Bank Fraud: Banks’ AI as an Argument for Getting Reimbursed (RTS, PSD2, Cass. com., 4 March 2026, No. 24-19.588)

Delegated Regulation (EU) 2018/389 of 27 November 2017 (PSD2 RTS), Articles L. 133-18, L. 133-19 and L. 133-44 of the Monetary and Financial Code (code monétaire et financier), Cass. com., 4 March 2026, No. 24-19.588

What Do Banks Really Say About Their Anti-Fraud AI?

The banking sector’s message is remarkably uniform today: artificial intelligence is said to have shifted the fight against fraud from a logic of reaction to a logic of anticipation. It is no longer a laboratory project, but an openly embraced commercial and strategic argument.

In a study published on 9 March 2026, Deloitte writes that AI “now makes it possible to anticipate, detect and neutralise attacks in real time”. The firm describes “proactive and predictive” detection, capable of “analysing millions of transactions in real time” and, for transfer fraud, of “sequential models (LSTM), analysis of transfer history, detection of breaks in habits, cross-checking with other signals (geolocation, device used)”. The stated objective is “automated blocking” or a “request for additional information” as soon as an atypical transaction is spotted (Deloitte, “Bank Fraud: AI Turns the Threat into a Strategic Lever”, 9 March 2026).

Which Figures and Promises Do They Put Forward?

The institutions themselves communicate along the same lines. The specialist press reports that Société Générale processes more than 200 million transactions a day using models combining business rules and machine learning, while BNP Paribas is aiming for several hundred million euros of value generated by AI, notably in fraud and money laundering detection. Sector analyses describe a genuine showdown of “AI against AI“: fraudsters deploy generative tools, and banks respond with systems that analyse thousands of parameters within seconds (device geolocation, behavioural biometrics, time of day and spending habits), including on instant transfer flows. This message is not confined to specialist publications: the mainstream press relays it just as clearly. In a report published on 27 May 2026 in partnership with Visa, Le Parisien states that, according to the software vendor Finastra, 28% of French financial institutions have already rolled out AI across several functions, and that, according to a Visa risk manager, “every transaction is now analysed” to spot an unusual amount, a sudden change of location or behaviour that departs from habits, the declared aim being the real-time detection of weak signals, sometimes invisible to the human eye (Le Parisien, 27 May 2026). When a payment player publicly states that it analyses every transaction in real time, it also assumes the legal consequences of that claim.

These means are being deployed against a very real threat. According to the 2024 annual report of the Observatory for the Security of Payment Means of the Banque de France, the number of fraudulent transactions rose by 9.3% in 2024, reaching 7.8 million transactions for a total loss of €1.189 billion. Banks’ communication is therefore sincere on one decisive point: the tools exist, they are deployed on a large scale, and the sector presents them as an asset. That is precisely what makes it legally interesting for victims.

What Do the RTS Require of Banks?

This technical capability is not a mere option open to banks: it is a full regulatory obligation.

Article 2 of this regulation requires payment service providers to put in place transaction monitoring mechanisms enabling them to detect unauthorised or fraudulent transactions. These mechanisms must rely on specific risk factors: lists of compromised authentication elements, the amount of each transaction, known fraud scenarios, signs of malware infection and the payer’s location. In other words, the “monitoring” that banks present as an in-house innovation has been a requirement of positive law since 2019.

French law transposes this same requirement in Article L. 133-44 of the Monetary and Financial Code, which requires strong authentication whenever the payer accesses their account online, initiates an electronic payment or carries out a remote transaction “likely to involve a risk of fraud”. The security of transactions is therefore not a marketing promise: it is a legal obligation, for which the RTS define the technical standard.

How Does This Communication Become a Legal Argument?

Bringing these two realities together (banks’ communication on one side, the RTS obligations on the other) produces an effect that institutions do not always anticipate.

When a bank claims to have an AI capable of spotting in real time a “break in habits” in transfers and automatically blocking the transaction, it acknowledges that it holds exactly the tool that the RTS require it to implement. Its own communication (studies, press releases, sales materials) becomes evidence of its technical capability, enforceable before the court. The debate then shifts: the question is no longer whether the bank could have detected the fraudulent transaction, but why it failed to do so in the customer’s case.

What Legal Bases Support a Claim for Reimbursement?

For an unauthorised payment transaction, the Monetary and Financial Code lays down a principle that clearly favours the customer. It still has to be articulated correctly.

What Does Article L. 133-18 Provide on Immediate Reimbursement?

Article L. 133-18 of the Monetary and Financial Code obliges the bank to reimburse the amount of an unauthorised transaction immediately, and at the latest by the end of the first business day following the report, unless it has good reason to suspect fraud by the user themselves, which it must then notify in writing to the Banque de France. The provision comes with dissuasive penalties: in the event of delay, the sums due bear interest at the statutory rate increased by five points, then by ten points after seven days of delay, and by fifteen points after thirty days. The legal principle is therefore reimbursement first; dispute afterwards.

Why Does the Absence of Strong Authentication Change Everything?

Article L. 133-19, V, of the Monetary and Financial Code is even clearer: unless the payer themselves acted fraudulently, the customer “bears no financial consequences” where the transaction was carried out without the bank having required strong authentication. Technical security is therefore not neutral in the allocation of losses: its absence shifts the cost of fraud onto the institution. Checking whether the disputed transaction actually triggered compliant strong authentication, and not a mere validation bypassed through social engineering, is often the first question to ask.

How to Respond to the Gross Negligence Argument?

What remains is the argument that banks raise almost systematically: the customer’s gross negligence (négligence grave), which, on the basis of Articles L. 133-16 and L. 133-19, can deprive them of any reimbursement. This is where banks’ communication on their AI turns against them. If the institution maintains that its models detect anomalies in real time (unusual amount, unknown payee, inconsistent device or geolocation), it becomes awkward for it to explain why a manifestly atypical transfer, to a payee never used before, was executed without the slightest alert or block. The technical capability the bank claims sets the level of diligence that may legitimately be expected of it. Assessing the customer’s “gross negligence” without examining, in mirror image, the failure of the monitoring system that the bank nonetheless says it masters amounts to looking at only one pan of the scales. It is worth noting that the sector, while praising this near-exhaustive detection, tends at the same time to portray the consumer as the weak link and to shift fraud from the technological terrain to the psychological one: a convenient shift, which cannot relieve the bank of the monitoring obligation that rests on it.

Why Base the Claim on the RTS Rather Than on AML/CFT Rules?

A point of method is decisive here, and recent case law has confirmed it. In a judgment of 4 March 2026 (Cass. com., 4 March 2026, No. 24-19.588, published), the Commercial Chamber held that the duty of vigilance arising from the anti-money laundering and counter-terrorist financing framework (Articles L. 561-4-1 to L. 561-14-2 of the Monetary and Financial Code) has “as its sole purpose” AML/CFT: the victim of fraudulent acts therefore cannot rely on its breach to claim damages from the bank. The judgment that had ordered the bank to pay on that basis was set aside.

The lesson is clear: basing a reimbursement claim on the anti-money laundering provisions is a dead end. The relevant ground is that of the obligations to monitor payment transactions: the strong authentication of Article L. 133-44, the monitoring mechanisms of Article 2 of the RTS, and the liability regime of Articles L. 133-18 and L. 133-19. It is on this basis, and not on AML/CFT, that the technical capability claimed by banks takes on its full weight.

It should also be noted that, in the same judgment, the French Supreme Court also set aside the ruling on gross negligence, criticising the lower court for failing to examine whether, on receiving a confirmation message stating that the operation was a payment validation and not a cancellation, the customer was not in a position to suspect fraud. The decision thus recalls that gross negligence is assessed concretely, case by case. Yet this reasoning works both ways: if the customer is expected to decode a confirmation message, the bank, which boasts of analysing thousands of parameters per second, can just as well be expected to detect a fraudulent transfer pattern. This symmetry is rarely pleaded; it deserves to be.

Conclusion: Turning Banks’ Communication into the Victim’s Argument

The paradox is striking. The more banks vaunt the power of their artificial intelligence, the more they weaken the argument they subsequently raise against victims. One cannot, at the same time, claim to detect and neutralise fraud “in real time” and maintain before the court that a manifestly atypical transaction was undetectable. For the victim of a fraudulent transfer or payment, the practical challenge is twofold: to document the unauthorised and atypical nature of the transaction (unknown payee, unusual amount and timing, absence or bypassing of strong authentication), and to set the bank’s own communication on its detection capability against it. Mobilised within the right legal framework, that of Articles L. 133-18, L. 133-19 and L. 133-44 of the Monetary and Financial Code, informed by the RTS obligations, these elements significantly strengthen the customer’s position. LE BOT Avocat assists victims of payment fraud in building this argument and in their reimbursement proceedings.

FAQ: Frequently Asked Questions

This article is published for general information purposes and does not constitute legal advice. Each bank fraud situation is assessed in light of its own circumstances.