As virtual IBANs become increasingly common in the fintech world, a new report highlights the vulnerabilities of this innovative tool. Although they are legal and often useful, these fictitious bank account numbers are increasingly exploited by criminal networks, raising concerns about their future use.
Key Takeaways
- Virtual IBANs, or vIBANs, are used to redirect payments to a single account, but their structure is exploited by criminal networks.
- Two high-risk uses have been identified: cascading reassignment and the use of misleading country codes.
- New European and French regulations aim to strengthen control and transparency of vIBANs by 2027.
Understanding Virtual IBANs and How They Work
Virtual IBANs, also known as vIBANs, faithfully mimic the appearance of a traditional bank account number. Their main purpose is to facilitate the receipt of payments by redirecting them to a single master account. This mechanism, well established in France for a decade, is now regulated by European regulations to reduce the risk of abuse.
The Risks Associated with the Use of vIBANs
Although useful for many businesses and individuals, vIBANs present certain risks. The technique of “cascading reassignment” is particularly problematic. In this scenario, vIBANs are redistributed at multiple levels, making it difficult to track the real users. Additionally, the use of country codes that do not match the actual location of the funds complicates interventions by financial authorities.
Tracfin has already identified cases of money laundering involving multi-country vIBANs. These manipulations represent about 20% of the value of fraudulent transfers reported in France in 2022, despite their small share in the total transactions.
Regulatory Responses to These Risks
To counter these abuses, Europe adopted new rules in 2024. They require banks and payment providers to clearly identify vIBAN holders and share this information with authorities within five business days. Additionally, all vIBANs must be registered in national banking registers.
In France, the Prudential Supervision and Resolution Authority (ACPR) requires that vIBANs with foreign country codes or reassigned in cascade be treated as real payment accounts, which involves strict verification of customer identities and their transactions.
Future Prospects for Virtual IBANs and Financial Security
With the increase in cyber threats and the sophistication of criminal networks, financial security has become a global priority. Virtual IBANs, although advantageous, require continuous adjustments to prevent abuse. In the future, the adoption of stricter international standards on the format of vIBANs could help prevent diversions and improve transaction traceability. The evolution of regulation and technology will strengthen public confidence in these tools while ensuring effective protection against illegal activities.