Banking Fraud by Impersonation: When Telephone Spoofing No Longer Excuses the Victim (Cass. com., 4 March 2026, No. 24-19.588, Published in the Bulletin)

French Supreme Court (Cour de cassation), Commercial, Financial and Economic Chamber, 4 March 2026, No. 24-19.588

I. The Facts: A Classic Banking Impersonation Fraud

The case brought before the Supreme Court illustrates a method of banking fraud that has unfortunately become commonplace. In September 2022, Mr V. held a bank account with Banque CIC Ouest. On 8 and 9 September, he noticed that two unsolicited remote payment transactions had been debited from his account.

Two days earlier, he had received a telephone call from a person posing as an employee of his bank. That person had convinced him to log in to his mobile banking application in order, supposedly, to cancel fraudulent transactions in progress. Convinced that he was in contact with a genuine adviser from his bank, Mr V. had followed the instructions he was given.

The manipulation relied on a particularly sophisticated technique: the impersonation of the bank branch’s official telephone number, a practice known as telephone spoofing. The fraudster managed to display the official number of Mr V.’s branch on his screen, thereby reinforcing the credibility of the call. Moreover, the call took place during the branch’s opening hours, a detail likely to reassure the victim.

Mr V. immediately alerted his bank and disputed the transactions. Considering that Banque CIC Ouest should have detected and blocked these suspicious payments, he brought proceedings against it to obtain reimbursement of the sums debited, namely €3,946. The case was brought before the proximity court (tribunal de proximité) of Morlaix, which has jurisdiction over small claims.

The proximity court, in a judgment delivered on 18 June 2024, ruled in favour of Mr V. and ordered the bank to pay him the sum claimed. That decision rested on two pillars: first, an alleged breach by the bank of its duty of monitoring and vigilance under Article L. 561-6 of the Monetary and Financial Code (code monétaire et financier); second, the absence of gross negligence on the part of Mr V., given the particularly deceptive circumstances of the fraud.

Dissatisfied with this decision, Banque CIC Ouest lodged an appeal on points of law relying on three grounds. Only two of them would be examined by the highest court, but they were enough to bring about the quashing of the judgment and to clarify two major points of banking law on fraud.

II. Anti-Money Laundering Vigilance Obligations Cannot Found a Civil Liability Claim

A. The First Ground of Appeal: Confusing AML/CTF Vigilance with Banking Security

In its first ground of appeal, Banque CIC Ouest vigorously challenged the legal basis relied on by the proximity court. It criticised the court for having invoked Article L. 561-6 of the Monetary and Financial Code (code monétaire et financier) to establish a breach of an alleged “duty of monitoring and vigilance” justifying the bank’s liability.

Article L. 561-6 of the Monetary and Financial Code forms part of a specific legislative framework, grouped under Articles L. 561-4-1 to L. 561-14-2 of that same code. These provisions transpose into French law the European directive on combating money laundering and terrorist financing (the “AML/CTF” directive). They impose on financial institutions a whole series of vigilance obligations with regard to their customers: identity verification, knowledge of the origin of funds, detection of suspicious transactions, reporting to Tracfin (the French financial intelligence unit), and so on.

According to the bank, however, these AML/CTF vigilance obligations pursue a public-interest purpose (the fight against illicit financial flows and terrorism) and not the individual protection of customers against fraud. In other words, if the bank were to breach these obligations, it would be exposed to administrative or criminal sanctions imposed by the competent authorities (the Prudential Supervision and Resolution Authority, the public prosecutor’s office, etc.), but not necessarily to a claim for damages by a customer.

That is precisely what the first ground of appeal argues: “the vigilance and reporting obligations imposed on financial institutions pursuant to Articles L. 561-5 to L. 561-22 of the Monetary and Financial Code have as their sole purpose the fight against money laundering and terrorist financing; the victim of fraudulent acts cannot rely on the non-observance of the aforementioned vigilance and reporting obligations to claim damages from the financial institution”.

This reasoning rests on a fundamental legal distinction in civil liability: for a customer to obtain compensation on the basis of a contractual or quasi-tortious breach, the rule breached must have been enacted in his interest. Lawyers sometimes refer to this as the question of the rule’s “protective purpose”, or of whether it can be relied on in private relationships.

B. Case Law Now Consolidated: The Vigilance Obligation Serves Only the Fight Against Money Laundering

In its judgment of 4 March 2026, the Supreme Court rules unambiguously. It lays down a clear principle, intended to be authoritative and published in the Bulletin for that reason: “The customer vigilance obligation imposed on financial institutions pursuant to Articles L. 561-4-1 to L. 561-14-2 of the Monetary and Financial Code has as its sole purpose the fight against money laundering and terrorist financing. Consequently, the victim of fraudulent acts cannot rely on their non-observance to claim damages from the financial institution.”

This solution confirms and consolidates case law already begun in earlier decisions, but which had not yet been formulated so clearly. Indeed, trial judges, faced with banking fraud cases, have sometimes been tempted to use the AML/CTF obligations as an additional lever to establish the bank’s liability, especially where it had let suspicious transactions go through.

That temptation must now be set aside. The Supreme Court recalls that anti-money laundering law belongs to a distinct legal regime, governed by public-interest purposes and accompanied by specific supervision and sanction mechanisms. Fraud victims therefore cannot “divert” these provisions to make them a basis for civil liability.

This does not mean, of course, that banks are exempt from all liability in matters of fraud. They remain bound by other obligations, in particular those arising from the bank account agreement, the duty to warn (devoir de mise en garde), or the specific provisions of the Monetary and Financial Code relating to payment services (Articles L. 133-1 et seq.). But the field of anti-money laundering is strictly reserved for its primary purpose.

In ruling as it did, the proximity court of Morlaix therefore made an error of law, which the Supreme Court penalises without hesitation: “In so ruling, the proximity court infringed the aforementioned article [L. 561-6 of the Monetary and Financial Code] by wrongly applying it.”

This first limb of the first ground of appeal is therefore upheld, which would in theory already be enough to justify the quashing. But the Supreme Court does not stop there. It also examines the third ground, relating to the assessment of the victim customer’s gross negligence. And it is here that the judgment takes on its full significance.

III. The Victim Customer’s Gross Negligence: A Stricter Assessment Where There Is an Explicit Confirmation Message

A. The Legal Framework: Who Bears the Losses in the Event of an Unauthorised Transaction?

When a bank customer is the victim of unauthorised payment transactions, the Monetary and Financial Code provides for a mechanism for allocating the burden of losses between the customer and his bank. This mechanism, which stems from the transposition of the European Payment Services Directive (“PSD2”), seeks to reconcile two objectives: on the one hand, to protect consumers against fraud; on the other, to make them accountable so that they behave prudently when using their means of payment.

The basic principle, laid down in Article L. 133-18 of the Monetary and Financial Code, is favourable to the customer: in the event of an unauthorised payment transaction, the payment service provider (the bank) immediately refunds the payer the amount of the transaction. In other words, it is the bank that bears, by default, the losses linked to a fraud.

But this principle is subject to exceptions, provided for in the following articles. Article L. 133-19 of the Monetary and Financial Code provides in particular that “the payer bears all losses resulting from unauthorised payment transactions if he has failed, intentionally or through gross negligence” to comply with two essential obligations:

• The obligation to keep his personalised security credentials safe (confidential codes, identifiers, etc.);
• The obligation to use the payment instrument in accordance with the terms governing its use, as defined by the agreement.

It is therefore the notion of gross negligence that is the pivot of the customer’s liability. If the customer has been grossly negligent, he must bear the losses himself. If, on the contrary, he acted with the prudence of a reasonably informed and attentive user, it is the bank that must compensate him.

Article L. 133-16 of the same code specifies what is meant by “terms governing the use of the payment instrument”. These are, in essence, all the contractual rules that the bank communicates to the customer to enable him to use his bank card, his mobile application, or any other means of payment safely. These terms generally include recommendations and warnings against fraud attempts: never disclose your confidential code, be wary of suspicious calls, verify the identity of the person you are speaking to, and so on.

B. The Supreme Court’s Solution: The Duty to Analyse the Confirmation Message

In the case decided on 4 March 2026, the proximity court of Morlaix had held that Mr V. had not committed gross negligence. The court’s reasoning rested essentially on the effectiveness of the spoofing technique used by the fraudster: the fact that the call came from the bank branch’s official number, during opening hours, had created such an appearance of legitimacy that “it was therefore not abnormal for Mr V. to simply follow the instructions of a person whom he had legitimately identified as an adviser trying to help him at a worrying time”.

This analysis, sympathetic to the victim, seemed in line with recent case law of the Supreme Court. Indeed, in two notable judgments of 23 October 2024 and 12 June 2025, the Commercial Chamber had shown itself protective of customers deceived by an act of spoofing. It had held that no gross negligence could be attributed to them where the fraudster had spoofed the bank’s number, thereby creating a legitimate confusion.

But the judgment of 4 March 2026 qualifies, or even bends, this line of case law. The Supreme Court quashes the proximity court’s judgment on the ground that it did not carry out a full inquiry into a nevertheless decisive point: the analysis of the confirmation message received by Mr V.

Indeed, Banque CIC Ouest argued in its pleadings that Mr V. had received, at the time of validating the transactions, a message on his mobile phone stating explicitly: “You are about to confirm a payment. This is neither a refund nor a cancellation.” This clear and unambiguous message should have alerted Mr V. to the fact that he was validating payment transactions, and not cancelling fraudulent transactions as his caller claimed.

The Supreme Court criticises the proximity court for not having examined whether, on receiving this message, Mr V. was not in a position to suspect the fraudulent nature of the transactions. It states: “In so deciding, without examining, as it had been invited to do, whether, on receipt of the confirmation message sent by the bank stating that the disputed transactions were payment validation transactions, and not cancellations, Mr V. was not in a position to suspect the fraudulent nature of those transactions, the court failed to give a legal basis to its decision.”

This solution is crucial. It means that telephone spoofing, however sophisticated, is not on its own enough to rule out any gross negligence on the part of the victim customer. If, despite the deceptive appearance of the call, the customer received clear and contradictory information through another channel (here, a text message), it is for him to show discernment and to question the consistency of the transactions he is validating.

In other words, the Supreme Court introduces an additional criterion of assessment: that of the victim’s objective ability to detect the fraud, given all the information available to him at the time of the events. What matters is no longer only the subjective credibility of the fraudster, but also the attention the customer should have paid to the messages and alerts issued by his bank.

C. A Quashing for Lack of Legal Basis: A Severe Warning

The quashing technique used by the Court is also revealing. It is a quashing for lack of legal basis (défaut de base légale), meaning that the court did not carry out the factual inquiries necessary to apply the law correctly. In this case, the applicable law consists of Articles L. 133-19 and L. 133-16 of the Monetary and Financial Code, relating to the notion of gross negligence.

This type of quashing is a severe reproach. It means that the court did not investigate the case sufficiently and did not take into account all the relevant elements in assessing the customer’s conduct. By failing to check whether the confirmation message should have aroused Mr V.’s suspicions, the court deprived its decision of a solid legal foundation.

The Supreme Court therefore quashes the judgment “in all its provisions” and remits the case to the Court of First Instance (tribunal judiciaire) of Brest, which will be responsible for re-examining the case in light of this new requirement. The court to which the case is remitted will therefore have to carry out a much finer analysis of Mr V.’s conduct, taking into account all the elements capable of establishing or excluding gross negligence: the precise content of the confirmation message, the customer’s level of information, the general terms and conditions of the payment card, any earlier alerts, the context of stress, and so on.

It is entirely possible that, after this fresh investigation, the Brest court will reach the same conclusion as the Morlaix court and ultimately rule out gross negligence. But it will have to do so after a much more rigorous and detailed demonstration. And that is precisely where the main lesson of this judgment lies: from now on, trial judges can no longer be content with invoking telephone spoofing alone to absolve the customer; they will have to scrutinise all the circumstances of the fraud, and in particular the clarity of the messages received.

IV. Critical Analysis: A Harsh Decision That Underestimates the Psychological Reality of Manipulation

A. A Turning Point in the Case Law That Places an Excessive Burden on Victims

The judgment of 4 March 2026 marks a worrying turning point in the case law on banking fraud by social engineering. Whereas earlier decisions recognised that spoofing the bank’s telephone number was a sufficiently deceptive circumstance to rule out gross negligence on the part of the victim customer, this new position calls that protection into question.

Here the Supreme Court carries out a questionable reversal of perspective. It now requires victims, who are already in a situation of stress and intense psychological manipulation, to retain a capacity for critical analysis at the very moment when everything is done to deprive them of it. That is the main weakness of this reasoning: it postulates a cold rationality in people who have been deliberately placed in a state of panic and urgency by professional fraudsters.

This development can certainly be explained by the spread of fraud techniques and the concern to make users of banking services more accountable. But it places a disproportionate burden on victims, without taking account of the reality of the manipulation mechanisms used by fraudsters. By requiring the customer to analyse a confirmation message coolly when he is convinced that he is in contact with his bank and is being made to believe in an absolute emergency, the Supreme Court disregards everything that the behavioural sciences teach us about cognitive biases and human vulnerability to manipulation.

B. The Illusion of the Clear Message: When Stress Makes Rational Analysis Impossible

The solution adopted by the Supreme Court rests on a debatable assumption: that a confirmation message, however explicit, is sufficient to enable a victim to detect the fraud. This view profoundly misunderstands the psychological reality of manipulation situations.

When a person receives a call that appears to come from his bank (with the right number displayed, during opening hours) and a credible caller tells him that his account is under threat, he is in a state of acute stress that considerably impairs his judgment. Neuroscience has amply demonstrated that stress reduces cognitive capacities, focuses attention on the perceived threat, and creates a tendency to follow the instructions of an authority figure.

In these conditions, a text message referring to “payment validation” rather than “cancellation” becomes an element that is easily overlooked or rationalised. The victim, convinced that he is in contact with his bank, may perfectly well interpret this message as a mere technical formality, an awkward wording, or may not even read it attentively because his attention is monopolised by the caller’s spoken instructions.

The Supreme Court seems to consider that the mere presence of a contradictory message is enough to restore the victim’s clarity of mind. This overlooks the force of social engineering techniques, which rely precisely on cognitive saturation and the creation of attentional tunnelling. The fraudster does not merely spoof a number: he builds a credible scenario, maintains constant pressure, and guides the victim step by step, leaving no respite in which to step back.

In this context, requiring a victim to detect an inconsistency in a text message amounts to blaming him for not having resisted a professional manipulation technique designed precisely to short-circuit his powers of discernment. It is, in a way, like blaming someone for having been fooled by a professional conjuror.

Moreover, the Court’s decision ignores a fundamental point: in many cases, victims regularly receive confirmation messages for legitimate transactions, to the point that these messages become commonplace. When one regularly makes online payments, one gets used to validating these confirmations almost automatically. This habituation makes it all the harder to detect an anomaly under stress.

C. The Practical Consequences for Victims and Banks

For victims of banking fraud, this judgment marks a worrying hardening of the case law. The message is clear: even in the presence of sophisticated spoofing and intense psychological manipulation, the presence of a confirmation message may suffice to establish gross negligence. Customers will no longer be able to fall back solely on the argument that “the fraudster was convincing” if, at the same time, they received a message stating that it was a payment.

This position ignores a simple reality: if careful reading of a message were enough to detect fraud, fraud would no longer exist. Fraudsters have perfectly understood that victims, under pressure, do not read these messages carefully or interpret them through the prism of the trust that has been established. It is precisely on this human weakness that they base their strategy.

In practical terms, this means that, to have any hope of succeeding, fraud victims will have to show that:

• Either they did not receive a clear confirmation message (which will be difficult to prove if the bank produces screenshots);
• Or the message received was itself ambiguous or misleading (but the Court seems to consider that a simple reference to “payment” is sufficiently clear);
• Or they were in a situation of particular vulnerability that prevented them from analysing the message, and it is undoubtedly on this ground that the bulk of disputes will now be fought.

This last scenario therefore becomes crucial. Victims will have to prove that they were in such a state of stress that they were materially unable to analyse the message, that they suffer from cognitive limitations (elderly people, attention disorders, disability), or that they were subjected to exceptional psychological pressure. But the burden will be on them to prove these particular circumstances, which can prove delicate, especially long after the events.

For banks, this judgment is obviously an opportunity to reduce their compensation obligations. The more explicit the messages are (and banks will not fail to make them even clearer and more visible), the easier it will be for them to demonstrate that the customer should have suspected the fraud. We can expect a proliferation of very detailed messages, double confirmations, and alerts in bold and in colour, all of which can be invoked after the event to establish the victim’s negligence.

But this race to multiply messages risks paradoxically relieving banks of responsibility for what matters most: putting in place systems for the automatic detection of suspicious transactions. If a message is enough to exonerate the bank, why would it invest in costly behavioural detection technologies, the automatic blocking of atypical transactions, or the systematic calling back of the customer in case of doubt? The risk is that banks will content themselves with multiplying warning messages, thereby shifting their responsibility onto the customer.

D. The Remaining Defences Available to Fraud Victims

Faced with this hardening of the case law, fraud victims are not left defenceless, but they must build a much stronger and more detailed argument. Several lines of defence remain available, and litigation strategy must focus on them:

1. Emphasise the psychological context and the pressure exerted. This is undoubtedly the most important argument. It is not simply a matter of saying “I was stressed”, but of demonstrating, ideally through a psychological expert report or medical evidence, that the level of stress was such as to make any critical analysis of the message impossible. Victims may rely on their age, their state of health, their limited familiarity with digital tools, or the emotional shock caused by the announcement of a fraud on their account.

2. Challenge the real clarity of the confirmation message. If the message received was buried among other notifications, displayed in an inconspicuous way, worded in technical jargon, or accompanied by other legitimate messages creating confusion, the victim may argue that a normally attentive user, even outside a situation of stress, would not necessarily have noticed the alert. Screenshots, testimony from digital ergonomics experts, or a reconstruction of the conditions in which the message was received can be useful.

3. Demonstrate the exceptional sophistication of the fraud. Not all spoofing is equal. If the fraudster not only spoofed the number but also perfectly imitated the bank’s tone, vocabulary and procedures, if he had personal information about the victim (surname, first name, account number), if he maintained the pressure over a long period, this may show a level of professionalism such that no reasonable person could have detected the fraud.

4. Hold the bank liable on other grounds. If the AML/CTF obligations can no longer be invoked, other grounds of liability remain essential:

• The breach of the contractual security obligation: did the bank put in place sufficiently effective systems for detecting suspicious transactions? Why did two unusual transactions not trigger an automatic alert?
• The failure to warn (défaut de mise en garde): did the bank sufficiently inform and raise its customer’s awareness of the risks of spoofing? Did the general terms and conditions clearly mention this fraud technique?
• The fault in performance of the agreement: did the bank delay in blocking the transactions after being alerted? Did it react diligently?

5. Seek an in-depth technical expert report. An expert can analyse the bank’s security systems, its anomaly detection systems, the traceability of transactions, and reaction times. If the expert finds that the bank could and should have detected these transactions given their atypical nature, this will be a major factor in a sharing of liability.

6. Favour banking mediation. In the face of this hardening of the case law, the amicable route becomes even more important. Banking ombudsmen, aware of the limits of the case law and anxious to protect their institution’s image, may accept settlement solutions, particularly where the victim presents a vulnerability profile or the circumstances of the fraud are particularly shocking. A well-constructed file, with all the contextual elements, can persuade a mediator even if the chances in court seem compromised.

Conclusion

The judgment delivered by the Commercial Chamber of the French Supreme Court on 4 March 2026 marks a worrying turning point in the case law on banking fraud. By requiring victims to analyse confirmation messages coolly even though they are subject to intense psychological manipulation, the highest court disregards the reality of the cognitive and emotional mechanisms at work in these situations.

This decision admittedly clarifies two points of law: anti-money laundering obligations cannot serve as the basis for a civil liability claim, and telephone spoofing is no longer enough to systematically rule out gross negligence. But it does so at the price of a disembodied view of the victim, reduced to a rational agent capable of critical analysis in all circumstances.

The reality is quite different, however. Social engineering techniques are designed by manipulation professionals to short-circuit precisely the victims’ powers of discernment. Placing on them the responsibility of detecting an inconsistency in a text message, when they are convinced that they are in contact with their bank and are being made to believe in an absolute emergency, amounts to blaming them for not having resisted a technique designed to deceive them.

Beyond these considerations, this judgment raises a fundamental question: how far should the accountability of bank customers go in the face of increasingly sophisticated fraud techniques? Banking law constantly oscillates between two imperatives: protecting consumers and encouraging them to be vigilant. The judgment of 4 March 2026 leans resolutely towards accountability, at the risk of leaving alone victims who are already traumatised by the fraud they have suffered.

This increased severity also risks producing a perverse effect: by allowing banks to escape liability more easily through the mere multiplication of warning messages, it could dissuade them from investing in genuine fraud detection and prevention systems. Why develop costly behavioural detection technologies if a simple message is enough to transfer responsibility to the customer?

It remains to be seen how the lower courts will apply this new teaching. The Court of First Instance (tribunal judiciaire) of Brest, to which the case has been remitted after the quashing, will have the opportunity to show whether there is still room for assessment that makes it possible to take account of the victims’ psychological context. Let us hope that the judges will show pragmatism and humanity, remembering that behind every banking fraud case there is a person who has been the victim of professional manipulation, and not an automaton incapable of reading a message.

If you are the victim of banking fraud and your bank refuses to reimburse you, do not hesitate to consult a lawyer specialising in banking law. A careful analysis of your case will determine whether gross negligence can be ruled out and whether other grounds of liability can be invoked. Lebot Avocat, with its expertise in banking fraud and aware of the difficulties this new case law raises for victims, can support you in this process and defend your interests with rigour and determination.

FAQ: Your Questions on Banking Fraud and Customer Liability