Fake documents posted anonymously on websites Mixtape and 4Chan on May 3 purport that French presidential candidate Emmanuel Macron had set up a company in Nevis and maintained a bank account in the Cayman Islands.

After the two documents appeared on an image-based bulletin board that allows anyone to post comments and share images anonymously, they were shared widely over the internet.

The documents were meant to suggest that Macron had created the company for purposes of tax evasion, news reports stated.

The fake documents included a so-called “operating agreement” for La Providence LLC, a limited liability company purportedly set up by Mr. Macron and bearing his signature. La Providence is the name of Mr. Macron’s high school in his hometown of Amiens.

The anonymous user also posted the image of a crudely manipulated fax addressed to the Nevis company with a letterhead and address of CIBC FirstCaribbean in the Cayman Islands. The fax mentions the return of a check, ostensibly to suggest a relationship between the company and the bank.

A spokesperson for CIBC FirstCaribbean said in a statement emailed to the Cayman Compass: “We have examined the image of the fax cover document purporting to come from CIBC FirstCaribbean. We can confirm that it did not originate from CIBC FirstCaribbean and it is not a bank document.”

Nevertheless, allegations of secret offshore accounts held by Mr. Macron made it into the final election debate later that day, May 3. Marine Le Pen, the Front National candidate for the French presidency, told her political opponent: “Pay attention to what you say, Mr. Macron. I hope we will not learn that you had an offshore account in the Bahamas.”

Mr. Macron retorted: “This is slander.” The following day he filed a complaint against unknown persons for spreading false information and attempting to manipulate the election. Prosecutors confirmed they had opened an investigation in response to Mr. Macron’s complaint.

A statement from Mr. Macron’s En Marche! Campaign on May 4 said, “Here is how a fake news makes its way in a few hours to the heart of the French presidential campaign.”

Speaking on French radio on May 4, the centrist candidate said the information was “fake news and lies” from “sites, some of which were linked to Russian interests.”

A cyberattack on French TV station TV5 two years ago that took the channel off air and nearly destroyed the network was later ascribed to hackers linked to the Russian government.

In April, cybersecurity firm Trend Micro reported it had found evidence that the same hacking group, called Fancy Bear or APT28, created at least four different domains with addresses very similar to the name of Mr. Macron’s party and its official website for phishing attacks designed to obtain private email and website passwords.

There are indications that the fake documents originated from California.

The Associated Press reported that some of the language in the “operating agreement” comes from a guide to forming limited liability companies in California. The Macron campaign noted that the Twitter account of a far-right activist and felon based in northern California mentioned the documents first.

If you value our service, if you have turned to us in the past few days or weeks for verified, factual updates, if you have watched our live streaming of press conferences or sent an article to a friend... please consider a donation. Quality local journalism was at risk before the coronavirus crisis. It is now deeply threatened. Even a small amount can go a long way to sustaining our mission of informing the public. We need our readers’ financial support now more than ever.