Bank Card Fraud “With the PIN”: Why the Bank Must Prove Much More (and Often Reimburse)

“My PIN was used”: can the bank really refuse to reimburse?

The answer fits in one sentence: no, not on that basis alone. The starting point of any dispute over an unauthorised transaction is Article L. 133-23 of the Monetary and Financial Code. Its logic is clear: once the customer denies having authorised a transaction, it is not for them to prove that they did nothing; it is for the bank to prove that they authorised it, or that they seriously breached their obligations.

The text deserves to be read word for word, because it anticipates precisely the banks’ argument:

Everything lies in the emphasised sentence. The legislator expressly provided that the mere fact that the bank has recorded in its systems the use of the card and the entry of the PIN is not enough to establish authorisation. The bank’s internal log is not revealed truth: it is an item of evidence, subject to the judge’s assessment, and which can be contradicted.

The rest of the scheme follows logically. Article L. 133-18 requires the bank, when an unauthorised transaction is reported to it in time, to reimburse the debited amount immediately and to restore the account to the state in which it would have been had the transaction not taken place. The bank can escape this obligation only by producing proof (which it always bears) either of authorisation or, to rule out reimbursement, of gross negligence or fraud by the holder (Art. L. 133-19, IV).

Two provisions of Article L. 133-19, often overlooked, target precisely technical fraud scenarios. First, paragraph II: the payer’s liability is not engaged where the transaction was carried out by misappropriating the payment instrument or its related data without the payer’s knowledge, nor in the event of counterfeiting of the instrument if the payer was, at the time of the transaction, in possession of their card. The legislator thus expressly contemplated cloning and data misappropriation, and placed the consequences on the bank, not on the victim. Second, paragraph V: save for fraud by the payer themselves, the payer bears no financial consequence if the transaction was carried out without the bank having required strong authentication (cross-reference to Article L. 133-44).

The French Supreme Court (Cour de cassation) ensures that these rules are not emptied of their meaning. In a judgment published in the Bulletin, the Commercial Chamber held that the bank’s proof of the customer’s fraud or gross negligence “cannot be inferred from the mere fact that the payment instrument or the personal data related to it were actually used” (Cass. com., 18 January 2017, No. 15-18.102). Delivered in respect of an online payment diverted by phishing, this judgment states a general rule, valid for any means of payment. In other words: “the PIN was entered” is not reasoning, it is begging the question.

Does the “Magic DAB” exist? Is the chip card tamper-proof?

Faced with a customer disputing a withdrawal or a payment, some defenders of the banks put forward an argument that has become a genuine courtroom slogan: the “Magic DAB” (that is, a device that would make it possible to withdraw or pay without the real card and its PIN) does not exist. From this premise, they draw a radical conclusion: the chip card would be tamper-proof, so, once a transaction has gone through “with the PIN”, it is necessarily the victim who was at fault: PIN written down somewhere, card poorly looked after, even complicity.

This reasoning rests entirely on a technical assumption: the tamper-proof nature of the card. Yet this assumption is false. It is false legally, since the law precisely refuses to make use of the PIN proof of authorisation. It is above all false technically, as an abundant and convergent body of scientific literature has demonstrated since 2010.

How can a card be used without the real PIN?

The bank’s assumption (“if the terminal indicates that the PIN was verified, the cardholder entered it”) has been contradicted by research since 2010. The weak link is not the secrecy of the PIN itself; it is the fact that, in several documented and tested scenarios, the terminal records a cardholder verification that never actually took place. Let us review the main pieces of work.

2010: can a wrong PIN be made to pass? (the “no-PIN” attack)

As early as 2010, the team of Steven J. Murdoch and Ross Anderson (University of Cambridge), in a paper with an eloquent title, “Chip and PIN is Broken”, presented at the IEEE Security & Privacy conference, described a man-in-the-middle attack. A small device inserted between the card and the terminal intercepts the PIN verification request and itself replies to the terminal that the PIN is “correct”, without ever needing to know it. The underlying flaw: the card’s response to the PIN verification request is not authenticated. The terminal, and therefore the bank’s log, then records a “PIN” transaction for a stolen card whose thief knows nothing of the PIN. This attack is credited with a fraud of about €600,000 committed in France and Belgium in 2010-2011.

2012: can a cloning be invisible in the statements? (the “pre-play” attack)

In 2012, the same team (Bond, Choudary, Murdoch, Skorobogatov, Anderson), in “Chip and Skim: cloning EMV cards with the pre-play attack”, uncovered a still more insidious weakness. The security of each transaction rests on an “unpredictable number” supposed to guarantee its freshness, that is, to prevent a captured card response from being replayed later. Yet many cash machines and terminals generated this number with simple counters or timestamps, and it was therefore perfectly predictable. A fraudster having the card for a moment (for example in a complicit shop) can then precompute the authorisation codes for a future transaction.

The consequence is decisive in evidentiary terms: the attack is indistinguishable from a cloning from the standpoint of the logs available to the issuing bank. The researchers explicitly link their discovery to cases in which victims were refused any reimbursement on the ground that “an EMV card cannot be cloned”, an argument that their work destroys. They also note a point that every practitioner encounters: some banks refuse to produce transaction logs, or even erase them during the dispute, leaving the customer to argue on generalities.

2020-2021: does contactless make the PIN useless?

The most resounding work is that of David Basin, Ralf Sasse and Jorge Toro-Pozo (ETH Zurich). In “The EMV Standard: Break, Fix, Verify” (IEEE Security & Privacy, 2021), they formalise the entire EMV protocol using an automatic verification tool and demonstrate that, in Visa contactless, the cardholder verification method is neither authenticated nor protected against modification. Their Android application, acting as a man-in-the-middle, makes the terminal believe that “cardholder verification was performed on the device” (a phone), so that no PIN is requested, including above the limit that should require it. The authors validated the attack on real in-store terminals, for example for a payment of about 190 dollars. Their conclusion is blunt: “the PIN is useless in Visa contactless transactions”.

The same team extended the attack to Mastercard in “Card Brand Mixup Attack” (USENIX Security, 2021): by making a Mastercard card pass, from the terminal’s standpoint, for a Visa card, they bypass the PIN even on cards previously thought to be protected, with a transaction of over 400 dollars on a Maestro debit card. They built on these results in 2023 (“Inducing Authentication Failures to Bypass Credit Card PINs”, USENIX Security).

Isolated cases or a structural problem?

These results are not laboratory curiosities. They form part of more than fifteen years of consistent publications, from the best computer security conferences in the world and subjected to peer review. This convergence is, in itself, probative. Examples include:

• Murdoch, Drimer, Anderson, Bond, “Chip and PIN is Broken” (IEEE S&P 2010): the founding demonstration of the “no-PIN” attack.
• Emms, Arief, Freitas, Hannon, van Moorsel (Newcastle University), “Harvesting High Value Foreign Currency Transactions from EMV Contactless Credit Cards Without the PIN” (ACM CCS 2014): contactless payments in foreign currencies achievable above the limit, without a PIN.
• Chothia, Garcia, de Ruiter et al. (University of Birmingham), “Relay Cost Bounding for Contactless EMV Payments” (Financial Cryptography 2015): the analysis of relay attacks, where the terminal talks remotely to a card that is not present.
• Galloway and Yunusov (Positive Technologies), “First Contact: New Vulnerabilities in Contactless Payments” (Black Hat Europe 2019): the bypass of the contactless limit validated on the Visa cards of five major banks.
• “SoK: Security of EMV Contactless Payment Systems” (University of Warwick, 2024) and “SoK: Attacks on Modern Card Payments” (2025): two recent syntheses that catalogue and replay these attacks.

The 2025 synthesis changes the very nature of the debate. Rather than describing yet another flaw, it proposes a systematic framework of analysis of modern card payment (chip and contactless, including mobile payment): it defines the security properties that the system is supposed to guarantee and the realistic attacker models, then catalogues and classifies all the design flaws of the protocol. Its decisive contribution is to show that these flaws are not isolated accidents: they combine. Different subsets of flaws, assembled, produce new attacks, which explains why, in fifteen years, piecemeal fixes have never dried up the flow of vulnerabilities. The authors also focus on the root causes of this accumulation: the complexity of the standard, the multiplicity of variants and backward compatibility, which sustain lasting blind spots.

For the lawyer, the lesson is twofold. On the one hand, the structural and persistent nature of these weaknesses rules out treating fraud “with PIN” as a marginal or theoretical hypothesis: it is a documented, current risk on the cards and terminals in circulation, even though contactless now accounts for most card payments. On the other hand, the fact that the attacks result from combinations of flaws makes all the more illusory the idea that a simple “card + PIN” log would suffice to establish authorisation by the holder.

What do strong customer authentication (SCA) and the RTS require of the bank?

Since the second Payment Services Directive (PSD2), transposed in Article L. 133-44 of the Monetary and Financial Code, the bank must apply strong customer authentication. This obligation is not a marketing slogan: it has a precise technical content, and failure to comply has direct civil consequences.

The Code itself restates the central requirement: for remote electronic payments, strong authentication must include elements establishing a dynamic link between the transaction, the amount and the payee (Art. L. 133-44, II). The concrete technical content of this obligation is set by a European regulatory standard, the RTS.

Three requirements of the RTS bear directly on the evidentiary debate. First, two independent factors (Art. 4): the mere fact that a “PIN” appears in the logs says nothing about the reality of this two-factor requirement. Second, the dynamic link (Art. 5): the authentication code must be cryptographically linked to the exact amount and the specific payee, with any modification having to invalidate it. This is exactly the point that the ETH Zurich attacks defeat, the cardholder verification method not being protected against modification. Finally, the independence of the elements (Art. 9): the compromise of one factor must not compromise the others, whereas the above-mentioned work shows attack chains where mastery of a single link is enough to get the transaction accepted.

The legal consequence is clear. Asserting that “the transaction was authenticated” is not enough: the bank must also prove that the authentication implemented genuinely satisfied the requirements of the RTS. Where strong authentication was required and the bank does not demonstrate that it applied it correctly, the payer who has not acted fraudulently should, in principle, bear no loss (Art. L. 133-19, V). The RTS thus gives verifiable content to the burden of proof under Article L. 133-23: it transforms the question “did the bank authenticate?” into a grid of technical criteria that the transaction log, on its own, does not provide.

What should be concluded in legal terms?

What is drawn from this work is not that “cards do not work”. What is drawn from it is something precise and legally decisive: the “PIN verified” entry in the bank’s systems is a declaratory datum, produced by the terminal, and not proof that the holder entered their PIN. Three consequences follow.

1. Authenticating is not authorising. That a transaction is technically “authenticated” within the meaning of the logs says nothing about its authorisation by the payer. This is exactly the distinction drawn by Article L. 133-23. Research shows that there are paths by which authentication is obtained without the consent, or even the presence, of the holder.

2. The bank’s log is self-serving evidence, and therefore open to challenge. It is constituted by the party relying on it. The pre-play and man-in-the-middle attacks demonstrate that it can indicate “card + PIN” in cases of pure fraud. The judge therefore cannot rest content with it to hold authorisation, or gross negligence, as established.

3. Gross negligence must be proved concretely. Since the use of the PIN may result from an attack, setting it against the customer as proof of their negligence amounts to reversing the burden that the law places on the bank. The bank must put forward elements specific to the case (circumstances, the customer’s actual behaviour) and not a deduction drawn from the supposed operation of the card.

What to do in practice when faced with a refusal to reimburse?

Faced with a refusal based on the “use of the PIN”, several reflexes are called for. Report the transaction without delay as soon as it is discovered (Art. L. 133-17), then send a written dispute to the bank. The statutory time limit for disputing is thirteen months from the debit (Art. L. 133-24); shorter periods that the bank sometimes inserts in its general terms and conditions cannot defeat this right.

You should then demand in writing the communication of the technical logs of the transaction: the cardholder verification method actually recorded, strong authentication data, timestamps and the so-called unpredictable number. These are precisely the documents that the researchers invite victims to request, and their absence or inconsistency tells against the bank, on which the burden of proof lies. On the terrain of liability, beyond the unauthorised transaction itself, the bank’s obligations under the RTS (strong authentication, transaction monitoring, detection of anomalies) are a lever that is still underused where they have not been complied with.

Finally, one should never accept as inevitable the claim that “a chip card cannot be misused without the PIN”. It is legally false with regard to the burden of proof, and technically false with regard to the state of the art.

Conclusion

The strength of a file on a disputed banking transaction lies in the alliance of two registers: the text (Articles L. 133-18 to L. 133-24 and L. 133-44, and the case law that refuses to infer gross negligence from the mere use of the device) and the state of research, which deprives the banks’ argument of its implicit premise. “The PIN was used” does not answer the only question that matters: can the bank prove that the holder authorised the transaction? As long as it does not, reimbursement is due. The firm LE BOT Avocat assists cardholders and account holders in disputing unauthorised transactions and refusals to reimburse: if a bank sets against you a transaction “carried out with your PIN”, that reasoning alone is not enough, and it can be challenged.

FAQ: Frequently Asked Questions