Bank Identity Fraud and Refund: Strong Authentication Is Not Enough to Prove the Customer’s Consent (Paris Court of Appeal, Pôle 4 Chamber 9 A, 2 April 2026, No. RG 25/00442)

Paris Court of Appeal, Pôle 4, Chamber 9 A, judgment of 2 April 2026, No. RG 25/00442 (first-instance decision: judge for protection disputes (juge des contentieux de la protection) of the Paris Court of First Instance (tribunal judiciaire), 20 November 2024, No. RG 24/01047)

What Is the Background to This Case: What Happened?

This case illustrates, with almost pedagogical precision, the classic course of a social engineering fraud targeting bank customers. It pits a BNP Paribas customer, the holder of a joint account with her husband and of a business account, against her bank, which refused her any refund after she fell victim to a sophisticated scam.

The Chronology of the Trap: Text Message, Telephone Call and Fraudulent Validation

It all begins on the afternoon of 15 February 2023. The customer receives a text message in the name of Chronopost informing her that an error occurred during the delivery of her parcel and that €1.46 is missing to complete the delivery. The message contains a link to the website “colis-suivis.info”. An important detail: she was indeed expecting a parcel for her son. The text message contains no spelling mistakes and no apparent anomalies. She clicks on the link and enters her bank card number.

That same evening, she receives a telephone call from a person introducing himself as a BNP Paribas adviser. This person tells her that her account has been hacked, that fraudulent transfers have been made, and offers to help her “stop” them (faire opposition). To do so, he simply asks her to validate, via her digital key installed on her telephone, several notifications that are sent to her, explaining that these are requests to stop the fraudulent debits. She complies, convinced that she is acting in her own interest.

In reality, she has just authorised three fraudulent payments: €3,500, then €3,170.77 from her business account, and finally €1,371.37 from her joint account. Total loss: €8,042.14.

The Bank’s Refusal to Refund and the Court Action

On 20 February 2023, five days after the events, the customer challenges the transactions with her bank. BNP Paribas refuses a first time on 20 February, then confirms its refusal on 1 March 2023, citing the customer’s gross negligence. Faced with this double refusal, the customer sues the bank in January 2024. The judge for protection disputes of the Paris Court of First Instance finds in her favour in November 2024 and orders BNP Paribas to refund her €8,042.14, together with an order to pay €500 for non-material harm. The bank appeals. The Paris Court of Appeal gives its judgment on 2 April 2026: it upholds the refund but overturns the order for non-material harm.

What Is the Legal Framework Applicable to Fraudulent Payments?

To understand why the bank lost, one must grasp the logic of the statutory regime governing unauthorised payments. This regime, derived from the Monetary and Financial Code (code monétaire et financier), sets out in precise terms how responsibilities are allocated between the bank and its customer.

The Bank’s Obligations: Authentication and Refund

Articles L. 133-16 to L. 133-23 of the Monetary and Financial Code impose a demanding framework on the bank. It must first ensure that its customers’ personalised security data are not accessible to third parties. It must put in place free means enabling the customer to block their payment instrument. And above all, where a customer disputes a transaction, the law places a particularly heavy burden of proof on the bank.

Article L. 133-23 is fundamental here: where a customer denies having authorised a transaction, it is for the payment service provider to prove that the transaction was authenticated, duly recorded and accounted for, and that it was not affected by a technical deficiency. But the law goes further: even if the bank proves authentication, this is not enough to show that the customer authorised the transaction, or that they committed fraud or gross negligence. The bank must provide additional evidence to establish either of these.

Where an unauthorised transaction has been duly reported, Article L. 133-18 of the Monetary and Financial Code requires the bank to refund the customer immediately, and at the latest by the end of the first business day following the challenge. It should be noted that the source decision also cites Article L. 133-19 for the conditions under which the bank is exonerated in the event of the customer’s gross negligence.

The Customer’s Obligations: Reasonable Vigilance and Prompt Reporting

The customer is not exempt from obligations. Article L. 133-16 requires them to take all reasonable measures to preserve the security of their personalised security data. Article L. 133-17 requires them to notify their bank without delay as soon as they become aware of an unauthorised use of their payment instrument.

It is on these obligations that the bank sought to build its defence, arguing that its customer had committed “gross negligence” on two occasions: by disclosing her banking details on a fraudulent website, and then by validating transactions that she knew she had not initiated.

What Is Gross Negligence and How Did the Court Assess It?

This is the heart of the dispute and the point on which the decision is most instructive. The notion of gross negligence, within the meaning of Article L. 133-19 of the Monetary and Financial Code, is decisive: if it is established, the customer bears all the losses arising from the unauthorised payments. If it is not, the bank refunds.

The court relies in particular on a judgment of the French Supreme Court (Cour de cassation) of 23 October 2024, cited by both parties, which holds that no gross negligence can be attributed to an account holder who, contacted by telephone by a person posing as an employee of their bank whose number was displayed, uses the personalised security mechanism at that person’s request to carry out transactions in order to prevent malicious acts. This case law is directly transposable to the facts of the present case.

The Chronopost Text Message: Could It Reasonably Have Been Detected as Fraudulent?

The bank argued that phishing risks are known to the general public and that the customer should have been wary. The court dismisses this argument with a concrete analysis of the text message received. The message, worded “Chronopost: an error occurred during the delivery of your parcel follow the instructions in order to complete the delivery: https://.colis-suivis.info/” (in the French original: “Chronopost : une erreur est survenue lors l’acheminement de votre colis suivez les instructions afin d’achever la livraison”), contains no spelling mistakes. The customer was indeed expecting a parcel for her son. In these circumstances, the court concludes that this response to the text message “shows conduct consistent with that of a reasonably attentive user” and that she “therefore committed no gross negligence” at this stage. The fraudulent nature of the text message is, moreover, confirmed only after the event: no debit of €1.46 appears on her accounts.

The Spoofing Call: Building Trust as a Ground for Exoneration

The court’s reasoning on the fraudulent telephone call is particularly finely articulated. It notes that the caller reminded the customer of her personal details (which created a sense of legitimacy), alerted her to a hacking in progress (which created a context of urgency), and made no unusually suspicious request: he simply asked her to confirm, using her digital key, “stop requests against fraudulent debits”. The court takes care to note that, contrary to what the bank argued, the customer was never asked to disclose her confidential data (card numbers, secret codes): she simply used her usual authentication tool, believing that she was protecting her account.

This is a point of capital importance: the fraud was designed so as never to arouse the suspicions of an ordinary user. The fraudster did not behave like the stereotypical image of fraudsters; he mimicked exactly the behaviour of a legitimate bank adviser dealing with a customer who had just been “hacked”. In this context, the court holds that “her vigilance was weakened, preventing her from doubting the sincerity of her interlocutor”.

The Digital Key: A Strong Authentication Tool That Does Not Prove Fault

BNP Paribas emphasised that the customer had validated the three transactions via her digital key (a strong authentication system installed only on her personal telephone) and that these validations made the transactions “irrevocable”. The court categorically rejects this argument. It recalls that the law itself, in Article L. 133-23 of the Monetary and Financial Code, specifies that “the sole use of the payment instrument as recorded by the payment service provider is not necessarily sufficient in itself to prove that the transaction was authorised by the payer or that the payer failed, intentionally or through gross negligence, to meet the obligations incumbent upon them”.

In other words: the fact that the customer physically pressed “validate” in her application does not allow the bank to infer that she freely and knowingly authorised a payment. Consent vitiated by manipulation by a third party is not legally valid consent.

The Bank’s Awareness Campaigns: Insufficient and Not Proven

The bank had produced alert emails that it claimed to have sent to its customer, in order to show that she had been informed of the risks of phishing. The court dismantles this reasoning in two stages. First, it notes that these emails were addressed to a recipient whose name had been masked, and that the email addresses used (Gmail and Orange) did not correspond to the Hotmail address used by the customer in her dealings with the bank. It is therefore not shown that these alerts were in fact sent to her. Second, the court recalls that “general-purpose awareness campaigns” cannot suffice to establish the gross negligence of an individual customer. The bank should have demonstrated a personalised and effective warning.

It also rejects the argument based on the five-day delay in reporting the fraud, taking the view that such a delay is compatible with the time needed to consult one’s account statements and realise that fraudulent transactions had taken place.

Why Were Damages for Non-Material Harm Refused?

While the Court of Appeal upholds the refund of the fraudulent sums, it overturns the order requiring the bank to pay €500 in damages for non-material harm (préjudice moral), made at first instance.

The reasoning here is different. The court first recalls that the liability regime of payment service providers (Articles L. 133-18 to L. 133-24 of the CMF) is the reference framework for disputes relating to unauthorised payments. To obtain additional damages on the basis of ordinary contractual liability, a separate fault on the part of the bank must be shown, going beyond the mere framework of the refund of the fraudulent payment.

The customer, however, relied on the “particularly unpleasant” conduct of the bank’s employees, who allegedly treated her as a “deliberate fraudster”. But the court notes that she herself produces an email from her bank adviser who defended her to her superiors and insisted that she be refunded. The bank’s wrongful conduct is therefore not established. Likewise, the non-material harm alleged (the trauma suffered, the impossibility of going on holiday with her children) is not considered sufficiently established and proved to justify additional compensation.

This point illustrates an important limit of the current case law: while the refund of the misappropriated sums is well protected, obtaining compensation for the non-material harm allegedly caused by the bank’s attitude remains a difficult exercise, requiring the demonstration of a separate fault and of concrete, established harm.

What Is the Impact of This Decision for Victims of Bank Fraud?

This judgment forms part of a coherent line of case law protecting bank customers who are victims of social engineering. It confirms and clarifies several essential principles.

First, the sophistication of the fraud is a central factor in the assessment. The more elaborate the modus operandi (a text message without mistakes, the bank’s number displayed, a reassuring manner, no unusual requests), the less reasonable it is to expect an ordinary user to detect it. Gross negligence cannot be established by the mere fact of having been deceived by a fraud that even professionals struggle to identify.

Second, the burden of proof is a shield for the customer. It is for the bank to prove gross negligence, not for the customer to prove their innocence. And this proof cannot be reduced to the technical recording of an authentication: it must go further.

Third, IP connections are a valuable indicator. The court notes the existence of foreign IP connections (Morocco, United Arab Emirates) at the time of the fraud, while the customer was in France, a fact that the bank adviser herself had confirmed in writing. This geographical anomaly, which the bank’s fraud detection systems should have identified, strengthens the conviction that the account was indeed used by malicious third parties.

Finally, this judgment reminds banks that they cannot discharge their liability by invoking generic awareness campaigns if they are unable to prove that personalised alerts were in fact sent to the customer concerned, at the correct address.

Conclusion

The judgment given on 2 April 2026 by the Paris Court of Appeal is a reference decision for anyone who is the victim of a bank fraud by spoofing. It clearly recalls that the bank’s liability is engaged where it fails to demonstrate its customer’s gross negligence, and that this demonstration cannot rest on the technical recording of a strong authentication alone.

Faced with increasingly sophisticated frauds that exploit not IT security flaws but human beings’ instinctive trust, French banking law lays down a protective principle: it is for the bank, as a professional in payment security, to bear the risk linked to frauds that it fails to prevent or detect. The presence of foreign IP connections at the time of the fraud, which BNP Paribas’s own fraud department had identified, perfectly illustrates the information asymmetry between the customer and the bank: the bank knew, or ought to have known.

If you are in a similar situation (a spoofing fraud, a refusal by your bank to refund you), this decision gives you solid arguments to take action. The assistance of a lawyer specialising in banking law will allow you to assess your chances and build a robust case, in particular by reconstructing the chronology of events, documenting connection anomalies and demonstrating the absence of gross negligence on your part.

FAQ: Frequently Asked Questions