Court of Appeal of Besançon, 1st Civil and Commercial Chamber, 24 March 2026, No. RG 24/01830: Upholding the judgment of the Court of First Instance of Besançon (tribunal judiciaire) of 19 November 2024, RG No. 1123000680
🔑 Key Takeaways
- The bank cannot escape its obligation to reimburse by relying solely on the proper functioning of the strong authentication system.
- The burden of proving the customer’s gross negligence (négligence grave) lies exclusively with the payment service provider (the bank), never with the customer.
- That proof cannot result from mere presumptive reasoning: the bank must produce concrete extrinsic evidence.
- In a case of fraud by spoofing (impersonation of the bank adviser), the victim is generally not guilty of gross negligence.
- The court upholds the reimbursement of €6,007.80 of fraudulent debits, together with interest at the statutory rate from the formal notice, as well as €2,000 in damages for non-material loss.
- Taking out a loan to cover an overdraft caused by fraud is not a ground for annulling the loan for duress (violence), unless there is a clearly established abuse.
Table of Contents ▼
- What happened in this bank fraud case?
- How were the victims robbed?
- Why did the bank refuse to reimburse?
- What is strong authentication and why is it at the heart of the dispute?
- Does the Securpass system protect the bank or the customer?
- What is spoofing, or fake bank adviser fraud?
- Who must prove what: what is the applicable rule of law?
- What does Article L. 133-23 of the Monetary and Financial Code say?
- Does the mere use of strong authentication prove the customer’s fault?
- How did the Court of Appeal of Besançon decide?
- Was the bank able to escape liability?
- Could the loan taken out to cover the overdraft be annulled?
- What practical lessons can bank fraud victims draw from this judgment?
- FAQ: Frequently Asked Questions
What happened in this bank fraud case?
How were the victims robbed despite two-factor authentication?
The case begins in August 2022. A couple holds a current account with Banque Populaire de Bourgogne Franche-Comté (hereinafter “BPBFC”). Like millions of French people, they had activated their bank’s strong authentication service, called “Securpass” here, in order to secure their online banking operations. This system, required by European regulation, is presented by banks as an infallible shield against fraud.
The Securpass mechanism looks robust: to validate a transfer from a mobile phone, the customer must complete four successive steps: enter the details of their bank card, open the mobile application with a confidential code or their biometric fingerprint, check the details of the transaction displayed (amount, recipient, date), then confirm their confidential code a second time. A genuine series of locks.
Yet on 15 August 2022, a first transfer of €3,003.90 was debited from their account, to the money transfer company Western Union. Two days later, on 17 August 2022, an identical second debit of €3,003.90 was made to the same recipient. Within 48 hours, the couple had been robbed of a total of €6,007.80.
It was only on 19 August 2022, alerted by their bank adviser, that the victims realised what had happened. They immediately disputed these transactions, declaring them unauthorised, and demanded that their bank reimburse the sums taken.
🔍 Modus operandi: spoofing, or fake adviser fraud
Step 1: A fraudster calls the victim, spoofing the official telephone number of their bank (the number displayed on the phone really is the bank’s)
Step 2: He presents himself as a security agent or bank adviser and reports “suspicious transactions” on the victim’s account
Step 3: Under the pretext of “securing” the account, he asks the victim to validate transactions or to give him codes
Result: The funds are transferred to a third-party account controlled by the fraudsters, often via Western Union or accounts abroad
Why did the bank flatly refuse to reimburse its customers?
BPBFC’s response came quickly: in a letter of 24 August 2022, it issued a firm refusal. Its reasoning was blunt: since the disputed transfers had indeed been validated through the Securpass system, which involves the double entry of personal codes, this necessarily meant that the customers had disclosed their credentials to malicious third parties. The bank concluded that its customers had committed gross negligence, which released it from any obligation to reimburse.
In plain terms, the bank adopts a syllogism: our system is infallible → the fraudsters were able to use it → therefore the customers gave them the codes → therefore the customers are at fault. This reasoning, based on the supposed technical reliability of the system, lies at the heart of the banks’ argument in almost every PSD2 fraud dispute. And it is precisely this reasoning that the Court of Appeal is going to demolish.
The couple maintained their refusal to pay. Unable to obtain satisfaction amicably, the victims found themselves in a dramatic situation: their account was overdrawn and their everyday banking operations were at risk. Under pressure from the bank, in October 2022 they agreed to take out a consumer loan of €5,300 to cover the overdraft created by the fraud, a debt they would never have contracted without the fraudulent debits. On 3 August 2023, they brought proceedings before the Court of First Instance of Besançon.
What is strong authentication and why is it at the heart of the dispute?
Strong Customer Authentication (SCA) is an identity verification mechanism required by the European PSD2 Directive (Payment Services Directive 2, 2015/2366). It is based on the combination of at least two of the following three factors: something you know (a secret code), something you possess (your mobile phone), and something you are (biometric data such as a fingerprint or facial recognition). The aim is to make online payments safer by making access to the account and the validation of transactions harder to impersonate.
Directive (EU) 2015/2366 of 25 November 2015, known as PSD2, is the European text governing payment services in Europe. Transposed into French law in the Monetary and Financial Code (code monétaire et financier, Articles L. 133-1 et seq.), it sets the rules on unauthorised payment transactions, on the burden of proof, and on the conditions under which a bank may escape its obligation to reimburse. PSD2 has considerably strengthened the rights of customers who are victims of fraud.
Does the strong authentication system protect the bank or the customer?
It is essential to understand a point that banks often present poorly: the strong authentication mechanism was designed to protect the customer against unauthorised payments, not to create an irrebuttable presumption of customer fault in the event of fraud. PSD2 imposes this technical requirement on payment service providers (PSPs) to strengthen the security of transactions. It is not an instrument allowing banks to shed their legal liability.
Yet in bank fraud disputes, it is regularly observed that banks turn the argument against their own customers. Their reasoning is as follows: “we have put in place a secure and infallible system, so if a third party was able to use it, you must have given them your codes.” This argumentative slide turns proof that the system worked into proof of the customer’s fault. This is exactly what the Court of Appeal of Besançon penalises in this judgment.
The court recalls that the law is unequivocal on this point. Article L. 133-23 of the Monetary and Financial Code expressly provides that “the use of the payment instrument as recorded by the PSP is not necessarily sufficient in itself to prove that the transaction was authorised by the payer, or that the payer failed, intentionally or through gross negligence, to fulfil their obligations in this respect.”
What is “spoofing”, or fake bank adviser fraud?
Spoofing (from the English “to spoof”: to impersonate) is a fraud technique in which a fraudster impersonates a trusted third party, here a bank employee, in order to manipulate the victim. In the variant known as “fake bank adviser fraud” or “CEO fraud” (fraude au président), the fraudster uses a telephone number spoofing technique (the number displayed on the victim’s phone really is the bank’s, but the call actually comes from the fraudster). The victim, convinced they have their bank on the line, follows the instructions they are given, including validating transfers or disclosing codes.
The Court of Appeal of Besançon expressly classifies the modus operandi at issue in this case as “spoofing”, illustrating the technique of “CEO fraud”. This is an important judicial recognition: spoofing is a sophisticated fraud in which the victim is manipulated by methods that deceive even vigilant people. The court notes that this technique involves a malicious third party who “impersonates a manager of the account-holding institution in order to obtain a deposit held on the account or the personal codes and identifiers with a view to stripping the victim of their funds.”
This classification is fundamental because it changes how the victim’s behaviour is perceived: a person who receives a telephone call displaying the official number of their bank, and who follows the instructions of someone presenting themselves as their adviser, does not necessarily commit gross negligence. On the contrary, they are the victim of a sophisticated scam.
Who must prove what: what is the applicable rule of law in bank fraud cases?
Gross negligence is the condition allowing a bank to refuse to reimburse an unauthorised payment transaction. Recital 72 of PSD2 specifies that it implies “more than mere negligence”: it is a “marked failure of vigilance” (défaut de vigilance caractérisé). In practice, the case law holds that it must be a particularly serious fault, such as deliberately disclosing one’s PIN code by email or replying to a manifestly fraudulent message. The mere fact of being deceived by a sophisticated fraud is not enough to establish gross negligence.
What does Article L. 133-23 of the Monetary and Financial Code say about the burden of proof?
Article L. 133-23 of the Monetary and Financial Code, which transposes PSD2 into domestic law, organises the allocation of the burden of proof in a very precise way. This provision lays down two fundamental rules that benefit victims:
First rule: It is for the payment service provider (the bank) to provide “all the evidence needed to prove the fraud or gross negligence committed by the payment service user.” The bank must therefore actively prove its customer’s fault. It cannot simply wait for the customer to prove their innocence.
Second rule: The use of the payment instrument as recorded by the PSP “is not necessarily sufficient in itself to prove that the transaction was authorised by the payer, or that the payer failed, intentionally or through gross negligence, to fulfil their obligations.” In other words, the mere fact that the bank’s computer logs show that the transactions were authenticated does not constitute sufficient proof.
Combined with Article L. 133-19 of the same code, these provisions establish that, in order to escape its obligation to reimburse, the bank must:
What the bank MUST demonstrate in order to refuse reimbursement:
That the transaction was duly authenticated (technical record)
That the transaction was properly recorded and accounted for
That the transaction was not affected by a technical deficiency
Concrete extrinsic evidence establishing the customer’s gross negligence (abnormal behaviour, ignored warnings, voluntary and knowing disclosure of codes…)
Can the mere use of strong authentication prove the customer’s fault?
No, and this is the core of the solution in this judgment. The Court of Appeal of Besançon puts it unambiguously: “the mere fact that the security protocol provides for the use of two passwords to make the payment from a mobile phone cannot lead to the unequivocal inference of gross negligence on the part of the payer.”
The court relies here on solid case law of the French Supreme Court (Cour de cassation), which laid down the same principle in a judgment of 18 January 2017 (Cass. com., 18 January 2017, No. 15-18.102): proof of gross negligence cannot result from presumptive reasoning and cannot be deduced solely from the use of the payment instrument or of the personal data linked to it.
The practical significance of this principle is considerable: even in the most robust strong authentication systems, sophisticated fraudsters can lead victims to validate the fraudulent transactions themselves without realising what they are doing. The fact that the transaction was technically authenticated says nothing about the conditions in which that authentication took place.
How did the Court of Appeal of Besançon decide the dispute?
Was the bank able to prove its customers’ gross negligence in order to escape liability?
The answer is clearly no. BPBFC had told its customers in its letter of 24 August 2022: “Our departments have proof that the card transactions were duly validated by means of the strong authentication mechanism offered by our bank, by entering the secret code that you previously defined or by using the biometric function within that mechanism.”
The court brushes this argument aside: “the proof allegedly held is in no way adduced and cannot, as has been seen, result from presumptive reasoning.” The bank produced no concrete evidence that the customers had acted with gross negligence: no proof of a suspicious email to which they had replied, no analysis of abnormal behaviour, no witness statement, nothing other than the bare invocation of the functioning of the Securpass system.
The court therefore upholds the first-instance judgment in its entirety, ordering BPBFC to pay:
📋 What the bank must pay (final decision)
€2,000in damages for the non-material loss suffered (stress, anxiety, psychological distress linked to the scam)
€2,000in costs at first instance (Article 700 of the Code of Civil Procedure)
€1,500in costs on appeal (Article 700 of the Code of Civil Procedure)
+ costsof both instances
The recognition of non-material loss deserves emphasis. The court confirms that “the financial hardship, with its undeniable psychological effects on the customers, was rightly compensated […] by the award of compensation of €2,000.” This confirms that victims of bank fraud may claim compensation going beyond the mere reimbursement of the sums taken, provided they can show non-material loss: anxiety, stress, sleep disturbance, financial difficulties resulting from the fraud.
Could the loan taken out to cover the overdraft be annulled for economic duress?
On this point, the outcome is unfavourable to the customers, and it deserves an explanation. On their cross-appeal, the victims had sought annulment of the €5,300 consumer loan they had taken out in October 2022 to cover the overdraft created by the fraud. Their argument was that the loan was taken out under duress, the bank having formally called on them to regularise their situation on pain of having their banking operations blocked. They relied on duress (violence) within the meaning of Articles 1140 and 1143 of the Civil Code (code civil), in particular abuse of economic dependence.
The court rejects this analysis. It recalls that “the threat of legal action, save abuse, cannot be regarded as constraint characteristic of a defect of duress” and that “the interest of the account-holding banker in having a debt liability cleared cannot constitute constraint or an abuse of economic dependence.” It also notes that the amount of the loan corresponded exactly to the debit recorded on the account.
This solution is legally consistent with the classic case law on economic duress, but it leaves the victims in an uncomfortable position: they obtained reimbursement of the fraud but remain bound to repay the loan taken out immediately afterwards. They will have to use the funds recovered from the bank to settle that loan, hoping that the statutory interest running since the formal notice covers part of the contractual interest.
What practical lessons can bank fraud victims draw from this judgment in 2026?
What arguments should you use against your bank to obtain reimbursement after a fraud?
This judgment of the Court of Appeal of Besançon consolidates a body of case law favourable to victims and gives you specific arguments to put to your bank:
1. Invoke the burden of proof that lies with the bank. If reimbursement is refused, the bank must explain which concrete, extrinsic elements demonstrate your gross negligence. It is not enough for it to tell you that the strong authentication system was used: it must prove your fault, and that proof cannot result from circular reasoning. Demand it in writing.
2. Distinguish technical authentication from proof of fault. The fact that your bank’s computer logs record a “successful two-factor authentication” does not prove that you committed gross negligence. That is exactly what Article L. 133-23 of the Monetary and Financial Code says, and what the settled case law has held since 2017.
3. Describe the modus operandi of the fraud precisely. If you were the victim of a telephone call with the bank’s number spoofed, a fake email, a fake text message, or another psychological manipulation technique, describe it in detail. This context is essential to rule out the classification as gross negligence: a victim manipulated by a sophisticated identity-spoofing system is not negligent.
4. Keep all the evidence. Keep screenshots of the text messages and emails received, telephone records showing the call, and exchanges with your bank. These items will be valuable if your case reaches a court.
5. Meet the deadlines for disputing the transaction. Article L. 133-24 of the Monetary and Financial Code requires an unauthorised transaction to be reported within 13 months of the date of the debit. Do not let it drag on.
What legal levers are available if the bank continues to refuse?
If the amicable approach fails, several routes are open to you:
Banking mediation is mandatory before any court action for disputes under €10,000 at certain institutions. The bank’s mediator may give a favourable opinion, even though it is not binding on the bank.
Legal action before the Court of First Instance (tribunal judiciaire) is the main route for significant amounts. This judgment reminds you that judges penalise banks’ attempts to escape liability by mere presumptions, and that they also award damages for the non-material loss suffered.
The bank’s technical obligations under the RTS (Regulatory Technical Standards of the EBA, supplementing PSD2) are a still under-used but potentially powerful lever. These standards impose on banks precise obligations regarding strong authentication, transaction monitoring and the detection of behavioural anomalies. Where a fraud occurs despite strong authentication, particularly in cases of sophisticated spoofing, the question of whether the bank complied with its monitoring obligations may found a separate civil liability, in addition to the statutory obligation to reimburse.
Filing a criminal complaint remains useful, in particular to obtain a soit-transmis (a transmission note from the prosecutor’s office) that can support your civil proceedings and help identify the perpetrators, even though a criminal complaint does not, in itself, constitute a basis for civil compensation against your bank.
The judgment of 24 March 2026 does not create an automatic right to reimbursement for every fraud victim. Each case is particular. The outcome depends on the precise facts, the victim’s behaviour and the nature of the fraud. If, for example, you disclosed your PIN code in response to a message clearly identifiable as fraudulent, or if you had received warnings from your bank about phishing risks that you ignored, your situation could be assessed differently. Consult a specialist lawyer to assess your case.
Conclusion: A Judgment That Strengthens the Protection of Bank Fraud Victims
The judgment delivered by the Court of Appeal of Besançon on 24 March 2026 forms part of a consistent and favourable body of case law on unauthorised payment transactions. It provides a welcome confirmation of an essential principle: in bank fraud litigation, the bank cannot hide behind the sophistication of its own security system to escape its statutory obligation to reimburse. The presumption that the system works properly does not create a presumption of fault on the part of the user.
This reminder is all the more important because fraud techniques are constantly evolving. Spoofing, which consists of impersonating the bank by manipulating the displayed telephone number, is a sophisticated fraud that even vigilant people may fail to detect. Requiring victims to prove their innocence would penalise them twice: first through the loss of their funds, then through the practical impossibility of obtaining redress.
The decision also confirms that the non-material loss of fraud victims (the anxiety, the stress, the psychological distress linked to a suddenly deteriorated financial situation) deserves compensation beyond the mere reimbursement of the sums taken.
If you are the victim of bank fraud and your bank refuses to reimburse you by invoking your own negligence, you have rights and serious arguments to put forward. Do not accept a final refusal without having consulted a lawyer specialising in banking law.
Is your bank refusing to reimburse you after a fraud?
The law firm LE BOT Avocat defends victims of bank fraud against their bank. Contact us for an initial analysis of your case.
