Bank Liability and the Recall Procedure: What Compensation for a Fraudulent Transfer? (CA Bordeaux, 1st Civ. Ch., 23 February 2026, No. 23/05381)

Bordeaux Court of Appeal, 1st Civil Chamber, 23 February 2026, No. 23/05381

What Was the Background to This Transfer Fraud?

On 9 February 2022, the company Garage [Q], which operates a car garage, placed an order for a second-hand vehicle with the company Alphabet Francefleet, its usual supplier. The following day, 10 February 2022, the garage made a transfer of €16,126 from its bank account held with Banque Populaire Aquitaine. To carry out this transaction, the company entered the IBAN shown on the purchase order it had received, logging in to its online customer area and validating the transaction with its bank card and confidential code.

Everything appeared to proceed normally until 15 February 2022, when the bank contacted the garage to warn it of a suspected fraudulent transfer. After checking, it turned out that the IBAN entered did not match that of the company Alphabet Francefleet. The garage had in fact been the victim of a fraud involving the interception and alteration of its email: malicious individuals had hacked its mailbox and replaced the genuine purchase order sent by Alphabet with a fake document in which the bank details had been altered.

On the same day, 15 February 2022, the garage filed a criminal complaint for fraud (escroquerie). On 4 March 2022, almost three weeks after the initial transfer order, a partial return of funds occurred: €108.50 was refunded from an account in the name of a private individual. On 4 November 2022, the bank informed its customer that a “RECALL” request (a request for the return of the funds) had been rejected on 21 February 2022.

In this situation, the garage sued Banque Populaire Aquitaine for liability, considering that it should have detected the anomaly more quickly and acted with greater diligence to recover the fraudulently diverted funds.

By judgment of 7 November 2023, the Court of First Instance (tribunal judiciaire) of Bordeaux ordered Banque Populaire Aquitaine to pay the garage €15,857.32 in damages, considering that it had breached its duty of vigilance. The bank appealed against that decision, disputing any legal obligation to check the payment order and arguing that it had acted promptly as soon as it discovered the fraud.

What Are a Bank’s Legal Obligations When Executing a Transfer?

In this decision, the Bordeaux Court of Appeal restates the fundamental principles governing a bank’s obligations when executing payment orders. These principles rest on a delicate balance between the obligation to carry out the customer’s orders and respect for the customer’s commercial autonomy.

The Principle of Non-Interference in the Customer’s Affairs

The bank holding the account is required to execute the transfers its customer instructs, provided that several conditions are met: the order must be regular, the payer must have been identified, the payer must actually have given consent, and the account must hold sufficient funds.

On the other hand, the court recalls an essential principle of banking law: because the banker is bound not to interfere in its customer’s affairs, it does not, in principle, have to carry out investigations or request supporting documents to satisfy itself that the transactions requested of it are regular, not dangerous for its customer, or not liable to harm a third party.

In the present case, the court finds that at the time the transfer was executed on 10 February 2022, the payment order showed no readily detectable anomaly and no apparent sign of forgery. The garage had itself entered the beneficiary’s IBAN in its online banking area and then validated the transaction by entering its bank card with its confidential code.

The diagram below illustrates the conditions for the normal execution of a bank transfer:

The Exclusive Application of the Special Regime of the Monetary and Financial Code

A crucial legal point raised by this decision concerns the applicable liability regime. The garage had initially based its claim on breach of a contractual duty of vigilance, relying on Article 1231-1 of the Civil Code (code civil), which governs ordinary contractual liability.

The Court of Appeal rejects this argument, recalling that Article L. 133-21 of the Monetary and Financial Code, applicable on the date of the facts (10 February 2022), establishes a special and exclusive liability regime for payment transactions. This special regime excludes the application of the ordinary rules of contractual liability.

The company Garage [Q] had relied on Article L. 133-10 of the Monetary and Financial Code, which the bank pointed out does not exist, illustrating the complexity of the legal framework applicable to payment services.

An essential consequence of this special regime: a payer who has given their payment service provider an erroneous payment order, whether the error originates from the payer themselves or from a fraud committed by a third party, cannot in principle bring a claim based on a lack of vigilance on the part of the payment service provider in order to obtain compensation for the loss suffered.

Can the Bank Be Held Liable Despite Having No Legal Obligation to Check?

If the bank has no legal obligation to check that the IBAN entered matches the beneficiary’s identity, can its liability nonetheless be engaged? That is the whole issue in this dispute, and the Bordeaux Court of Appeal gives a nuanced answer based on the distinction between the initial obligation and the obligations that follow a voluntary detection of an anomaly.

When Voluntary Detection Creates an Obligation

The court notes a decisive factual element: it was the bank itself that, on 15 February 2022, five days after the payment order, informed its customer by email of a suspicion of fraud concerning the identity of the IBAN used. This voluntary verification step, although not mandatory, gives rise to specific obligations for the bank.

The court sets out an important principle: “A bank which, although not subject to a duty of vigilance, decides to carry out further checks and to initiate the recall procedure cannot be criticised for its late check, 5 days after the order was placed, having thus been unable to obtain the funds through the recall procedure.”

In other words, the bank cannot be penalised for having detected the anomaly after a certain delay, since it was not required to carry out that check. However, the court immediately adds: “If the bank had no obligation to carry out this check, it could nevertheless not leave this suspicion, once discovered, unaddressed by a recall procedure.”

This distinction is fundamental: it preserves the principle of non-interference (the bank does not have to check orders systematically), while penalising passivity once a legitimate suspicion has been identified by the bank itself.

The Recall Procedure: A Crucial Mechanism

The “recall” procedure, or recall of funds, is the mechanism by which an attempt is made to recover sums transferred fraudulently. It is a request sent by the originating bank to the beneficiary’s bank to obtain the return of the funds.

This procedure has several important characteristics that the court recalls:

First, for the recall procedure to be effective, the return of the funds presupposes that the beneficiary account still holds sufficient funds on the day of the request. If the fraudsters have already withdrawn or transferred the funds, the procedure becomes ineffective. This is why speed of execution is decisive.

Second, the beneficiary (in this case, the fraudster) must expressly consent to the return. The beneficiary’s bank has 15 days to give a positive or negative answer to the request for the return of the funds.

Third, as the court emphasises, “a request for the recall of funds made late after the disputed payment transaction was illusory”, given the time left to the fraudsters to empty the account.

Who Must Prove the Bank’s Diligence in the Recall Procedure?

An essential procedural aspect of this decision concerns the allocation of the burden of proof. Who must show that the recall procedure was carried out properly and promptly?

The Court of Appeal answers this question clearly: “The burden of proving that the recall procedure was actually carried out lies with the bank holding the funds.”

This solution is logical: it is the bank that holds all the evidence concerning its dealings with the beneficiary’s bank. The customer who is the victim of the fraud has no means of knowing the content of the interbank exchanges or of checking whether the procedure was implemented quickly and effectively.

In the present case, the court notes that “the payment service provider produces neither the recall request nor the response given by the beneficiary’s bank, merely asserting that it received a negative answer on 21 February 2022.”

This evidential failing is all the more problematic because the chronology raises questions: the bank claims to have received a negative response on 21 February 2022, only 6 days after detecting the fraud on 15 February. Yet a partial refund of €108.50 occurred on 4 March 2022, more than 15 days after it learned of the suspected fraud.

The court infers that the bank “has failed to discharge the burden of proof incumbent on it”, which prevents it from ruling out “the culpable inaction that characterises its duty of vigilance.”

This legal reasoning is important: in the absence of proof of diligence, a presumption of culpable inaction applies. The bank cannot simply assert that it acted promptly; it must demonstrate this through objective evidence: a copy of the recall request, an acknowledgement of receipt from the beneficiary’s bank, its formal response, and so on.

How Is the Loss Assessed Where There Is a Loss of a Chance?

The assessment of the loss is the most delicate aspect of this case. The court of first instance had ordered the bank to pay €15,857.32, almost the entire loss suffered (€16,126 of the initial transfer less the partial return of €108.50, i.e. €16,017.50), which represented approximately 99% of the loss.

The Court of Appeal partially overturns the judgment, substantially revising the assessment of the loss on the basis of the notion of “loss of a chance”.

The court considers that the bank’s “culpable inaction” “appears to be in a direct and certain causal relationship with the deprivation, for the company Garage [Q], of the possibility of obtaining the return of the funds available on the day of the request, which constitutes a loss of a chance.”

This legal characterisation is essential: the bank’s fault did not directly cause the total loss of the funds (the fraud is the cause of that), but it caused the garage to lose a chance of recovering all or part of the sums through the recall procedure.

To assess this loss of a chance, the court takes into account “the low probability for the company Garage [Q] of having the funds returned 5 days after the payment order was placed, where that delay is not attributable to any culpable conduct on the part of the bank.”

This reasoning incorporates several factors:

First, the five days that elapsed between the transfer (10 February) and the bank’s detection (15 February) cannot be held against the bank, since it had no obligation to carry out an immediate check.

Second, those five days allowed the fraudsters to begin emptying the beneficiary account, mechanically reducing the chances of recovery.

Third, even with an immediate recall procedure on 15 February, nothing guaranteed that the funds would still be available or that the (fraudulent) beneficiary would agree to the return.

In light of these elements, the court assesses the loss of a chance at 20% of the total loss, i.e. €3,203.50 (20% of €16,017.50). This assessment, although partly arbitrary like any assessment of a loss of a chance, reflects a reasonable probability of recovery had the recall procedure been carried out immediately on 15 February 2022.

This 20% assessment may seem harsh for the victim, but it reflects the statistical reality of the chances of success of a recall procedure in a context of organised fraud, even when it is carried out promptly.

What Practical Lessons Can Be Drawn From This Decision?

This decision of the Bordeaux Court of Appeal offers several important practical lessons, both for bank customers and for banks themselves.

For businesses and individuals who are victims of transfer fraud:

The judgment confirms that one should not count on the bank to systematically detect anomalies in payment orders. The principle of non-interference protects banks from a general obligation of verification. Vigilance must therefore be exercised beforehand, when the bank details are entered.

A few essential precautions: systematically check bank details received by email by calling the supplier directly on a known telephone number (not the one shown on the suspicious document), be wary of any change of bank details communicated by email, and put in place double-validation procedures for large transfers.

If fraud is suspected, it is crucial to act immediately: contact your bank by telephone as soon as you discover the anomaly (do not rely on an email alone), expressly request a recall procedure and state that it is urgent, file a complaint with the police or gendarmerie the same day, and keep all evidence (fraudulent emails, falsified purchase order, etc.).

For banks:

The decision recalls that while the bank has no general obligation to check payment orders, it cannot remain passive once it has itself detected an anomaly. This voluntary detection gives rise to a duty of diligence in handling the suspicion.

In practical terms, if a bank identifies a risk of fraud on a transaction already executed, it must: inform its customer immediately (which was done in this case), initiate the recall procedure with the beneficiary’s bank without delay, keep all supporting documents for this step (request, acknowledgement of receipt, response), and inform the customer of the outcome of the procedure within a reasonable time.

The judgment underlines the crucial importance of the burden of proof: the bank must be able to show that it acted diligently. A mere assertion is not enough; supporting documents must be produced. This evidential requirement is particularly important in litigation.

Interplay between the bank’s liability and the criminal liability of the fraudsters:

The appellant had raised an interesting argument: since the garage had filed a criminal complaint for fraud, can it obtain “double compensation” by also seeking the bank’s civil liability?

The court does not dwell on this argument, because the two courses of action are not mutually exclusive. The criminal complaint aims to identify and punish the perpetrators of the fraud, whereas the civil liability claim against the bank rests on a distinct legal basis (breach of a duty of diligence). There is no double compensation, since the losses compensated are different: on the one hand the loss caused by the fraud itself, on the other the loss of a chance caused by the bank’s inaction in the recall procedure.

In practice, the chances of recovering the funds from the fraudsters are often minimal, as they frequently operate from abroad under false identities. A claim against the bank, although limited to the loss of a chance, therefore sometimes constitutes the only realistic route to partial compensation.

Conclusion

This decision of the Bordeaux Court of Appeal of 23 February 2026 illustrates the difficult balance between the principle of the bank’s non-interference in its customer’s affairs and the need to protect victims of increasingly sophisticated frauds.

By confirming that the bank has no legal obligation to systematically check that the IBAN entered matches the beneficiary’s identity, the court preserves customers’ autonomy in managing their banking transactions. This position falls within the special regime of the Monetary and Financial Code, which excludes the application of the general rules of contractual liability.

However, by penalising the bank’s inaction after it had itself detected an anomaly, the court introduces a conditional duty of diligence: if the bank voluntarily chooses to carry out checks, it must then deal effectively and promptly with the suspicions identified through a recall procedure. This obligation comes with a burden of proof that rests on the bank.

The assessment of the loss of a chance at 20% of the total loss reflects a realistic approach to the probability of success of a recall procedure initiated five days after the fraudulent transfer. It is a reminder that the best protection remains the preventive vigilance of customers themselves, who must systematically check bank details before making a transfer, particularly when they are communicated electronically.

The court mentions that the applicable legal regime may evolve, but does not specify how this potential evolution would take place. It is likely that case law will continue to adapt to new forms of fraud, leading to a gradual increase in the responsibility of banks for the prevention and detection of transfer fraud.

FAQ: Frequently Asked Questions