Apple Pay Fraud: The Bank Must Prove the Authentication of Each Payment (CA Rennes, 2nd ch., 26 May 2026, No. 24/00410)

Rennes Court of Appeal, 2^nd chamber, 26 May 2026, No. RG 24/00410 (upholding TJ Nantes, 28 November 2023, No. RG 22/03255)

What happened in this case?

The case heard by the Rennes Court of Appeal illustrates a now very widespread fraud pattern: the hijacking of a bank card by means of a mobile payment wallet. The customer of an online bank, BforBank, holds a bank account denominated in Swiss francs (CHF). In January 2022, she falls victim to a series of fraudulent manoeuvres: her bank card is enrolled, without her knowledge, in the Apple Pay service installed on a phone other than her own. This enrolment, which took place on 9 January 2022, could only be completed after a confirmation sent by SMS.

In the following days, eleven fraudulent transactions go through on the account, for a total of €6,667.56. On 12 January 2022 at 9:27 pm, the customer blocks her card: she reacts immediately after receiving an SMS from her bank informing her that one of the transactions had been carried out. She then reports the fraudulent debits to the national gendarmerie on 14 and 18 January 2022.

The bank, asked to compensate her, refuses by two emails (8 February and 27 May 2022). The customer then sues it before the Court of First Instance of Nantes (tribunal judiciaire de Nantes), which finds in her favour on 28 November 2023 and orders BforBank to return the sums debited. The bank appeals. In the judgment discussed here, the Rennes Court of Appeal upholds the first-instance judgment in full and even increases the bank’s liability for procedural costs.

Who must prove the fraud: the customer or the bank?

This is the heart of payment fraud litigation, and the source of most misunderstandings with banks. Many victims think it is up to them to show that they did not carry out the disputed transactions. It is the opposite. When a customer denies having authorised a transaction, the burden of proof rests on the bank, described as the “payment service provider”.

What do Articles L. 133-18 to L. 133-23 of the Monetary and Financial Code say?

The Court of Appeal bases its reasoning on the combination of Articles L. 133-18, L. 133-19, L. 133-16 and L. 133-23 of the Monetary and Financial Code. These provisions, which transpose into French law the second European Payment Services Directive (PSD2), establish a regime that is highly protective of the user.

The principle is set out in Article L. 133-18: in the event of an unauthorised payment transaction reported by the user, the bank must reimburse the amount of the transaction immediately and restore the account to the state it would have been in. Article L. 133-23 then specifies the mechanics of proof: where the user denies having authorised a transaction, “it is for the payment service provider to prove that the transaction in question was authenticated, duly recorded and accounted for and that it was not affected by a technical or other deficiency”.

Above all, the same article adds an essential clarification, which the Rennes court repeats word for word: the mere use of the payment instrument or of the personalised security data is not, in itself, sufficient to establish either that the payer authorised the transaction, or that the payer was at fault, or even grossly negligent within the meaning of Articles L. 133-16 and L. 133-17. In other words: the fact that the right card, the right code or the right phone was used proves nothing, in itself, as to the customer’s consent or fault.

Does enrolling a card in Apple Pay authorise all payments?

This was the bank’s central argument, and the Court of Appeal rejected it clearly. BforBank argued that the disputed payments had been made via the Apple Pay application, after the customer had activated the service using her phone number and a one-time code. For the bank, this initial validation, which took place on 9 January 2022, was enough to guarantee the security of all subsequent payments: strong authentication was, in its view, “ensured ab initio“, at the time the service was activated, relieving the bank of the need to require it again for each transaction.

The Court of Appeal answers unambiguously: “in light of the above-mentioned provisions, strong authentication means authentication of each of the transactions in question and not the validation of a means of payment”. The bank therefore relies in vain on the fact that the customer validated her registration for the payment service on 9 January in order to establish the authentication of each of the transactions carried out in the following days.

Why must strong authentication apply to each transaction?

The distinction drawn by the court is both technical and a matter of common sense. Enrolling a card in a mobile wallet (Apple Pay, Google Pay, Samsung Pay…) and making a payment are two distinct acts. Enrolment consists in associating a card number with a device; a payment, for its part, is the order to transfer a specific sum to a specific beneficiary. To accept that the single validation of the enrolment covers all future payments would empty the strong authentication requirement of all substance: a fraudster would only need to succeed, once, in getting the card enrolled on his own phone in order to then have a blank cheque over the account.

This is exactly what happened here. The court notes that “the fact that [the customer] was able, following the fraudulent manoeuvres of which she was the victim, to allow the activation of the payment service on a third-party phone in no way relieved the bank of the duty to ensure the authentication of each of the transactions carried out by means of that payment instrument”. The bank remains bound to ensure the authenticity of each transaction, as with any other means of payment used by its customers.

Can the bank invoke the customer’s “gross negligence”?

This is the other major defence of banks: even in the event of fraud, the user bears the losses if he or she committed gross negligence in safeguarding their security data (Article L. 133-19, IV, of the Monetary and Financial Code). BforBank thus criticised its customer for having disclosed her codes and her card number to the fraudsters.

The contribution of the judgment here is decisive in terms of method. The Court of Appeal recalls that there is a logical order of proof: before it can even discuss any gross negligence on the part of the customer, the bank must first prove that the transactions were authenticated, duly recorded, accounted for and not affected by a technical deficiency. Yet BforBank alleges no technical failure and does not demonstrate the authentication of each transaction. As the proof “required before any invocation of gross negligence” has not been provided, the question of negligence cannot even be examined: the bank must reimburse.

This reasoning is valuable for victims. It means that the bank cannot simply point to the customer’s behaviour to escape its obligation. It must first clear the evidential hurdle of transaction-by-transaction authentication. Until that hurdle is cleared, there is no room for a debate on negligence.

Is it necessary to file a complaint to be compensated?

Many victims fear that the absence of a criminal complaint, or a late one, will be held against them by the bank. The Rennes court provides a reassuring answer. It notes that the customer was able to block the use of her means of payment as soon as she received, on 12 January 2022, an SMS from her bank informing her that a fraudulent transaction had been carried out. This responsiveness establishes that she was “diligent in her steps to prevent the fraud from continuing, without it being necessary for [the customer] to show that she filed a complaint“.

Filing a complaint remains useful in practice (for the needs of the investigation, for the receipt, or for any recovery), but it is not a condition of the right to reimbursement. What matters is the victim’s diligence once the fraud has been detected, and above all the prompt blocking of the card.

What is the practical impact for victims of mobile payment fraud?

This judgment, although unpublished and delivered by a court of appeal, forms part of a firmly established line of case law protecting payment service users, in the wake of the French Supreme Court (Cour de cassation). It offers several concrete benefits for anyone disputing fraudulent transactions.

First, it neutralises an argument that banks raise more and more frequently: the idea that the use of a supposedly “secure” mobile wallet (Apple Pay, Google Pay) shifts the burden of risk onto the customer. The court recalls that the technology used changes nothing about the rules of evidence: strong authentication must be demonstrated transaction by transaction.

Second, it establishes a hierarchy of proof favourable to victims: gross negligence can be discussed only after the bank has proved the effective authentication of each debit. This framework can be applied directly to countless disputes: “spoofing” fraud (impersonation of the bank’s number), fake bank adviser scams, phishing, and card hijacking in a mobile wallet.

What other levers can be used against the bank?

Beyond the evidential regime of Articles L. 133-18 et seq., which is the main battleground, the victim can strengthen the case by questioning whether the bank complied with its own technical security obligations. The regulatory technical standards (RTS) adopted by the European Banking Authority to supplement PSD2 impose precise requirements on providers regarding strong authentication and transaction monitoring. Where a bank fails to detect a manifestly abnormal pattern of transactions (for example, the enrolment of a card on a new device immediately followed by a burst of unusual payments), its compliance with these standards can usefully be questioned. This is a lever still under-used by victims, and one that deserves to be examined systematically.

Reporting to the gendarmerie or filing a complaint, as well as any reporting steps taken by the bank, remain factually useful to the case and to the investigation, but they are not in themselves the basis of civil compensation: this rests above all on the regime for unauthorised payment transactions.

Conclusion

The Rennes Court of Appeal judgment of 26 May 2026 delivers a clear message: faced with mobile payment fraud, the user does not have to justify themselves; it is for the bank to prove. And that proof is not satisfied by an initial validation of the wallet: it must cover the strong authentication of each of the disputed transactions. Without such a demonstration, there is no room even for a debate on the customer’s gross negligence, and reimbursement is required (here, €6,667.56, plus procedural costs).

For the thousands of customers whose card has been hijacked via Apple Pay or another wallet, this decision is a solid support. If your bank refuses to reimburse you by invoking authentication “ensured at enrolment” or alleged negligence on your part, the firm LE BOT Avocat, dedicated to banking law, can analyse your case and take on your bank in the battle over proof on the basis of Articles L. 133-18 et seq. of the Monetary and Financial Code.

FAQ: Frequently Asked Questions