References: Articles L. 133-16, L. 133-18, L. 133-19 IV, L. 133-23 and L. 133-24 of the Monetary and Financial Code (code monétaire et financier); Article 40 of the Code of Criminal Procedure (code de procédure pénale). Decisions cited: TJ Paris, 9th ch., 11 April 2025, No. 23/11667; CA Paris, Pôle 4 ch. 9-A, 21 March 2024, No. 22/13072; Cass. com., 23 October 2024, No. 23-16.267; on the fake IBAN: Cass. com., 20 May 2026, No. 25-14.005 and 1 July 2026, No. 25-16.014.
🔑 Key Takeaways
- In the case of an unauthorised transaction, the bank must reimburse you by the end of the next business day at the latest after the report (Article L. 133-18 of the Monetary and Financial Code).
- The burden of proving gross negligence (négligence grave) lies on the bank, never on the customer (Article L. 133-23). The mere fact that the payment instrument was used is not enough.
- The bank can produce your criminal complaint as an admission: in Paris, a customer lost €9,654 because his complaint acknowledged having disclosed a code (TJ Paris, 11 April 2025, No. 23/11667).
- A victory won at first instance was overturned on appeal thanks to the customer’s complaint, in which she acknowledged having clicked on a link (CA Paris, 21 March 2024, No. 22/13072).
- What to tell the bank: “I dispute these unauthorised transactions” + the identifying details (date, amount, reference, beneficiary). Nothing more.
- The time limit for disputing is 13 months at most after the debit (Article L. 133-24).
- A complaint sent by registered letter to the public prosecutor (procureur de la République) has the same value as a filing at the police station (Article 40 of the Code of Criminal Procedure), while leaving you in control of its content.
- Warning: if you yourself ordered the transfer to an IBAN supplied by the fraudster (fake seller, fake notary, fake adviser), this guide and its templates do not apply. The case law changed in 2026 and the basis to rely on depends on the circumstances: consult a lawyer before putting anything in writing.
- Two ready-to-copy templates appear at the end of the article: a letter disputing the transactions addressed to the bank and a complaint to the prosecutor, deliberately minimalist.
Table of Contents ▼
- Why are your statements so dangerous?
- Who must prove what?
- Concrete examples where the complaint sank the victim?
- What should you say? The strict minimum
- What to say to the bank?
- What to put in the complaint?
- Police station or letter to the prosecutor?
- And if you have already said too much?
- Which letter templates should you use?
- Did you make the transfer yourself to a fake bank details form?
- Template letter disputing the transactions, addressed to the bank
- Template complaint to the prosecutor
- FAQ: Frequently Asked Questions
Why are your statements so dangerous?
The regime for unauthorised payment transactions (Articles L. 133-18 to L. 133-24 of the Monetary and Financial Code) is, on paper, very favourable to the victim. As soon as you report a transaction that you did not authorise, the bank must reimburse you immediately, and by the end of the next business day at the latest (Article L. 133-18). By default, therefore, you win: the bank must pay.
This is a transaction (transfer, card payment, direct debit) carried out on your account without your consent. It gives rise, in principle, to a right to full reimbursement by the bank, even if the transaction was technically “authenticated”.
Who must prove what?
This is where everything is decided. It is for the bank, and not for you, to prove that you authorised the transaction, or that you acted fraudulently, or that you failed through gross negligence in your security obligations (Article L. 133-23). And the law specifies that this proof cannot be inferred from the mere fact that the payment instrument was used. The bank in reality has only one way out: demonstrating your gross negligence (Article L. 133-19 IV).
This is conduct of manifest recklessness, going beyond mere imprudence: for example, voluntarily disclosing a security code or an authentication key to a third party, despite an explicit warning. It is the only fault that deprives the victim of the right to reimbursement.
The problem: the simplest, cheapest and most formidable way for the bank to establish this gross negligence is to take up your own statements. Your complaint, your letter and above all your criminal complaint become the incriminating evidence it produces against you.
You describe the fraud in detail → the bank retrieves your writings (it has access to your complaint) → it isolates the sentence that incriminates you → it invokes gross negligence (Art. L. 133-19 IV) → refusal to reimburse.
Concrete examples where the complaint sank the victim?
Two recent decisions illustrate this strikingly.
Paris Court of First Instance (tribunal judiciaire), 11 April 2025 (No. 23/11667). A BNP Paribas customer, a victim of spoofing (impersonation of his bank’s telephone number), claimed reimbursement of €9,654. To establish his gross negligence, the bank “relie[d] on the complaint filed” by the customer to argue that he acknowledged having disclosed a code received by SMS. The court then reproduced word for word the record of the complaint (“I therefore gave him my customer number”), as well as the letter of complaint, in which the customer admitted having passed on his digital key. Conclusion: gross negligence established, claim dismissed, the customer was denied everything and ordered to pay costs. It was his own writings that sank him.
Spoofing consists, for a fraudster, in impersonating your bank’s telephone number or visual identity to put you at ease. Phishing (hameçonnage) consists in luring you, by SMS or e-mail, to a fake website so that you enter or disclose your data. Depending on whether or not you yourself handed over your data, the legal outcome changes radically.
Paris Court of Appeal (cour d’appel), 21 March 2024 (No. 22/13072). The scenario is even more telling. At first instance, the customer had won: La Banque Postale had not appeared and had therefore not proved gross negligence, and the bank was ordered to reimburse €6,000. On appeal, the bank produced the record of the complaint that the customer, aware of the danger, had carefully avoided putting before the court. The court noted that, in this complaint, the customer “acknowledged” having received a suspicious e-mail, “having followed the link, entered her login details”, while having had a doubt. The court expressly characterised these statements as an “admission”, found gross negligence and reversed the judgment. The customer lost her entire reimbursement and was ordered to pay €1,000 to the bank. She had nevertheless tried to hide her complaint: the bank held a copy of it.
The lesson is final. The complaint is not a confidential document that would remain between you and the justice system: the bank has access to it and uses it. Everything you state, to the bank as to the investigators, can and will be used against you.
What should you say? The strict minimum
The rule fits in one sentence: you dispute fraudulent transactions, full stop. You do not have to recount the fraud, explain how it happened, or detail what you clicked, received or disclosed.
✅ WHAT TO SAY
- “I dispute these transactions, which I did not authorise.”
- The date and amount of each transaction.
- The transaction reference and the account / beneficiary concerned.
- The express request for reimbursement.
⛔ WHAT NOT TO SAY
- “I clicked on a link…”
- “I disclosed my code / my key…”
- “I think it happened because…”
- Any account, hypothesis or regret about your behaviour.
An adviser may promise you reimbursement orally, assure you that “the file is settled” or, on the contrary, dissuade you from taking action: none of this has any value before a judge. Systematically demand written confirmation of every exchange, and formalise your disputes yourself by letter. As the Latin adage reminds us, verba volant, scripta manent: spoken words fly away, written words remain.
What to say to the bank?
Your only useful obligation is to report unauthorised transactions without delay and within the statutory time limit (Article L. 133-24: no later than thirteen months after the debit). This report is enough to trigger the reimbursement obligation of Article L. 133-18. Stick to the essentials, therefore: formal dispute, identification of the transactions, request for reimbursement. No narrative, no self-analysis, no “I may have…”. The “how” of the fraud is precisely what feeds the gross negligence argument, yet this “how” has no bearing on your right to reimbursement, which arises from the report alone.
What to put in the complaint?
The same discipline applies. State that you are the victim of fraudulent banking transactions, identify them, and set out your loss. Do not include any technical confession about codes disclosed, links clicked or data entered. Avoid hypotheses, regrets and improvised reconstructions: these are exactly the sentences the bank will highlight before the judge.
An important clarification: this obviously does not mean lying or concealing facts, which would expose you to other risks. It means not volunteering an interpretation or a level of detail that will be turned against you. You report verifiable, identifying facts; you do not characterise your own behaviour yourself.
Police station or letter to the prosecutor?
Many victims rush to the police station. It is rarely the best choice.
This is the act by which a victim reports an offence to the justice system. It may be filed at the police station or the gendarmerie, but may also be sent directly to the public prosecutor by letter (Article 40 of the Code of Criminal Procedure). Both routes have the same legal value.
You can therefore perfectly well send your complaint by registered letter with acknowledgement of receipt to the public prosecutor at the Court of First Instance (tribunal judiciaire) for the place where the offence occurred. The advantage is decisive: you control the content.
At the police station
You are heard in haste and under emotional stress. The officer steers the interview with their questions. Your improvised answers are recorded in a report that you sign, and this report is exactly the document the bank exploited in the two cases above. Your complaint is written for you.
By letter to the prosecutor
You (and your lawyer) draft a measured, proofread text that says what needs to be said and nothing more: statement of the facts, identification of the transactions, estimate of the loss, without any self-incriminating detail. You keep the pen.
In practice: address your letter to the public prosecutor at the competent Court of First Instance; set out the facts; identify the disputed transactions; quantify your loss; do not go into the detail of your actions; keep proof of the registered mailing. For the record, filing at the police station sets the investigation in motion a little faster; but with a view to the civil dispute that will pit you against the bank, controlling your account almost always prevails.
And if you have already said too much?
Nothing is necessarily lost. First, the characterisation of gross negligence remains strictly assessed: a clumsy account does not always amount to an admission of serious fault, and the case law clearly distinguishes between situations. Thus, where the victim did not voluntarily part with any security data, the French Supreme Court (Cour de cassation) refuses to find gross negligence in a case of spoofing (Cass. com., 23 October 2024, No. 23-16.267).
Next, a lever often remains underused: the technical security obligations borne by the bank itself under the regulatory technical standards (RTS) supplementing the Payment Services Directive: strong authentication, monitoring of transactions, detection of abnormal patterns. Where these standards have been disregarded, they may ground the bank’s liability, regardless of your behaviour. It is still necessary not to have closed off this discussion yourself through hasty statements. Hence the value of consulting a lawyer before going any further.
Which letter templates should you use?
Here are two templates ready for use: a letter disputing the transactions to be sent to your bank and a complaint to be sent to the public prosecutor. Both apply the rule set out in this article: identify the disputed transactions, ask for redress, and say nothing about the mechanics of the fraud. Replace the items in square brackets and adapt them to your situation. If in doubt, have them reviewed by a lawyer before sending.
Send each letter by registered letter with acknowledgement of receipt and keep a copy. These templates are general outlines; they do not replace personalised advice tailored to the documents in your file.
This guide covers transactions that you did not order. If you yourself requested a transfer to an IBAN supplied by a fake seller, a fake notary or a fake adviser, the legal situation is different and the case law has changed: the French Supreme Court now refuses to characterise this as an unauthorised transaction (Cass. com., 1 July 2026, No. 25-16.014) and the way you describe the facts may close or open avenues of recourse (Cass. com., 20 May 2026, No. 25-14.005). Do not use the templates below as they stand: ask your bank for a recall without waiting, keep the order you transmitted and all exchanges, and consult a lawyer before writing to your bank or filing a complaint.
How to draft the letter disputing the transactions, addressed to the bank?
[Address]
[Postcode City]
Account No. [IBAN / account number]
[Bank, Complaints Department]
[Address of the branch or department]
[City], [date]
Registered letter with acknowledgement of receipt
Subject: Dispute of unauthorised payment transactions, request for reimbursement (Art. L. 133-18 et seq. of the Monetary and Financial Code)
Dear Sir or Madam,
As holder of account No. [number] opened in your books, I formally dispute the following fraudulent transactions:
– on [date], transaction of €[amount], reference [reference], in favour of [beneficiary / merchant];
– [where applicable, other transactions identified in the same way];
which must be regarded as unauthorised transactions within the meaning of Articles L. 133-6 and L. 133-7 of the Monetary and Financial Code. Accordingly, and in accordance with Articles L. 133-18 and L. 133-23 of the same Code, I ask you to reimburse them in full, namely the sum of €[total amount], and to restore my account to the state in which it would have been had these transactions not taken place.
I further ask you to initiate without delay a procedure for recalling the funds (recall) with the institution holding the beneficiary account, in order to attempt to recover the sums wrongly transferred, and to inform me in writing of the follow-up given to this request.
I remind you that it is for you, where appropriate, to prove that these transactions were authenticated, duly recorded and accounted for, and that they were not affected by a technical deficiency.
Failing reimbursement as soon as possible, I reserve the right to bring the matter before the competent courts.
Yours faithfully,
[Signature]
[First name SURNAME]
Enclosure: copy of the statement showing the disputed transactions.
How to draft the complaint to the prosecutor?
Born on [date] in [place]
Residing at [full address]
[Telephone] | [e-mail address]
The Public Prosecutor
Court of First Instance of [city]
[Address of the court]
[City], [date]
Registered letter with acknowledgement of receipt
Subject: Complaint for fraud (escroquerie) and fraudulent banking transactions
Dear Public Prosecutor,
I have the honour to lodge a complaint against person or persons unknown (contre X) for acts committed to my detriment, capable of being characterised as fraud (Article 313-1 of the Criminal Code (code pénal)) and any other characterisation you consider appropriate.
Statement of facts
I am the holder of account No. [number] opened with [bank]. I noticed the following fraudulent transactions:
– on [date], €[amount], [reference / beneficiary];
– [where applicable, other transactions];
which must be regarded as unauthorised transactions within the meaning of Articles L. 133-6 and L. 133-7 of the Monetary and Financial Code.
Loss
My financial loss currently amounts to €[amount], in addition to the costs and inconvenience resulting from these acts.
I remain at your department’s disposal for any useful hearing and to produce all the documents in my file. I ask you to have an investigation carried out in order to identify the perpetrator or perpetrators of these acts, and I state that I reserve the right to join the proceedings as a civil party (partie civile).
Yours faithfully,
[Signature]
[First name SURNAME]
Enclosures: copy of an identity document; statement of the disputed transactions.
You will notice what these two templates do not contain: no account of how the fraud unfolded, no mention of a link you may have clicked, or of a code or key you may have disclosed. It is precisely this restraint that protects your right to reimbursement.
Conclusion
The law places on the bank the burden of proving your gross negligence. Do not hand it that proof yourself. Dispute fraudulent transactions, identify them, and nothing more, both with the bank and in your complaint. Favour the registered letter to the prosecutor, which leaves you the pen. And before any written or oral statement, get support: a poorly drafted complaint or claim can, on its own, make you lose a reimbursement to which the law entitled you.
