Bank Fraud: A Bank Cannot Rely on Its SECUR’PASS System Without Proof (TJ Rodez, 12 February 2026, No. 24/01535)

Court of First Instance of Rodez (tribunal judiciaire), contentious matters, 12 February 2026, No. 24/01535

The Factual Background: When the Customer’s Vigilance Meets the Bank’s Inertia

The case decided by the Court of First Instance of Rodez on 12 February 2026 illustrates a scenario that is unfortunately common in today’s banking landscape. Ms [C] [P], the holder of a current account with CAISSE D’EPARGNE ET DE PREVOYANCE MIDI PYRENEES, discovered on 21 October 2023 that fraudulent cash withdrawals had been made on her account without her knowledge. More worryingly still, she found that she could no longer access her online banking area, as her access code no longer worked.

Faced with this situation, the customer showed exemplary responsiveness. On 24 October 2023, three days after discovering the facts, she contacted her bank to ask for the transactions on her account to be blocked immediately. This diligence nonetheless proved insufficient: further fraudulent transactions were carried out on 31 October 2023, showing that the bank had not acted on her request to secure the account.

On 6 November 2023, Ms [P] sent Caisse d’Épargne a registered letter with acknowledgement of receipt formally requiring the bank to refund the sums wrongly debited. Faced with the bank’s silence, the customer had no choice but to go to court. On 23 October 2024, almost a year after the events, she brought proceedings against the bank before the Court of First Instance (tribunal judiciaire).

What is striking in this case is Caisse d’Épargne’s particularly offhand attitude. Not only did the bank fail to act on its customer’s urgent request to block transactions on her account, thereby allowing further frauds to take place, but it also refused any refund. Worse still, the bank charged its customer overdraft interest (agios) and terminated her overdraft facility, adding insult to injury.

This chronology highlights two worrying realities: first, the vulnerability of customers in the face of increasingly sophisticated bank fraud; second, the reluctance of certain banks to take full responsibility for payment security, preferring to blame their customers rather than rigorously examine their own protection mechanisms.

The Legal Framework Applicable to Unauthorised Payment Transactions

Disputes over unauthorised payment transactions fall within a precise and protective legal framework, codified in Articles L. 133-16 et seq. of the Monetary and Financial Code (code monétaire et financier). This regime strikes a balance between the customer’s obligations as regards the security of their means of payment and the liability of the payment service provider, that is, the bank.

The Principle of Immediate Refund by the Payment Service Provider

Article L. 133-18 of the Monetary and Financial Code lays down a fundamental principle: where an unauthorised payment transaction is reported by the customer, the bank must immediately refund the amount concerned. The refund must be made “at the latest by the end of the following business day” after the bank has become aware of the fraudulent transaction or has been informed of it by the customer.

This obligation of prompt refund is the cornerstone of the system protecting users of payment services. It rests on a simple premise: a customer who disputes a transaction should not bear the financial consequences of a fraud of which they are not the author while the investigation is under way. It is for the bank, a professional with the necessary technical means and skills, to bear the risk temporarily, even if it may later turn against the customer should it manage to demonstrate the customer’s liability.

The law does, however, provide for a notable exception to this principle of immediate refund: the bank may defer the refund if it has “good reasons to suspect fraud” on the part of the customer. But this exception is strictly circumscribed: the bank must notify its reasons in writing to the Banque de France. Vague suspicions or a mere assertion by the bank are therefore not enough to escape the obligation to refund.

The Burden of Proof: A Protective Reversal in Favour of the Consumer

Article L. 133-23 of the Monetary and Financial Code brings about a decisive reversal of the burden of proof. When a customer disputes a payment transaction, it is not for them to prove that they were not its author, which would often be impossible in practice. On the contrary, it is for the bank to demonstrate three cumulative elements:

First, that the transaction was “authenticated, duly recorded and accounted for”. In other words, the bank must prove that its IT systems correctly recorded the transaction and that the authentication procedures were followed. It is not enough to assert that “the system works”; this must be demonstrated concretely for the disputed transaction.

Second, that the transaction “was not affected by a technical or other deficiency”. This requirement is particularly onerous for banks. It forces them to prove that there is no flaw in their security mechanisms, which presupposes precise traceability and rigorous technical documentation. In practice, banks often struggle to provide this proof, in particular where sophisticated hacking exploits vulnerabilities that were unknown at the time of the events.

Third, that the customer “acted fraudulently” or “failed, intentionally or through gross negligence,” to meet their security obligations. The law expressly states that “the use of the payment instrument as recorded by the payment service provider is not necessarily sufficient in itself to prove” that the customer authorised the transaction or was negligent. In other words, the mere fact that the confidential code was used or that the transaction passed through the bank’s security systems proves nothing in itself.

This reversal of the burden of proof is a major step forward for consumers. It rests on a simple logic: the bank is a professional, with the technical means, the expertise and the data needed to understand how a fraud may have occurred. The customer, for their part, is generally ill-equipped in the face of the complexity of banking IT systems. It would therefore be unfair, and often impossible, to ask them to prove that they did not authorise the transaction or that the bank was at fault.

Cases of Customer Liability: Fraud and Gross Negligence

While the legal regime is broadly protective of the consumer, it does not relieve them of all responsibility. Article L. 133-19 of the Monetary and Financial Code distinguishes several situations in which the customer’s liability may be engaged, to varying degrees.

In the event of loss or theft of the payment instrument, the customer bears the losses up to a ceiling of 50 euros, and only for transactions made before they informed the bank of the loss or theft. Beyond this symbolic sum, the risk is borne by the bank. This 50-euro ceiling does not, however, apply in several situations: where the fraudulent transaction was made without the use of the personalised security data (the confidential code, for example), in the event of a loss or theft that the customer could not detect before the payment, or where the loss is due to the acts or omissions of a bank employee.

In the event of misappropriation or counterfeiting, the customer is not liable if the payment instrument or the data linked to it were misappropriated without their knowledge. Likewise, the customer’s liability is not engaged in the event of counterfeiting of the payment instrument, provided that they were in possession of their instrument at the time of the fraudulent transaction. These protective provisions address the increasingly frequent situations in which fraudsters manage to reproduce a bank card or capture the customer’s credentials without the customer noticing.

Fraudulent conduct by the customer is obviously a case of total liability. If the customer themselves organised the fraud in an attempt to obtain an undue refund from their bank, they bear all of the losses. But the bank must prove this fraudulent conduct, which generally requires concordant evidence: inconsistencies in the customer’s statements, a beneficiary of the funds linked to the customer, the absence of a criminal complaint, and so on.

Gross negligence is the hardest case to assess. Under Article L. 133-19, IV, the customer bears all the losses if they “failed, intentionally or through gross negligence,” to meet their security obligations as defined in Articles L. 133-16 and L. 133-17. These obligations relate essentially to preserving the security of the personalised security data (confidential codes, credentials) and to reporting without delay any loss, theft or fraudulent use of the payment instrument.

The notion of “gross negligence” must be interpreted restrictively. It is not a mere lapse of prudence or an isolated lack of vigilance, but conduct that shows a particularly serious carelessness in protecting one’s means of payment. Case law generally considers that there is gross negligence where the customer has, for example, voluntarily disclosed their confidential code to a third party, or has written the code down on a medium kept with the bank card.

In practice, the courts are particularly demanding of banks when it comes to proving gross negligence. Judges consider that a customer who falls victim to a sophisticated hacking technique does not necessarily commit gross negligence, even if they clicked on a fraudulent link or entered their credentials on a fake website. The growing sophistication of fraud techniques makes it increasingly difficult for a consumer, even a vigilant one, to detect every attempted scam.

The Time Limit for Challenging Transactions: Thirteen Months to Act

Article L. 133-24 of the Monetary and Financial Code imposes a time limit on the customer for disputing an unauthorised or incorrectly executed payment transaction: thirteen months from the date of the debit. This period is relatively long, which gives the customer time to detect a fraud even if they do not check their accounts daily.

Failure to comply with this time limit results in the claim being time-barred (forclusion), meaning that the customer can no longer obtain a refund of the disputed transaction. It is therefore a mandatory time limit of which the customer must be aware. However, the law provides for an important exception: if the bank has not provided or made available to the customer the information relating to the payment transaction in accordance with its regulatory obligations, time does not run and the customer may dispute the transaction beyond the thirteen months.

This thirteen-month period applies regardless of whether the transaction was made directly or through a third-party payment service provider (such as a payment initiation service). It covers both entirely unauthorised transactions and incorrectly executed ones (wrong amount, wrong beneficiary, etc.).

In summary, the legal framework applicable to unauthorised payment transactions rests on a delicate balance: on the one hand, the customer must be vigilant in using and protecting their means of payment; on the other, it is for the bank, a professional with technical expertise, to prove that its security systems did not fail and that the customer committed a clearly established fault. This protective regime reflects the legislature’s intention to guarantee confidence in dematerialised means of payment, while holding the players in the banking sector to account.

Analysis of the Rodez Court’s Decision

The decision handed down by the Court of First Instance of Rodez on 12 February 2026 offers an exemplary illustration of the practical application of the legal principles set out above. By ordering Caisse d’Épargne to refund in full the sums fraudulently debited, together with damages for abusive resistance and cash-flow loss, the court penalised the bank’s failure to discharge the burden of proof that lay upon it.

The Bank’s Failure in the Production of Evidence

The court begins by noting that “SA CAISSE D’EPARGNE ET DE PREVOYANCE MIDI-PYRENEES, on which the burden of proof lies, in no way proves either the absence of any deficiency in its secure authentication system, or the gross negligence of Ms [C] [P]”. This scathing finding highlights the total failure of the bank’s defence strategy.

Indeed, in accordance with Article L. 133-23 of the Monetary and Financial Code, the bank had to prove two cumulative elements: first, that the transaction had not been affected by a technical deficiency; second, that the customer had acted fraudulently or had been grossly negligent. On both points, Caisse d’Épargne proved to be lacking.

As regards the absence of a technical deficiency, the bank merely asserted that “the disputed transactions are not the result of a technical deficiency attributable to it”, without providing the slightest evidence in support of that assertion. The court rightly points out that the bank “relies solely on its SECUR’PASS mechanism” without proving that it worked properly in this particular case.

This evidential shortcoming is all the more serious because the chronology of events reveals obvious malfunctions in the management of the customer’s account. It should be recalled that Ms [P] asked, as early as 24 October 2023, for transactions on her account to be blocked after discovering fraudulent transactions. Despite this explicit request, further fraudulent transactions were carried out on 31 October 2023. This operational failure by the bank, which did not act on an urgent request to secure the account, is in itself a serious indication of negligence on the part of the bank in protecting its customer’s account.

The Insufficiency of the SECUR’PASS Mechanism

Caisse d’Épargne tried to shelter behind its SECUR’PASS strong authentication mechanism to argue that the transactions had necessarily been authorised by the account holder. This mechanism, which relies on sending a one-time code by SMS or via a mobile application, is now a standard security measure in the banking sector.

However, the court rightly observed that “the IT history of the transactions produced by CAISSE D’EPARGNE cannot serve as evidence, being illegible and in no way proving that SECUR’PASS was activated by Ms [C] [P]”. This observation is decisive: it is not enough for a bank to assert that its security system worked; it must demonstrate this in a way that is legible and comprehensible to a judge.

The production of incomprehensible IT histories or unexplained technical logs is not admissible evidence. The court expects the bank to be able to explain, clearly and in an accessible way, how authentication took place for each disputed transaction: at what time the SECUR’PASS code was generated, to which telephone number it was sent, from which IP address or which device the validation was carried out, and so on.

This requirement is not excessive. The bank holds all this data in its IT systems. If it is unable to reproduce it in an intelligible form in the context of a dispute, it is because it has not put in place the necessary traceability tools, which is precisely a failing in its security mechanism.

The court also recalls that the principle whereby “the sole proof of the use of the customer’s credentials cannot be enough to discharge the professional of all liability, and the conditions in which SECURIPASS was activated by a hacker constitute failings on the part of the bank justifying an order to refund the sums wrongly debited” is established in the present case.

The Absence of Proof of the Customer’s Gross Negligence

On the second limb of the burden of proof, the customer’s gross negligence, Caisse d’Épargne proved just as deficient. The bank merely pointed to the fact that Ms [P] “did not take note of the alert and warning messages sent every quarter to all CAISSE D’EPARGNE customers”.

The court dismissed this argument in short order, and rightly so. The mere fact that a bank periodically sends general prevention messages about fraud risks cannot constitute proof of gross negligence on the part of an individual customer. Gross negligence presupposes clearly faulty and personal conduct, and not mere ignorance of general security advice.

To establish gross negligence, the bank would have had to show, for example, that Ms [P] had voluntarily disclosed her confidential codes to a third party, that she had replied to a phishing email despite obvious signs of fraud, that she had lent her bank card, or any other manifestly imprudent conduct. The bank, however, produced no evidence of this kind.

On the contrary, the customer’s conduct appears exemplary: she quickly detected the fraudulent transactions, she immediately contacted her bank to ask for her account to be blocked, and she formalised her challenge by registered letter. This diligence shows that she was in no way negligent in monitoring her account or in reacting to the fraud.

The court also stresses that “there is likewise no proof that Ms [C] [P] disclosed her bank details or her personal codes relating to her current account and her bank card to a third party”. In other words, nothing suggests that the customer facilitated the fraud through her own conduct.

The Rodez Court’s decision thus aligns with a line of case law according to which the fact that confidential codes or credentials were used does not in itself prove that the customer disclosed them voluntarily or through negligence. Contemporary hacking techniques allow fraudsters to capture this data without any imprudence on the part of the victim.

The Orders Made Against the Bank

Having found Caisse d’Épargne to have failed on two counts, namely the absence of proof that there was no technical flaw and the absence of proof of the customer’s negligence, the court made a series of orders that deserve detailed analysis.

Refund of the Sums Fraudulently Debited

The court ordered Caisse d’Épargne to pay Ms [P] the sum of €5,580 by way of refund of the fraudulent transactions. This order follows directly from the application of Article L. 133-18 of the Monetary and Financial Code, which requires the bank to refund any unauthorised payment transaction immediately where it does not prove that the customer authorised it or was grossly negligent.

This amount of €5,580 corresponds to the fraudulent debits made on the customer’s account in October 2023. For a person on a modest income, as is often the case in this type of dispute, such a sum represents considerable financial harm. The fact that the bank refused for over a year to make the refund, forcing its customer to go to court, is all the more open to criticism.

It should be stressed that this refund was in principle due “at the latest by the end of the following business day” after the bank became aware of the fraudulent transaction or was informed of it by the customer. In this case, the customer had informed the bank as early as 24 October 2023 and had formalised her refund request by registered letter on 6 November 2023. The refund should therefore have been made at the latest in early November 2023. The bank thus breached its statutory obligation for more than fifteen months, until the judgment of February 2026.

The Order for Abusive Resistance

Beyond the simple refund of the fraudulent sums, the court ordered Caisse d’Épargne to pay €1,000 in damages for “abusive resistance”. This order carries significant symbolic and deterrent weight.

Abusive resistance characterises the conduct of a party who, even though it knows or ought to know that its position is legally indefensible, persists in refusing to meet its obligations, thereby forcing its opponent to bring lengthy and costly legal proceedings. This is precisely what the court criticised the bank for in this case.

The judgment stresses that “it is beyond dispute that SA CAISSE D’EPARGNE ET DE PREVOYANCE MIDI-PYRENEES never intended to refund the sums sought by Ms [C] [P] and tried by every means to escape its contractual obligation”. This scathing wording highlights the bank’s obstinacy in its strategy of systematic refusal.

The court also notes that “SA CAISSE D’EPARGNE ET DE PREVOYANCE MIDI-PYRENEES did not act on Ms [C] [P]’s request to block all transactions on her bank account, which led to further fraudulent transactions, something it could at the very least have acknowledged”. This passage is essential: not only did the bank fail in its obligations to secure the account, but it then refused to acknowledge that failing and its consequences, preferring to maintain a position of complete denial.

The order for abusive resistance is a moral and financial sanction of the bank’s conduct. It sends a clear signal to banks: the systematic and unjustified refusal to refund fraudulent transactions, forcing customers to go to court, will be penalised by an award of damages over and above the simple refund of the sums due.

Compensation for the Cash-Flow Loss

The court also awarded Ms [P] the sum of €1,000 in respect of cash-flow loss. This award, which is separate from the one for abusive resistance, aims to compensate the financial harm suffered by the customer as a result of being deprived for a prolonged period of the sums fraudulently debited.

Cash-flow loss corresponds to the concrete financial difficulties suffered by a person who is deprived of sums that should have been returned to them promptly. In Ms [P]’s case, this harm took several forms. First, she was deprived for more than fifteen months of a sum of €5,580, which, for a modest budget, represents a considerable difficulty in managing day-to-day expenses.

The court also highlights a particularly shocking element: “it is not insignificant to note that SA CAISSE D’EPARGNE ET DE PREVOYANCE MIDI-PYRENEES did not hesitate, despite Ms [C] [P]’s claims, to charge her overdraft interest (agios) and to terminate her overdraft facility”. In other words, not content with refusing to refund the sums fraudulently debited, the bank worsened its customer’s financial situation by charging her fees on the resulting overdraft and withdrawing her overdraft facility.

This conduct appears doubly wrongful. On the one hand, it reveals a complete lack of empathy and of understanding of the distress in which the customer found herself, as the victim of a fraud for which she was in no way responsible. On the other hand, it shows that the bank sought to profit from the situation by charging overdraft interest on an overdraft resulting directly from its own failure to secure the account.

The award for cash-flow loss thus compensates a harm distinct from the principal harm (the loss of the €5,580). It aims to compensate the collateral consequences of the refusal to refund: the inability to meet certain expenses, the need to resort to other credit or overdrafts, the payment of undue overdraft interest, financial stress, and so on.

It should be noted that the €1,000 awarded for cash-flow loss is lower than the amount claimed by the customer (€2,000). The court probably considered that, while the harm was real, it should be assessed in a measured way, taking into account the concrete circumstances of the case. This moderation takes nothing away from the principle: the prolonged and unjustified refusal to refund generates a distinct cash-flow loss, which must be compensated.

It may be added that ordering the bank to pay irrecoverable costs (Article 700 of the Code of Civil Procedure) of €1,800 and the full costs of the proceedings completes the customer’s compensation. These orders aim to compensate the expenses incurred in the proceedings (lawyer’s fees, bailiff’s fees, etc.) which, but for the bank’s abusive resistance, would not have had to be incurred.

The Practical Impact of This Decision for Victims of Bank Fraud

Beyond the solution adopted in the case decided at Rodez, this decision offers valuable lessons for anyone faced with fraudulent banking transactions and a refusal by their bank to make a refund. It allows a genuine litigation strategy to be identified and the respective obligations of the customer and the bank to be clarified.

The Steps Victims Should Take

Ms [P]’s conduct in this case is a model to follow for any victim of bank fraud. Her steps were exemplary in every respect, which undoubtedly contributed to the success of her legal action.

Step one: detect fraudulent transactions quickly. The faster you react, the more you limit the extent of the harm and the easier you make the investigations. It is therefore essential to check your accounts regularly, ideally via your bank’s mobile app or online customer area. Many banks now offer automatic SMS or push notification alerts for every transaction: activate them systematically.

Step two: contact your bank immediately to report the fraud and block your card. As soon as you detect a suspicious transaction, contact your bank’s stop service, which is available 24 hours a day, 7 days a week. Ask for your bank card to be blocked immediately and, if necessary, for transactions on your account to be temporarily frozen. Note the time of your call, the name of the person you spoke to and the case number you are given. This record will be valuable in the event of a dispute.

Step three: formalise your challenge in writing. In the days following your telephone call, send your bank a registered letter with acknowledgement of receipt setting out the transactions you are disputing. State the dates, amounts and beneficiaries of each fraudulent transaction. Specify that you did not authorise these transactions and that you did not disclose your confidential codes or credentials to any third party. Expressly request a refund of these sums in accordance with Article L. 133-18 of the Monetary and Financial Code. Keep the acknowledgement of receipt for this letter carefully.

Step four: file a complaint with the competent authorities. Go to a police station or gendarmerie to file a complaint for fraud (escroquerie) or fraudulent use of means of payment. Filing a complaint is not legally required in order to obtain a refund from your bank, but it is evidence of your good faith and may facilitate the investigations. Ask for a copy of the complaint receipt.

Step five: chase your bank and, if necessary, send a formal notice. If your bank has not refunded you within the statutory time limits (at the latest on the first business day after you informed it), send it a formal notice by registered letter with acknowledgement of receipt. Recall the applicable provisions, in particular Articles L. 133-18 and L. 133-23 of the Monetary and Financial Code. State that, failing a refund within a reasonable period (for example, 15 days), you reserve the right to bring the matter before the competent court.

Step six: refer the matter to the banking ombudsman if the situation remains deadlocked. Before bringing legal proceedings, you can refer the matter, free of charge, to your bank’s ombudsman. The ombudsman’s contact details appear in your bank’s contractual documents and on its website. The ombudsman will give an opinion within 90 days. This opinion is not binding, but it can unblock the situation if the ombudsman finds in your favour.

Step seven: summon your bank to court. If, despite all these steps, your bank persists in refusing to refund you, you will have to bring the matter before the competent Court of First Instance (tribunal judiciaire). You will need the assistance of a lawyer, unless the amount in dispute is below €10,000 (you may then appear alone before the court, although it is strongly recommended to be assisted). The summons will be served on the bank by a court bailiff (commissaire de justice).

What the Customer Must Prove (and What They Need Not Prove)

One of the questions most frequently asked by victims of bank fraud concerns the burden of proof. What must I prove? How can I show that I did not authorise these transactions? The Rodez Court’s decision provides clear and reassuring answers on this point.

What the customer MUST prove is extremely limited. In reality, the customer simply has to establish three factual elements:

First, that they were indeed the holder of the account on which the disputed transactions were made. This point generally poses no difficulty, since the contractual relationship between the customer and the bank is documented.

Second, that payment transactions were debited from their account. Here again, proof is easy: it is enough to produce the account statements showing these transactions, which the bank itself provides to its customer.

Third, that they dispute having authorised these transactions. This challenge stems from the customer’s simple assertion, formalised in their complaint letter and then in their summons. The customer does not have to prove that they did not authorise the transactions, which would often be impossible, since it would mean proving a negative. It is enough for them to dispute them.

What the customer does NOT have to prove is just as important to understand. The customer does not have to prove:

– That they did not disclose their confidential codes or credentials to third parties (it is for the bank to prove the contrary)

– That they were not negligent in safeguarding their means of payment (it is for the bank to prove gross negligence)

– That the bank’s security systems had a flaw (it is for the bank to prove the absence of any technical deficiency)

– How the fraud was technically carried out (the customer, a layperson in banking IT, does not have the means to understand or explain the technical methods of the hacking)

– That they were the victim of sophisticated hacking that it was impossible to resist (it is for the bank to prove that the customer could and should have avoided it)

This reversal of the burden of proof is decisive in the outcome of disputes. In the vast majority of cases, banks fail to provide the twofold proof that lies upon them: absence of a technical flaw AND gross negligence by the customer. They generally content themselves with asserting that “their systems are secure” and that “the confidential code was used”, which, as the Rodez Court recalled, is not sufficient proof.

It is nonetheless important to remain vigilant and avoid certain pitfalls. If you have in fact disclosed your confidential codes to a third party (even a family member or a friend), if you have replied to a manifestly fraudulent phishing email despite clear warnings, or if you have kept your confidential code written on a piece of paper attached to your bank card, your position will be much weaker. In these situations, the bank might succeed in demonstrating your gross negligence and thereby escape its obligation to refund.

Consistent Case Law in Favour of Consumers

The Rodez Court’s decision is not an isolated case. It forms part of a line of case law that interprets the provisions of the Monetary and Financial Code on unauthorised payment transactions in a manner protective of consumers.

As the judgment notes, the court applies the principles whereby “the sole proof of the use of the customer’s credentials cannot be enough to discharge the professional of all liability, and the conditions in which SECURIPASS was activated by a hacker constitute failings on the part of the bank justifying an order to refund the sums wrongly debited”.

This case-law approach rests on several pragmatic findings. First, IT hacking techniques have become extremely sophisticated and are constantly evolving. Fraudsters can now exploit various security flaws in banking systems or intercept data by advanced technical means.

In the face of this growing sophistication, it would be unfair to expect an average consumer, who is neither an IT specialist nor a cybersecurity expert, to be able to detect and counter all these techniques. A customer who uses their means of payment normally, who does not deliberately disclose their confidential codes and who does not engage in manifestly imprudent conduct does not commit gross negligence, even if they were caught out by a sophisticated fraud technique.

Second, banks are professionals with the technical, financial and human resources to secure their payment systems and to detect suspicious transactions. They have an obligation to achieve a result (obligation de résultat) as regards payment security. If their security mechanisms are circumvented by hackers, it is because they had a vulnerability, even if it was not known at the time of the events. It is therefore logical that banks should bear the risk of such failings rather than make their customers bear it.

Finally, banks have the means to protect themselves against the risk of fraud, in particular through professional insurance and by pooling the risk among all their customers. An individual customer who falls victim to fraud, on the other hand, suffers a personal loss that may be considerable relative to their income and that may place them in a very difficult financial situation.

It should be made clear, however, that this protective case law does not mean that customers bear no responsibility at all. Where gross negligence is actually established (for example, a customer who voluntarily gave their confidential code over the telephone to a caller claiming to be a bank adviser, when their bank had expressly warned them against this type of scam), the courts do not hesitate to reject the refund claim. But such situations remain a minority in litigation practice.

Conclusion

The decision handed down by the Court of First Instance of Rodez on 12 February 2026 is an exemplary illustration of the application of the protective regime established by the Monetary and Financial Code for unauthorised payment transactions. By firmly ordering CAISSE D’EPARGNE ET DE PREVOYANCE MIDI PYRENEES not only to refund the sums fraudulently debited, but also to pay damages for abusive resistance and cash-flow loss, the court sent a clear signal to banks: the systematic and unjustified refusal to refund victims of fraud will not be tolerated.

This case highlights several essential lessons for consumers faced with fraudulent transactions on their bank accounts. First, the law reverses the burden of proof in a way that is particularly favourable to the customer: it is not for them to prove that they did not authorise the transactions or that they were not negligent; it is for the bank to demonstrate the absence of any technical deficiency in its systems and the customer’s gross negligence or fraud. In practice, this proof is extremely difficult for banks to provide, as they generally content themselves with statements of principle without a solid evidential basis.

Second, the conduct of the victim of fraud is decisive in the outcome of the dispute. Ms [P] showed total exemplarity: rapid detection of the suspicious transactions, immediate alert to the bank, written formalisation of her challenge, persistence in her steps. This diligence enabled the court to find that she was in no way negligent and, on the contrary, that the bank had manifestly failed by not acting on her request to block the account.

The orders for abusive resistance and cash-flow loss are of particular importance. They penalise not only the initial refusal to refund, but also the offhand and even malicious attitude of the bank, which continued to charge overdraft interest on an overdraft resulting directly from the fraud and which withdrew its customer’s overdraft facility. This conduct, which considerably worsens the financial situation of a person who is already the victim of a fraud, indeed deserves a specific sanction.

Beyond the particular case decided at Rodez, this decision forms part of a line of case law that interprets the provisions of the Monetary and Financial Code in a protective manner. This protection rests on an objective finding of the asymmetry between banks, professionals with considerable technical resources, and customers, consumers who are vulnerable in the face of the growing sophistication of IT fraud. It is therefore logical that the risk of failure of the security systems should be borne by the party that designs them, deploys them and profits from them, rather than by the one who uses them in good faith.

For victims of bank fraud, the message is clear: do not let yourself be intimidated by your bank’s refusal to refund you. If you have acted diligently, if you have not voluntarily disclosed your confidential codes to third parties and if you have reported the fraud quickly, you have every chance of succeeding in court. The multiplication of decisions such as that of the Rodez Court should, in time, encourage banks to adopt a more responsible attitude and to favour amicable refunds over systematic litigation.

Bank fraud is a scourge that affects thousands of people in France every year. In a context of increasing dematerialisation of means of payment and constant sophistication of hacking techniques, it is essential that the law continue to protect consumers effectively. The Rodez Court’s decision is a further stone in this edifice of protection, and it is to be hoped that it will be followed by many other courts faced with similar situations.

💼 Are you the victim of fraudulent banking transactions and is your bank refusing to refund you? The firm lebot-avocat.com, which specialises in banking law and fraud litigation, can assist you with your steps and defend your interests before the competent courts. Do not wait until the 13-month period has elapsed before acting. The faster you react, the greater your chances of success.

FAQ