Suspected hijacking
I suspect my company has been hijacked: where to start
A document filed at the register that you did not sign, a director replaced without you, accounts or access slipping away: here are the steps to take, in the order we suggest doing them, while the doubt remains.
Read this first
This page answers a suspected hijacking: TierSafe does not certify that a fraud has taken place. General information, not legal advice. This order is a suggestion ranked by urgency (money and access first, the legal route in parallel), not an official procedure. Get a lawyer’s advice from the first day. The links lead to sites we do not control.
0 of 12 steps ticked
Your ticks stay in this browser: nothing is sent to TierSafe.
-
Keep the evidence
Keep everything, as it is: dated Kbis extract, the filed document, e-mails, screenshots, statements. Delete nothing, even what seems useless.
Who: Yourself. Date and file your screenshots as you go.
If your company is monitored by TierSafe Sentinelle, its page issues a dated timeline of the changes detected: an information statement, never legal evidence.
-
Warn your banks
Alert each bank, without delay, to have transactions and online access blocked.
Who: Your adviser or each bank’s helpline. There is no common counter.
Get ready: The list of your accounts, the Kbis, a proof of identity.
-
Take a lawyer to act in court
From the first day: summary proceedings and an approach to the judge in charge of the register are prepared with them, and a hearing takes weeks. Do not count on an immediate effect.
Who: A lawyer of your choice, preferably used to company law.
Get ready: The Kbis, the articles of association, the filed document, the police report receipt.
-
File a police report
One report per act noted (forgery, fraudulent access, fraud), at the police station, the gendarmerie or in writing to the public prosecutor. Keep a copy.
Who: The police, the gendarmerie or the prosecutor. Free help: Info Escroqueries, 0 805 805 817.
The online pre-complaint can save time for the facts it suits; check on site that it covers your case.
-
Warn the commercial court registry
Tell the registry that entered the document that you dispute it, and ask for a copy of the filed document.
Who: The commercial court registry your company falls under. INPI forwards the filings, but correcting them is up to the registries.
We found no official procedure for disputing a document filed without your consent: that is why the lawyer comes first. They will tell you the right step.
-
Tax office: access and authorisations
If you can still reach your professional account, review your services (“Gérer mes services”) and delete the authorisations you do not recognise. Otherwise, contact the business tax office (SIE) that handles your file: only it can put a principal administrator’s authorisation on hold, at the legal representative’s request.
Who: Your business tax office (SIE).
If the register now names someone else than you as legal representative, attach your police report and the register extract to your request. The teleservice helpline answers on 0809 400 210, 8 am to 6 pm, Monday to Friday (tax administration sheet of 12/10/2026).
-
Urssaf
Warn Urssaf without delay: through your online account if you can still reach it, otherwise by phone or through your Urssaf’s contact form.
Who: Your Urssaf, through your online account or by phone.
We found no public procedure dedicated to the hijacking of an employer account: explain the situation and attach your police report as soon as you have it.
-
Chorus Pro and invoicing platform
If you send or receive invoices through Chorus Pro or an approved platform, ask the support to check who manages your organisation’s account.
Who: Chorus Pro support (“Contact us”) and that of your approved platform.
There is only one main manager per organisation, transferable. We found no public procedure for unauthorised access: go through support.
-
La Poste: mail redirection
Ask La Poste whether there is a redirection in your name or the company’s, and have it stopped.
Who: A post office, with proof of identity. The business customer area only lets you cancel a redirection, identity being checked by post or in an office.
Get ready: The Kbis, the police report, your contract number if you know it.
-
Warn your factoring companies
If you use factoring, warn the institutions that contact you, with the police report attached.
Who: Each factoring company. The register of financial agents (REGAFI) lets you check that an institution is approved.
To be adapted with your lawyer.
-
Declare the claim to your insurer
If you have cyber or legal protection insurance, declare the claim without delay.
Who: Your insurer or broker.
The declaration period depends on your contract: reread it.
-
Warn your customers and suppliers
Ask them to disregard any change of bank details or contact unless they have called you back on a number they already knew.
Who: Your customers and suppliers, by a means the fraudster does not control.
Prepare the message and the list of your third parties (sign-in required)
What TierSafe does not do
- contact an organisation for you;
- qualify the fraud or give legal advice;
- cancel a filing at the register or promise a block;
- keep your documents;
- follow the progress of your steps with the organisations.
Links and texts checked on 30/10/2026. A link that no longer opens: write to us.
TierSafe Sentinelle e-mails you, the day we detect it, a filing at the register or a change of director on your company, free of charge.
Discover Sentinelle