined. Every situation is different.

What is CEO fraud?

CEO fraud, or fake transfer order fraud, follows a well-rehearsed scenario. A fraudster poses as the company’s director, or as a trusted third party acting at the director’s request. They contact an employee in the accounting or finance department, often by email or phone. They invoke an urgent and confidential transaction: a secret acquisition, a tax audit, a strategic contract. They obtain one or more transfers to accounts they control, frequently abroad.

There are many variants: a fake supplier announcing a change of bank details, a fake bank technician running transfer “tests”, a fake lawyer or a fake statutory auditor. The common thread remains the manipulation of an employee authorised to make payments. The prior compromise of an internal mailbox often makes the fraud easier: the fraudster then knows the habits, the ongoing matters and the style of the exchanges. Voice and image cloning by artificial intelligence now makes these set-ups more convincing: our article deepfakes: what the law says and the remedies (in French) covers these techniques.

How to recognise a CEO scam

The DGCCRF (French consumer protection and fraud control authority) describes the typical pattern: the fraudster contacts the company by email or phone, posing as the chairman of the parent company or group. After a few exchanges designed to build trust, they ask for an unplanned international transfer, presented as urgent and confidential. Several signs should alert the accounting department:

• a transfer request outside the usual process, often to an account abroad unknown to the company;
• urgency and secrecy demanded, with the instruction to tell no one;
• a request to bypass internal approval procedures;
• an email address or phone number slightly different from the director’s;
• notice of a change of bank details from a supplier, a customer or a so-called public authority;
• a request made during the holidays or a busy period, when the usual managers are away.

The DGCCRF recommends not acting in haste despite the other person’s insistence and checking their identity through reliable sources. It also notes a two-step variant: the fraudster first poses as the tax authorities to obtain information on the company and its customers, then contacts the customers posing as the company to announce a change of bank account.

Fraud within the meaning of the French Criminal Code

Legally, CEO fraud is fraud (escroquerie): the use of a false name, a false capacity or fraudulent manoeuvres to induce the handing over of funds. Article 313-1 of the French Criminal Code (Code pénal) punishes it by 5 years’ imprisonment and a €375,000 fine. The penalties rise to 7 years and €750,000 where there are aggravating circumstances, and to 10 years and €1,000,000 when the fraud is committed by an organised gang, a frequent scenario for these structured networks.

Other offences may be added depending on the modus operandi. Impersonating a third party, online in particular, is punishable by one year’s imprisonment and a €15,000 fine (Article 226-4-1 of the Criminal Code). If the fraud involved unauthorised access to the company’s mailbox or information system, offences against automated data processing systems are also in play (Articles 323-1 et seq.). These offences form the basis of the complaint and guide the investigation.

Immediate steps after discovering CEO fraud

Alert the bank without delay. Ask for transfers still being executed to be blocked and for funds already sent to be recalled. This return request, sent to the beneficiary’s bank via your bank, offers no certainty: its effectiveness depends on how quickly you react and where the funds are, often dispersed in a cascade. Every hour counts.

Preserve the evidence. Keep the fraudulent emails with their full technical headers, the transfer orders, the bank statements, the calling numbers and any notes of the phone conversations. Delete nothing, even embarrassing messages: they document the fraudulent manoeuvre and how trust was built.

File a criminal complaint quickly. The complaint triggers the investigation and records the date of discovery. In some cases it is also a condition for insurance: where the losses result from an attack on an automated data processing system, such as a compromised mailbox, Article L. 12-10-1 of the French Insurance Code (Code des assurances) makes compensation of professionals conditional on filing a complaint no later than 72 hours after becoming aware of the attack.

Notify the insurer of the loss. Check your fraud and cyber cover, its limits and its reporting conditions. Policies impose short deadlines and precise supporting documents.

Key time limits

What remedies do you have against the bank?

The question almost always arises: must the bank that executed the transfers refund them? The answer first depends on one distinction: was the transaction authorised or not?

Transfer ordered by a deceived employee: the bank’s duty of vigilance

In CEO fraud, it is usually an authorised employee who places the order. The French Supreme Court (Cour de cassation) drew the consequences in a judgment published in the Bulletin on 19 November 2025 (Cass. com., No. 24-17.056). The refund regime of the Monetary and Financial Code covers only unauthorised or incorrectly executed transactions. A transfer authorised by the employee who held a power of attorney over the accounts therefore falls under ordinary contractual liability (Article 1231-1 of the French Civil Code).

This liability remains limited. As the bank must not interfere in the client’s affairs, it need only alert the client in the presence of apparent anomalies, easily detectable by a normally diligent professional. In the 2025 case, the Court quashed the judgment that had held the bank liable. A large transfer to a new beneficiary, made in summer, was not enough: the company had already made a large transfer and worked with a company established in the same country.

Conversely, the judgment of 2 October 2024 (Cass. com., No. 23-13.282, published in the Bulletin) shows when vigilance is required. The orders were close together and repeated, for high amounts compared with the company’s habits, in favour of companies outside its business relationships and located outside the usual geographical area of its activity. The bank had to check their regularity with the director, the only person authorised to approve them; a call to the accountant was not enough. The order against it to pay €1,060,951.90 was upheld.

In practice, everything turns on the comparison between the disputed transfers and the account history: amounts, frequency, countries and identity of the beneficiaries, the person who placed the order. Statements for the previous months and the account agreement are the first documents to gather.

Unauthorised transaction: the Monetary and Financial Code regime

Where the transaction was not authorised, for example a transfer made by a third party who took control of the online access, Article L. 133-18 of the Monetary and Financial Code requires the bank to refund immediately, no later than the end of the first business day after the report, unless it has good reason to suspect fraud by the user and communicates those reasons in writing to the Banque de France. The burden of proof lies with the bank: use of the payment instrument “is not necessarily sufficient” to prove authorisation or gross negligence by the payer (Article L. 133-23). The report must be made without delay, no later than 13 months after the debit (Article L. 133-24); for a business customer, the account agreement may provide for a different period.

The Court of Cassation clarified the notion of gross negligence in a notable judgment: Cass. com., 23 October 2024, No. 23-16.267, published in the Bulletin. In this spoofing case, a customer had approved transactions after a call from a fraudster who spoofed the number of the customer’s bank adviser. The Court upheld the lower courts in ruling out gross negligence on the part of a customer whose trust had been gained in this way: the order against the bank to refund €54,500 was upheld. We had commented on a similar decision on bank spoofing (in French). For remedies available to individuals, see our bank fraud lawyer (in French) page.

Insurance and internal follow-up

On the insurance side, everything depends on the wording of the policy: some fraud policies cover fake transfer orders, others exclude them or cap them heavily. The claim must be made quickly and completely, and compliance with the 72-hour complaint period checked as soon as the fraud involves a computer intrusion. A careful review of the clauses, exclusions and conditions of cover is needed before any discussion of compensation. The most frequent grounds for refusal are detailed in our article cyber insurance: cover, exclusions and refusals of compensation, and disputes with the insurer on our cyber litigation (in French) page.

Internally, the company gains more by treating the incident as a test of its procedures than by looking for a culprit. The manipulated employee is the target of the fraud, not its perpetrator. The analysis usefully focuses on payment approval processes, delegations of authority and mailbox security, all of which will also weigh in discussions with the bank and the insurer.

Obtaining redress: criminal and civil routes

Beyond the emergency, the victim company has several levers to seek compensation. In criminal proceedings, it can join as a civil party to claim compensation for its loss from the identified perpetrators, during the prosecution for fraud. The effectiveness of this route depends on identifying the perpetrators and locating attachable assets, which is often uncertain with international networks.

That is why the analysis of the liability of solvent parties, first and foremost the bank and the insurer, generally shapes the recovery strategy. Each avenue requires a precise examination of the facts and contracts: no outcome can be assured, and how the criminal, civil and insurance proceedings fit together is decided in the light of the case.

Preventing CEO fraud

Legal and organisational prevention relies on a few simple rules. Introduce systematic dual approval for any transfer above a threshold, with no urgency exception. Require a verification call-back to the person giving the order, on a number already known, never on the one given in the request. Lock down the procedures for changing suppliers’ bank details. Regularly train accounting teams on manipulation scenarios. And review your banking and insurance contracts to know, before any incident, the real extent of your cover.

How we assist you with CEO fraud

We act in the hours following the discovery of the fraud, then throughout the remedies. Every situation is different: the strategy is decided in the light of the documents.

• In the emergency: request to recall the funds and letters to the bank, criminal complaint for fraud and, where applicable, for computer intrusion, claim to the insurer, notification to the CNIL if personal data is exposed.
• Against the bank: analysis of the account history and apparent anomalies, formal notice, then a liability action if the case justifies it.
• With the insurer: review of the fraud and cyber cover, response to requests for documents, challenge to a refusal.
• In criminal proceedings: monitoring of the investigation and civil-party claim against the identified perpetrators.
• Prevention: payment procedures, delegations of authority, clauses in banking and insurance contracts.

For an initial discussion, call the firm on 01 85 73 56 66 or write to us. If the fraud is part of a wider attack on your systems, see our cyberattack lawyer for businesses page; for the criminal follow-up, see our cybercrime lawyer page.

Frequently asked questions about CEO fraud

Must the bank refund a transfer approved by a deceived employee?
Not automatically. A transfer made by an authorised employee is an authorised transaction: the refund under Article L. 133-18 of the French Monetary and Financial Code does not apply. The bank is liable if it executed orders showing apparent anomalies without checking them (Cass. com., 19 November 2025, No. 24-17.056; 2 October 2024, No. 23-13.282).

How soon must you file a criminal complaint?
As soon as possible. Where the fraud involves an attack on the information system, a complaint within 72 hours of discovery is a condition for insurance compensation of professionals (Article L. 12-10-1 of the French Insurance Code). Acting quickly also improves the chances of blocking the funds.

Can funds sent abroad be recovered?
It is difficult and never certain. The chances depend on how quickly the bank is alerted, the cooperation of the receiving institutions and any freezing of the accounts during the criminal investigation. No outcome can be promised.

What penalties do the perpetrators face?
Fraud (escroquerie) is punishable by 5 years’ imprisonment and a €375,000 fine, increased to 10 years and €1,000,000 when committed by an organised gang (Articles 313-1 and 313-2 of the French Criminal Code). Identity theft and computer intrusions are separate offences that may be added.

What is FOVI?
FOVI stands for “faux ordre de virement international” (fake international transfer order). It is the other name for CEO fraud: a fraudster poses as a director, a supplier or a public authority to obtain a transfer to an account they control, often abroad.

How can you recognise a CEO scam?
The classic warning signs are a request for an unplanned, urgent and confidential transfer, an instruction to bypass internal procedures, an email address or phone number slightly different from the director’s, or notice of a change of bank details. The right response is to call back the person giving the order on a number already known.

Does insurance cover CEO fraud?
It depends on the policy: some fraud or cyber policies cover fake transfer orders, others exclude them or cap them. Where the fraud involves a computer intrusion, a complaint within 72 hours is a condition for compensation of professionals (Article L. 12-10-1 of the French Insurance Code).

Official sources

• Article 313-1 of the French Criminal Code, fraud (escroquerie) – Légifrance (in French)
• Article 226-4-1 of the French Criminal Code, identity theft – Légifrance (in French)
• Article L. 133-18 of the French Monetary and Financial Code (Code monétaire et financier), refund of unauthorised transactions – Légifrance (in French)
• Article L. 133-23 of the French Monetary and Financial Code, burden of proof – Légifrance (in French)
• Cass. com., 23 October 2024, No. 23-16.267, published in the Bulletin (bank spoofing and gross negligence) – Légifrance (in French)
• Article L. 12-10-1 of the French Insurance Code, complaint within 72 hours and compensation of cyber risks – Légifrance (in French)
• Article 313-2 of the French Criminal Code, aggravated fraud and organised gang – Légifrance (in French)
• Article 1231-1 of the French Civil Code (Code civil), contractual liability – Légifrance (in French)
• Cass. com., 19 November 2025, No. 24-17.056, published in the Bulletin (authorised transfer, duty of vigilance, apparent anomalies) – Cour de cassation (in French)
• Cass. com., 2 October 2024, No. 23-13.282, published in the Bulletin (CEO fraud, verification with the director) – Cour de cassation (in French)
• Article L. 133-24 of the French Monetary and Financial Code, 13-month period – Légifrance (in French)
• Article 85 of the French Code of Criminal Procedure (Code de procédure pénale), complaint with civil-party petition – Légifrance (in French)
• Article 8 of the French Code of Criminal Procedure, limitation period for délits (intermediate-level offences) – Légifrance (in French)
• Article 33 of the GDPR, notification of data breaches – CNIL (in French)
• DGCCRF, “Se prémunir contre l’escroquerie aux faux ordres de virement ou ‘arnaque au président’” (Protecting yourself against fake transfer order fraud or “CEO scam”) – economie.gouv.fr (in French)

This article presents the law for general information purposes. It does not constitute legal advice. Every situation is different and calls for a specific analysis. Content compliant with the professional conduct rules of the legal profession.