Authorised Fraudulent Transfer: Bank Liable Despite the Time Bar (Toulouse Court of Appeal, 2nd Ch., 12 May 2026, No. 23/02325)

Toulouse Court of Appeal, 2^nd Chamber, 12 May 2026, No. 23/02325

What happened in this case?

The story has, sadly, become commonplace in law firms specialising in banking law. An 80-year-old woman, a Crédit Mutuel customer since 2014, is approached with an investment presented as exceptional: an investment in diamonds. Convinced, she goes to the branch on 16 August 2017 to order a first transfer of €40,000 to a company established in Great Britain. A month later, on 19 September 2017, she repeats the operation, this time for €83,000, to the same company. In four weeks, €123,000 leaves her accounts.

It was a scam. The customer filed a criminal complaint on 5 February 2018. Considering that her bank had breached its duty of vigilance by letting these orders go through without reacting, she sent it a formal notice in April 2020 to reimburse the sums transferred, then summoned it, together with the branch (caisse) through which the transfers were physically made, before the Toulouse Court of First Instance (tribunal judiciaire) in autumn 2020.

On 20 April 2023, the Court of First Instance ordered both Crédit Mutuel branches, jointly and severally (in solidum), to pay €49,200 in damages for breach of the duty of vigilance and of the duty to warn (devoir de mise en garde). The banks appealed. In the meantime, the customer died; her two heirs took over the proceedings. It is in this context that the Toulouse Court of Appeal delivered its judgment of 12 May 2026.

Why did the 13-month time bar not apply?

The banks’ first defensive reflex: invoking the time bar (forclusion). One of the branches argued that the customer’s claim was inadmissible, as she had not contested the operations within the thirteen-month period provided for by Article L133-24 of the Monetary and Financial Code. Had this argument succeeded, it would have closed the door to compensation outright.

The Court of Appeal nonetheless rejects the argument, and this is one of the most useful contributions of the judgment. The reasoning rests on a decisive distinction: this time bar applies only to unauthorised or incorrectly executed operations. Here, however, the customer herself had given the transfer orders. The operations were therefore perfectly authorised, which no one disputed, not even the heirs.

What is the difference between the Monetary and Financial Code regime and ordinary law?

The whole issue turns on the choice of the applicable liability regime. The court recalls the now well-established position of the French Supreme Court (Cour de cassation) (Com. 15 January 2025, No. 23-15.437): where the bank’s liability is sought in respect of an unauthorised or incorrectly executed operation, only the specific regime of Articles L133-18 to L133-24 of the Monetary and Financial Code applies, which transposes Directive (EU) 2015/2366 of 25 November 2015 (known as “PSD2”), to the exclusion of any other legal basis. And this regime imposes the famous thirteen-month period.

But, the court reasons, a contrario, where the operations were authorised, this specific regime is not intended to apply. The bank’s liability is then governed by the ordinary law of contractual liability (Articles 1103, 1104 and 1231-1 of the Civil Code), which knows no thirteen-month time bar. The heirs’ claim was therefore perfectly admissible.

The practical significance is considerable. In so-called “manipulation” scams, where the victim is deceived into giving the payment order herself (fake bank adviser, fake investment, CEO fraud, “romance scams”…), the bank cannot hide behind the thirteen-month period of the Monetary and Financial Code. The victim has the much longer ordinary-law period in which to sue for breach of the duty of vigilance.

Should the bank have reacted to these transfers?

Once admissibility was established, the real question on the merits remained: did the banks commit a fault by executing these transfers without demur? To answer it, the court combines two principles that may seem contradictory: the duty of non-interference on the one hand, the obligation of vigilance on the other.

What is the duty of non-interference?

The bank relied precisely on this principle: “it is not for me to judge the advisability of my customer’s transfers”. A correct argument… but an incomplete one. For the court immediately recalls the limit: this duty of non-interference gives way in the presence of an apparent anomaly. It is then the general obligation of vigilance, based on the ordinary law of liability, that takes over and requires the bank to carry out additional checks, or even, in very specific cases, to refuse its assistance.

What is an apparent intellectual anomaly?

Here, no material anomaly was alleged. The whole discussion therefore concerned the existence of an intellectual anomaly. The court carries out a careful, almost pedagogical analysis of the customer’s banking behaviour. It notes that:

The most instructive point lies in the bundle of indicators (faisceau d’indices) reasoning. The banks argued that, taken in isolation, none of these elements was enough to alert them. The court agrees on the premise… but turns the argument around: “it is indeed the combination of all these elements that constitutes the apparent intellectual anomaly“. In other words, it is not age alone, nor the amount alone, nor the destination alone, but their conjunction that made the anomaly “obvious”. The court also notes that a three-year look-back from the opening of the account was enough to gauge how unusual these operations were.

Could the banks’ oral warning have saved them?

The banks claimed to have given their customer an oral warning at the counter. This is a double-edged argument, and the court demonstrates it with remarkable economy.

First, the banks provided no evidence that this warning was actually given, yet it is for the party relying on a fact to prove it. Second, and above all, the court adopts the first judge’s observation: relying on an oral warning “tends to show that they were aware of the intellectual anomaly affecting these operations”. Put plainly: if the bank thought it useful to warn its customer, it had indeed perceived the abnormal nature of the operation, which revives its obligation of vigilance rather than relieving it of it. The defence argument turns into an admission.

Why did the customer recover only 20% of the sums?

It is here that the judgment, until then very favourable to victims, sets an essential limit. With the banks’ breach established, the amount of compensation still had to be determined. And the court, partially overturning the judgment, does not award the full sums lost.

The court’s reasoning is as follows: the banks’ breach did not directly cause the loss of the €123,000. That loss results first and foremost from the scam. The banking breach merely deprived the customer of the chance of abandoning the transfers had she been alerted as she should have been. The compensable loss is therefore not the sum dissipated, but the probability that such a warning would have made her abandon them.

To set this percentage, the court takes into account the customer’s great imprudence, as she had invested on the strength of internet advertisements without carrying out further checks. It notes that it is “not certain that a warning from the banks would have made her abandon” these investments. This imprudence is held to be, “to a significant extent, at the origin of the occurrence of the damage”. The result: the loss of chance is assessed at 20%, that is €24,600 (€123,000 × 20%), compared with €49,200 at first instance.

Is the reduction to 20% justified?

The principle of resorting to loss of chance is firmly anchored in case law in this type of dispute: it would be excessive to make the bank bear the whole of a loss whose primary cause remains the scam and the victim’s initial consent. On this point, the judgment is legally orthodox.

One may nevertheless question the proportion adopted. Setting the loss of chance at only 20% amounts to leaving 80% of the loss to be borne by an 80-year-old victim, even though the court, a few paragraphs earlier, described the anomaly as “obvious” and found that the banks “were aware of it”. There is a tension between the firmness of the finding of fault and the modesty of the compensation. The more strongly the glaring nature of the anomaly is asserted, the more paradoxical it becomes to consider that a warning would have had little chance of altering the customer’s decision.

The reasoning on this point also remains rather elliptical: the court deduces the low rate from the uncertainty that a warning “would have made her abandon” the investment, without really measuring the effect that a specific warning might have had, for example an outright refusal to execute, which case law accepts “in very specific cases” and which the court itself mentions. In comparable cases, one can therefore argue for a markedly higher proportion where the anomaly is described as obvious and the victim’s vulnerability (age, isolation, psychological pressure from the fraudster) is documented. Loss of chance is a sliding scale, not a guillotine: its proportion is negotiated case by case, with evidence to support it.

What options are open to victims of transfer scams?

Beyond the particular case, the judgment confirms a valuable toolbox for victims of “manipulation” fraud, where the victim personally gave the payment order under the influence of a fraudster.

A final word on a ground that is still under-exploited. Where the fraud passes through electronic channels, banks are also bound, under the regulatory technical standards (RTS) supplementing the PSD2 Directive, by precise standards of security and transaction monitoring (strong authentication, detection of abnormal patterns). Failure to comply with these technical obligations can also ground civil liability and is a complementary line of attack that is too rarely pleaded. On the other hand, and this is an important caveat, the banks’ failure to comply with their anti-money laundering obligations (AML/CFT) can no longer, following a recent judgment of the French Supreme Court (Cour de cassation), serve as the basis for a compensation claim: the sole purpose of those obligations is the general interest, not the protection of the customer’s assets. Filing a criminal complaint remains useful for evidence and recovery, but it is not, either, a civil basis for compensation.

Conclusion

The Toulouse Court of Appeal’s judgment of 12 May 2026 is, in the main, good news for victims. It establishes two major gains: first, for an authorised operation, the victim escapes the thirteen-month time bar and can sue under ordinary law; second, the duty of vigilance requires the bank to react to an intellectual anomaly revealed by a bundle of indicators, without being able to retreat behind its non-interference or an unverifiable oral warning.

But the judgment also recalls the fragility of the last mile: loss of chance. By setting the proportion at 20%, the court leaves 80% of the loss to be borne by the victim, at the price of reasoning that can be judged weaker than the firmness of its finding of fault. The lesson for those defending victims of banking fraud is clear: the battle over liability in principle is now largely winnable; the battle over quantum remains wide open and is prepared from the summons onwards, through a careful demonstration of the obviousness of the anomaly and of the victim’s vulnerability.

Are you the victim of a transfer scam, and did your bank let manifestly abnormal operations go through? The firm LE BOT Avocat, dedicated to banking law, can analyse your case and assess your chances of obtaining redress.

FAQ: Frequently Asked Questions