French E-Invoicing: Directory Guarantees & Fraud Risks

Key takeaways

• The official e-invoicing directory confirms where to deliver an invoice, not whether the invoice is honest: it secures the invoice, not the debt, and an invoice can be fully compliant and completely fraudulent.
• Arriving through an approved platform (plateforme agréée, PA) proves the sender is registered with the tax authority's routing network, nothing more about the goods, the price or the bank account.
• IBAN substitution is the dominant risk: the fake bank-details scam costs French companies close to 150 million euros a year.
• Your controls stay the same as in the paper era, only faster: three-way match, supplier identity check, and a locked procedure for any change of bank details.

Does an invoice received through the official directory mean it is genuine?

No. The directory (annuaire de la facturation électronique) is an address book, not a certificate of good faith. It is the reference list of invoicing addresses, consolidated from the directories kept by the platforms, and its job is to identify each VAT-registered business so invoices reach the right recipient.

What that guarantees is narrow but real: the invoice reached you because your SIREN is correctly listed, and the sender used a platform that the DGFiP (Direction générale des finances publiques, the French tax administration) has registered. An approved platform is an operator registered by the DGFiP that issues, receives and transmits your B2B electronic invoices and reports the tax data to the administration.

What it does not guarantee: that the service was ordered, that the amount is right, that the company behind the SIREN is solvent or honest, and above all that the IBAN printed on the document belongs to the supplier. The Portail Public de Facturation (PPF) no longer handles invoices at all. Since October 2024 its role has been limited to two functions: holding the central directory of VAT-registered businesses with their e-invoicing addresses, and acting as a concentrator of tax data sent to the DGFiP.

The directory tells you where to send an invoice. It says nothing about whether you owe it.

What exactly does the approved platform check before an invoice reaches me?

It checks format and routing, not substance. A PA verifies that the invoice uses one of the accepted structured formats, that the mandatory tax fields are present, that the recipient's address exists in the directory, and then transmits the fiscal data to the DGFiP. Operators had to file an application proving they met the requirements in order to obtain registration, the prerequisite for transmitting invoices electronically from 1 September 2026.

That registration is a serious filter on the pipe, not on the payload. Nothing in the process compares the invoice to your purchase order, your delivery note or your contract. Nothing checks that the IBAN is the one your supplier used last month. During the migration, a new trading name, a new tool or a new platform can make a request look credible, yet none of them proves a new SIRET or a new IBAN: the decisive check is on legal identity and bank details.

One technical point worth knowing, because it is a cheap control: Factur-X invoices combine a readable PDF with embedded XML data. The visible PDF and the embedded XML must agree, and a divergence is an anomaly to block, not a normal variation of the format. Ask your platform whether it runs that consistency check automatically.

Which frauds survive the reform, and which ones disappear?

Routing fraud becomes harder; identity and payment fraud get easier to disguise. The new circuit reduces manual handling, but it also creates openings for impersonation.

Fraudsters understood that the reform offered ideal cover: tax rules, a legal obligation, company data, bank details, login credentials. The DGFiP has already warned about this. According to the administration, fraudsters pose as officials and contact companies claiming there is a problem with Chorus Pro.

And a useful rule of thumb from the tax authority's own guidance: it will never ask you to send your password by email, to install an executable attachment, to pay a registration fee for the reform, or to replace a supplier's bank details.

A worked example: a 40-person accounting firm receiving 300 supplier invoices a month

Picture the firm's accounts payable clerk. From 1 September 2026, most of those 300 invoices arrive as structured data through the firm's PA instead of landing in a shared mailbox. The win is real: no re-keying, no lost PDF, automatic posting. The risk is that automation turns "received through the official channel" into "already approved".

Here is where it breaks. One invoice of 4,800 euros arrives from a supplier the firm has used for three years. Correct SIREN, correct VAT number, correct platform, perfectly structured XML. The only change is the IBAN. In the weeks around the 1 September 2026 deadline this fraud becomes formidable: the accounting team receives many legitimate update requests linked to the reform, so a fraudulent one can slip through carried by the same context and the same tone.

Three controls would have caught it, none of them technical:

1. Bank details are a master-data change, not an invoice field. A new IBAN on an invoice triggers nothing automatically. Any IBAN change request must be confirmed by phone with a known contact and recorded in the validation process.
2. Three-way match before approval: invoice against purchase order against delivery note. A mirror invoice with no matching order fails here.
3. A payment threshold with dual approval. Require double validation on transfers above a defined threshold.

Teams that handle this volume often pair the PA with an extraction layer that reads the attached documents (delivery notes, order confirmations, contracts) so the match can be automated; Sygnet works on that document-reading side, and its e-invoicing France page describes how structured invoices and scanned supporting documents end up in the same workflow. For firms sizing the manual effort first, the accounting firms solution page covers the same ground from the practice-management angle.

What should I verify before paying an invoice that came through the directory?

Verify the supplier, the obligation and the bank account, in that order. The channel is the one thing you no longer need to doubt.

Supplier identity: does the SIREN match the trading name? An inconsistent SIREN, absent from the directory or not matching the name, is a red flag. A Kbis extract confirms legal existence and the registered representative, though it has limits worth knowing before you treat it as proof of anything else (see what a Kbis extract does and does not prove).

The obligation: is there a contract, an order, a delivery? A well-known brand or a supplier you have no contract with should stop the payment regardless of how clean the invoice looks.

The bank account: never from the document alone. Never change an IBAN on the basis of a received document. Call a number you already had on file, not the one on the invoice.

Access security matters too. Protect access to your approved platform with multi-factor authentication, because a compromised platform account produces invoices that pass every structural check.

Who is now obliged to receive e-invoices, and what happens if I am not ready?

Everyone subject to VAT in France has been obliged to receive since 1 September 2026, with issuing phased in. Since 1 September 2026, VAT-registered businesses established in France must be able to receive electronic invoices through an approved platform, while large companies, mid-caps (ETI) and members of a single taxable entity must issue in electronic format and transmit their e-reporting data. Issuing becomes compulsory for very small businesses, SMEs and micro-enterprises on 1 September 2027.

Adoption is incomplete. At 20 September 2026, 71.4% of the core target had an approved platform, up from 55% at 16 August and 66% at 1 September; across the full population of 11 million entities the take-up rate was 43%. No penalties applied in 2026, which does not make waiting sensible: if you are not connected, your suppliers' invoices have nowhere to land.

One clarification that saves arguments with suppliers: a supplier cannot invoke the e-invoicing rules to force a non-taxable entity to join an approved platform, since such a request belongs to the commercial relationship, not to a regulatory obligation.

FAQ

Can I refuse an invoice received through an approved platform?

Yes, on substance. The platform delivers the document and records a status; it does not decide that you owe the money. You can reject or dispute the invoice through the status mechanism exactly as you would have returned a paper invoice, for instance if the quantities are wrong or there is no matching order. The obligation created by the reform is to be able to receive and to respond with a status, not to pay.

How do I check that a platform is really approved?

Use the official list, never a link in an email. The DGFiP publishes the list of approved platforms on impots.gouv.fr, and at the end of January 2026 there were 103 registered platforms with 29 more awaiting registration. Check the platform with the DGFiP, then reach the service from an address you already know.

Does an empty or missing directory entry mean a company is suspicious?

Not necessarily, but it deserves a question. A missing entry usually means the business has not yet chosen an approved platform, which is still common given the 43% overall take-up. Treat it as an operational blocker (you cannot send them a compliant invoice) rather than as evidence of fraud. What should worry you is a SIREN that does not match the name you were given, or an entity you have no contractual relationship with.