Data from 1.2 million French bank accounts accessed illegally, beware of fraudulent direct debits

A large-scale operation. Illegitimate access to the national file of bank accounts (FICOBA) has taken place in recent weeks, indicates the Ministry of Finance in a press release released on Wednesday.

“As of the end of January 2026, a malicious actor, who usurped the identifiers of an official with access as part of the exchange of information between ministries, was able to consult part of this file which lists all the bank accounts opened in French banking establishments and contains personal data,” underlines Bercy.

Bank details (RIB/IBAN), identity of the holder, address and, in certain cases, the user’s tax ID are particularly concerned. The data of 1.2 million French bank accounts were reportedly consulted.

“Data that is not enough to make a transfer or payment by card”

“As soon as this incident was detected, immediate access restriction measures were implemented in order to stop the attack, limit the extent of the data consulted and extracted from this database (…) and prevent any further illegitimate consultation,” assures the ministry.

“Work is underway to restore the service in the best protective conditions. The users concerned will receive individual information in the coming days alerting them that access to their data has been noted,” the press release continues.

Contacted, the French Banking Federation (FBF) explains that banking establishments will also inform users affected by this intrusion.

“The disclosure of Ficoba data, that is to say account number (IBAN), first and last name, date and place of birth is not enough to make a transfer or payment by card”, underlines the FBF which invites the people concerned, like all customers, to be particularly vigilant.

Because the people who are victims of this data leak are likely to be victims of false creditors who, using the IBAN, can request the execution of direct debits. “Under two conditions,” the FBF tells us. The first: be registered as a direct debit issuer with a payment service provider, the second: have direct debit mandates. »

Good reflexes to have

“The fraudster then falsifies direct debit mandates to IBANs that he obtained illegally and thus recovers the funds,” continues the FBF. Fraudsters can also take out subscriptions and services which would be paid for by debiting this illegally obtained IBAN. The fraudster thus benefits from real services paid for by the person whose IBAN was stolen. »

To protect yourself against this, the Observatory on the Security of Means of Payment advises regularly checking and updating in your online banking space the list of authorized creditors (also called “white list”) or prohibited (also called “black list”). And monitor direct debit transactions debited from your account and, in the event of fraud, immediately contest the direct debit transaction.

Furthermore, the FBF reminds that you should never communicate to your banker, or someone who claims to be one, your codes, identifiers or passwords because they do not need them, and that you must immediately notify your bank in case of doubt or if you are not the originator of a transaction.