On 3 October 2026, the Hauts-de-France region, in northern France, announced that two of its contractors, Atexo and Docaposte, had suffered a cyberattack that gave access to personal data processed on its behalf: surnames, first names, email addresses and "potentially RIBs" (Next, Clubic). A RIB, or relevé d'identité bancaire, is the slip French banks issue with your account details: IBAN, BIC and the account holder's name. Two days later, Xavier Bertrand, the president of the region, put the number at nearly 545,000 people: at most 515,000 registered on the regional grants platform, and nearly 30,000 beneficiaries and partners of the region's Génération #HDF card, for whom the data involved would mainly be apprenticeship contracts and RIBs (AFP via Techniques de l'Ingénieur). The attacker who has claimed responsibility says they hold 90,011 PDF files, including 15,118 attestations d'hébergement (letters in which someone confirms they're putting you up, used in France as proof of address), and the FrenchBreaches site counted 36,720 RIBs among them (Clubic). The region has not confirmed these figures and says it is not in a position to confirm "the volume and other categories of documents extracted".
It isn't an isolated case. In February 2026, the DGFiP, France's tax authority, revealed unauthorised access to FICOBA, the national register of bank accounts that it keeps: around 1.2 million accounts were affected, with their IBANs and the identity and address of their holders (impots.gouv.fr). In August, Solimut, a French mutual health insurer, reported an intrusion; the attacker claims more than 770,000 IBANs, a figure that hasn't been confirmed (Selectra). According to a survey by Cybermalveillance.gouv.fr, the French government's support service for victims of cybercrime, and the polling firm Ipsos bva, published in September, 45% of French people aged 18 to 75 say they were told about a leak of their data in the past twelve months (Selectra). These leaks are French, and so are the bodies and procedures in this article, though the payment rules behind them are European (SEPA): they concern you if you bank in France or have given your details to a French organisation. If you're in the UK, the box further down explains how things work there.
Should you worry? Yes, but for the right reasons, and knowing what to do.
What can't a fraudster do with your IBAN?
The reassuring part first: an IBAN is not a bank card. It's used to receive money and to authorise direct debits, not to take money out at will. The Banque de France, France's central bank, made the point about the FICOBA leak: these details "do not give access to account balances" and "are not enough to carry out banking transactions" (Banque de France). Nobody can make a transfer from your account, or withdraw money from it, with your IBAN alone.
So what can they do?
Three fraudulent uses are documented.
Setting up a fake direct debit mandate. This is the main risk. Under SEPA, the Single Euro Payments Area, the direct debit mandate is managed by the creditor (the organisation collecting the money), not by your bank. A fraudster can therefore take out a subscription or make a purchase by giving your IBAN, and the payments will be taken from your account. The Banque de France describes direct debits issued "using fictitious mandates", with IBANs that may come from data leaks (Banque de France), and CNIL, the French data protection authority, confirms that an IBAN can "allow a hacker to issue illegitimate direct debit orders" (CNIL). LegalPlace, a French legal-services platform, makes the same point: with an identity document or a signature, malicious people "can put together a fake direct debit authorisation" (LegalPlace). The amounts can be small, and so easy to miss on a statement.
Calling you while posing as your bank. A fraudster who knows your name, your bank and your IBAN sounds credible (the IBAN alone is enough to identify your bank and your branch). This is the "fake bank adviser" scam: they flag a suspicious transaction, then ask you to approve a transaction in your banking app or to read out a code you've received by text (Cybermalveillance.gouv.fr). France's Ministry of the Economy sums it up: "If you have the slightest doubt, hang up" (economie.gouv.fr). And if you're asked to make a transfer yourself, look at the result of the payee check: since 9 October 2025, banks in the euro area, French ones included, have checked before every transfer that the name you enter matches the IBAN (service-public.fr). A mismatch alert should stop you in your tracks, whatever the person on the line tells you; we go through this check and its limits in fake invoices and fake bank details.
Completing an identity-theft file. On its own, a RIB isn't enough. But combined with a copy of an identity document and proof of address, it makes an almost complete file. And an attestation d'hébergement is precisely the kind of document used to open a bank account, take out a mobile phone contract or renew an identity document (LegalPlace). Among the fraudulent uses of a stolen identity, Cybermalveillance.gouv.fr lists opening phone lines or bank accounts and taking out loans (Cybermalveillance.gouv.fr). That's why a leak that brings together RIBs, attestations d'hébergement and identity documents is more worrying than a mere list of IBANs.
What are your rights against a fraudulent direct debit?
They're strong, provided you keep an eye on your statements. The rules below are French; they transpose the EU's Payment Services Directive.
- A direct debit you never authorised: report it to your bank without delay, and no later than 13 months after the debit (70 days if the creditor's bank is outside the European Economic Area). The bank must refund you by the end of the first business day after your request at the latest (service-public.fr). After 13 months, you can no longer get a refund, as the DGCCRF, France's consumer protection authority, points out (DGCCRF).
- A direct debit you authorised but dispute: you have 8 weeks from the debit, with no need to give a reason (the refund is unconditional). The bank refunds you within ten business days (Banque de France).
- Blocking in advance: you can ask your bank to block all direct debits, to allow only certain creditors (a whitelist) or to refuse certain ones (a blacklist). The Banque de France states that your bank "is obliged to act on" such a request.
What should you do if your details have leaked?
On 1 October 2026, for Cybermois, France's cybersecurity awareness month, CNIL and Cybermalveillance.gouv.fr published a three-step leaflet (CNIL). Here is their advice, together with that of the "Personal data leak or breach" fact sheet (Cybermalveillance.gouv.fr) and of the Banque de France:
- Check your statements for several months, small amounts included.
- Tell your bank and, if need be, set up a whitelist of creditors.
- Don't sign any direct debit mandate if you're unsure where it comes from.
- Be wary of calls and messages that quote your details: your bank will never ask you to approve a transaction you didn't initiate.
- Watch for signs of identity theft: unexpected post, a credit application you don't recognise, a contract or subscription taken out without your knowledge. If in doubt, in France you can ask for the list of accounts opened in your name (FICOBA) through the secure messaging in your account on impots.gouv.fr, the French tax website, and check with the Banque de France that you haven't been entered in its registers of payment and credit incidents (Banque de France).
- If you've been defrauded, file a complaint with the police and keep all the evidence.
Two useful points. Perceval, the French online service that often gets mentioned, only handles bank card fraud, not direct debits (service-public.fr). And changing your IBAN usually isn't necessary: it amounts to changing accounts. In its FAQ on the FICOBA leak, the DGFiP writes that "there is no need to change your bank details" (impots.gouv.fr). Finally, be wary of sites that claim to hold the data and offer to tell you whether you're affected: CNIL advises against using them (CNIL).
What about where you are? In the UK, everyday payments go by sort code and account number; an IBAN is mostly what you give someone paying you from abroad (GOV.UK). If a Direct Debit is taken from your account in error, the Direct Debit Guarantee entitles you to a "full and immediate refund" from your bank or building society, and Pay.UK, which runs the scheme, says it also protects you if money is collected fraudulently; it doesn't cover a dispute with the biller, and a refund you weren't entitled to must be paid back when the organisation asks (directdebit.co.uk, directdebit.co.uk). The UK counterpart of the euro area's payee check is Confirmation of Payee, which checks the name you enter against the sort code and account number before you pay a new recipient (Pay.UK). If you've been defrauded, call your bank on 159, then report it to Report Fraud, which replaced Action Fraud in December 2025 (reportfraud.police.uk or 0300 123 2040), or, in Scotland, to Police Scotland on 101 (GOV.UK, Stop! Think Fraud); if your identity documents have leaked too, Cifas Protective Registration (£30 for two years) puts a warning flag on your details so that lenders and other organisations run extra identity checks on applications made in your name (Cifas).
How can you limit the damage next time?
You don't control the security of the organisations you hand your documents to. You do control what you send them, and in what form.
Send only what's asked for. CNIL and Cybermalveillance.gouv.fr remind you not to hand over your documents, bank details included, without making sure the recipient is legitimate, and to give only the information the procedure requires (Cybermois leaflet). When you rent a home in France, for example, a landlord isn't allowed to demand bank statements (CNIL).
Watermark your copies. Cybermalveillance.gouv.fr recommends writing on copies of identity documents why they're being sent, the date and the recipient (Cybermalveillance.gouv.fr). By extension, the same goes for a RIB or an attestation d'hébergement: a document marked "Bank details sent to the Region for grant X, October 2026" loses much of its value as proof in another file. A watermark doesn't stop anyone copying the IBAN, and a well-equipped forger can remove it: it marks the document, it doesn't protect it. You can add this wording with PDFKami's Watermark PDF, right in your browser, without uploading the document; we explain why in Why you should watermark your ID card.
Cut it down before you send it. An application doesn't need your full bank statement; a certificate doesn't need your bank details. Deleting pages or redacting whatever isn't needed can be done locally too. We've gone through these habits in When public services get hacked, what happens to your documents?
Glossary
RIB: relevé d'identité bancaire, a document issued by a French bank that brings together the IBAN, the BIC, the account holder's name and the branch address.
IBAN: the international identifier of a bank account (International Bank Account Number), shown on the RIB.
SEPA mandate: an authorisation given to a creditor to take payments from an account by direct debit; the creditor keeps it, not the bank.
Whitelist, blacklist: lists of authorised or refused creditors, which you can ask your bank to set up.
FICOBA: the French national register of bank accounts, kept by the DGFiP, which lists the accounts opened in France.
Identity theft: using someone else's identity; in France, punishable by one year's imprisonment and a €15,000 fine (Article 226-4-1 of the French Penal Code).
Verification of payee: a check, compulsory in the euro area since 9 October 2025, that compares the payee's name with the IBAN before a transfer.