LuxHawk.lu (+352) 27 52 67 45

← Back to knowledge

Co-ownership funds: transfer fraud and forged bank details

Buildings and co-ownership 10 min Author : Arnaud Colin Updated : 19/09/2026

Summary

The fraudster does not attack the bank: they place themselves between the party that pays and the party that should receive, either by taking control of the accounts workstation that approves the transfers, or by slipping altered bank details into an email that imitates a known contact. In Luxembourg, CIRCL documented in 2025 fraudulent transfers prepared by a fake invoice and a remote-access tool; in France, the Court of Cassation (Cour de cassation) ruled in 2026 that paying an impostor does not discharge the debtor, who must pay a second time. The defence rests on procedures: verification of any change of bank details through an independent channel, four-eyes approval, smart card removed from the reader.

A managing agent (syndic), a building manager or a property management company lives on bank transfers: calls for funds, rents, contractors’ invoices, service charge statements. That flow is precisely what a fraudster seeks to divert. They do not attack the bank’s vault; they place themselves between the party that pays and the party that should receive, either by taking control of the workstation that signs the payments, or by making people believe that the beneficiary’s bank details have changed. Two recent case files describe these two mechanisms with primary sources: a campaign documented in Luxembourg by CIRCL in 2025, and a series of French alerts and court decisions, between 2022 and 2026, which answer the question every co-owners’ council ends up asking: when the money has gone to a fraudster, who still owes it?

Luxembourg, 2025: the fake invoice that takes control of the accounts workstation

On 26 February 2025, the national incident response centre, CIRCL, published report TR-93 (version 1.0, releasable without restriction, TLP:CLEAR). It names no victim: it brings together several reports from organisations and individuals who learned from their bank that unknown transfers were leaving their accounts. The date of the incidents themselves is not given. On 3 March 2025, the financial sector supervisory authority, the CSSF, relayed the report and strongly recommended that the supervised entities concerned take note of it and act accordingly.

The vector is a fake invoice received by email. On opening it, the person unknowingly installs a remote-access tool from the family of remote monitoring and management (RMM) software that IT professionals use legitimately. The antivirus does not block it, since the software is not malicious in itself; the attacker in fact installs several of them to keep their access. They then watch the workstation, which often belongs to an accountant or a financial officer, and capture the smart card PIN as it is typed to approve a payment in Multiline. Once that code has been captured, the fraudulent transfers leave for abroad. The report also notes that malicious emails are sent to the contacts in the victim’s address book, which turns each compromised workstation into a relay towards the next ones.

What made the attack possible owes nothing to a software flaw: the report mentions no CVE. Everything rests on a human action, opening the invoice, on a legitimate tool that conventional defences let through, and on a smart card whose PIN is typed on a computer that someone else is watching.

The impact is not consolidated: CIRCL publishes neither a victim’s name nor an overall amount. It gives two examples, around €30,000 in ten operations and €1,000,000 in a single one, and states that the banks detected some of the operations. For the organisation affected, recovery is heavy: a simple antivirus scan settles nothing, the workstation has to be completely reinstalled.

CIRCL’s recommendations are concrete: an endpoint detection tool (EDR) configured with a whitelist of the only remote monitoring and management software that is authorised; the LuxTrust Mobile or LuxTrust Scan alternatives to the smart card; the card removed from the reader as soon as it is no longer in use; four-eyes approval of payments; multi-factor authentication. The report speaks neither of managing agents nor of co-ownerships. The transposition is ours, and it is direct: a managing agent’s accounts workstation does exactly what TR-93 describes, preparing and signing transfers on behalf of every co-ownership it manages.

France, 2022-2023: the forged bank details that imitate the property manager

The second mechanism requires no software on the victim’s workstation. A credible email is enough. Cybermalveillance.gouv.fr, in an article dated 10 January 2024 and updated on 15 July 2025, notes several waves of fraudulent emails aimed at diverting rents since late 2022.

In France, Foncia warned its clients on LinkedIn in November 2022, then again at the end of September 2023. Clients had fallen victim to transfer scams built on their actual situation: falsified emails, in Foncia’s corporate style, invited them to pay to the bank details (RIB) attached. The company’s response is a change of rule rather than a tool: it has prohibited any sending or requesting of bank details by email, directs its clients to the MyFoncia portal, promotes multi-factor authentication, and has opened a dedicated reporting channel (emeria.signalement.net). Foncia also publishes a page, “Comment se protéger” (How to protect yourself), for its clients.

On 30 December 2022, France 3 Occitanie gave a voice to an agency in Albi, Midi Immobilier, and reported that notaries’ offices were also on their guard. The agency explains that the fraudsters find its clients’ names in Google reviews, and that they use short-lived mailboxes, active for eight days. No scam succeeded against this agency, which shows that the defence exists.

The vector is therefore identity theft by email: a hyphenated domain such as “foncia-gestion.com”, or a domain that differs from the real one by a single letter, a template that reproduces the manager’s corporate style, and accurate details drawn from public or stolen data. In some cases, it is the professional’s own mailbox that has been compromised, and the email then leaves from the genuine domain. Here again, no software vulnerability: the weakness lies in the procedure that accepts a change of bank details announced by email.

Who pays when the money has gone? Two decisions from 2026

The question that interests a co-owners’ council is not only “how”, but “who bears the loss”. Two French decisions from 2026 answer it, and not in the direction the payer hopes for.

On 17 June 2026, the commercial chamber of the French Court of Cassation (Cour de cassation) handed down judgment no. 24-13.306, published in the Bulletin. The facts are ordinary: an email whose address differs from the supplier’s by a single letter, an invoice for €103,375.64, altered bank details. The debtor had paid the fraudster. The Court holds, on the basis of Article 1342-3 of the French Civil Code, that “a third party who usurps the creditor’s identity is not an apparent creditor” (our translation). The payment does not discharge the debt: the debtor remains liable and must pay a second time. The cassation is partial and the case is referred back to the Lyon Court of Appeal. The dispute was between two companies; for a co-ownership, this decision should be read as the statement of a principle, not as a ruling on a call for funds.

On 25 March 2026, the Paris judicial court (tribunal judiciaire) ruled on a neighbouring case, reported by Clubic on 4 April 2026. The facts date from October 2022: a notary’s email was intercepted, the IBAN it contained was replaced, and on a €320,000 transaction, €96,400 was transferred to the fraudster. €27,792.62 was recovered; the net loss amounts to €68,607.38. The court ordered the notary to bear 70% of it, i.e. €48,025.17, for manifest carelessness: having sent the bank details as an email attachment without precaution. The victim keeps 30% at its own expense. The banks are exonerated.

Both decisions are French; they do not say what a Luxembourg court would rule in a comparable case. They do, however, describe a line of reasoning that a managing agent would do well to know: whoever pays an impostor has not paid, and the professional who circulates bank details by email without precaution may be held liable for a large share of the loss.

What this teaches a building or a co-ownership in Luxembourg

The two case files converge on a single finding: none of the attacks described exploits a technical flaw. They exploit a payment procedure, or its absence. The measures below are drawn directly from CIRCL’s recommendations, from Foncia’s response and from the two decisions.

  • A change of bank details is never handled by email. Any new bank details, whether from a contractor, a co-owner or the managing agent, are verified through an independent channel: a call to the number already on file, never the one given in the email, or an authenticated portal. The managing agent would do well to write to its co-owners that it will never announce a new bank account by email, as Foncia did.
  • A foreign IBAN or an account holder name that differs from the expected one is an alert, not a detail to be regularised later.
  • Four-eyes approval, recommended by CIRCL, and transfer limits on co-ownership accounts are exercised from a workstation other than the one that prepares the transfers. If the same computer prepares and approves, the attacker who holds it does both.
  • The smart card comes out of the reader as soon as it is no longer in use. A PIN typed on a workstation that a stranger is watching amounts to handing them the signature. CIRCL cites the LuxTrust Mobile or LuxTrust Scan alternatives.
  • The antivirus does not see a legitimate remote monitoring tool. CIRCL recommends an endpoint detection tool (EDR) with a whitelist of the only authorised tools. Any remote-access window that was not requested is reported immediately.
  • Multi-factor authentication on the mailbox and on management portals, cited by CIRCL as by Foncia, closes the compromised-mailbox route, the one where the fake email leaves from the genuine domain.
  • The managing agent’s mandate and the contracts with contractors can set out in writing the channel through which bank details are communicated and verified. The Paris judicial court held that a professional who sends bank details as an attachment without precaution shows manifest carelessness; a written procedure is also what makes it possible to demonstrate precaution.
  • An agent who discovers that its mailbox has been compromised alerts all its principals without delay. Fraudsters use the address book; every contact becomes a target. If co-owners’ personal data may have been accessed, the GDPR benchmark applies: notification to the authority, the CNPD in Luxembourg, within 72 hours (Article 33) and information to the persons concerned without undue delay (Article 34).
  • When a transfer has gone: the bank first, to recall the funds within the following hours, then the criminal complaint. When the bank calls to confirm a transfer that nobody recognises, that is the incident: the workstation is not cleaned, it is completely reinstalled, and CIRCL is informed.

Most of these measures are less a matter of investment than of a decision, taken before the incident, on who approves a payment, on how bank details enter the accounts and on what is done when the bank calls.

Sources