Your bank must refund you first, and argue afterwards. A fraudster has emptied your account, you told your bank, and it replies that you were “grossly negligent”: no refund. Tens of thousands of people receive this answer every year. Since 15 October 2026, the Court of Justice of the European Union (CJEU) has said that this answer does not comply with European law: when a transaction was not authorised by the customer, the bank must refund first. If it believes the customer was negligent, it is up to the bank to prove it before a judge, after having refunded. This article explains, without jargon, what the Court decided, why this may allow you to get your money back in a few weeks rather than in a few years, and in which cases this works and in which cases it does not.
1. What the Court of Justice decided
The story of an online sale
It all starts in Poland. A woman puts an item up for sale on an auction website. A supposed buyer sends her a link to “confirm the sale”. The link takes her to a page that looks in every respect like her bank’s website; she types in her login details, then a code received by text message. A few minutes later, a transfer of about 700 euros leaves for an unknown account. She warns her bank the very next day. The bank refuses to refund her: in its view, the customer was grossly negligent in handing over her codes. Nobody disputes that the transaction was carried out by a fraudster; the only debate is whether the customer was careless, and whether that carelessness allows the bank to keep the money.
Two provisions that seemed to contradict each other
The rules that protect bank customers in Europe come from a 2015 directive on payment services, which France copied into its Monetary and Financial Code (Code monétaire et financier). Two articles of this directive seemed to contradict each other. The first (Article 73, in France Article L. 133-18) says that if a customer reports a transaction that he or she did not authorise, the bank must refund the customer “immediately”, and at the latest by the end of the following business day. It provides for only one exception: if the bank has “reasonable grounds for suspecting fraud” by the customer himself or herself, and provided that it reports this in writing to the supervisory authority, in France the Banque de France. The second (Article 74, in France Article L. 133-19) begins with the words “by way of derogation” from the first, and says that the customer bears all losses if he or she acted with gross negligence (négligence grave). Banks read this “by way of derogation” as a second exception: if the customer was negligent, no refund at all. Customers saw something else: the bank refunds, then, if it thinks the customer was negligent, it claims the money back from the customer. The Polish court put the question to the Court of Justice, making a remark that says it all: in practice, banks never sue their customers for negligence, it is customers who sue banks; “the application of the exceptions to the right to a refund has become the rule” [1].
The bank refunds “immediately”, at the latest by the end of the following business day
Only one exception: reasonable grounds for suspecting fraud by the customer, reported in writing to the Banque de France
“By way of derogation”: the customer bears all losses if he or she was grossly negligent
Banks’ reading: no refund at all. Customers’ reading: the bank refunds, then claims the money back
The answer: one exception, not two
The Court rules in favour of the second reading. A bank “cannot refuse to refund immediately” an unauthorised transaction “on the ground that the payer made that transaction possible through gross negligence”. Its reasons come down to a few sentences. The text provides for only one exception, suspicion of fraud reported in writing, and another cannot be added. The two articles do not deal with the same thing: one says who must pay straight away, the other says who bears the loss in the end. It is for the bank to prove the customer’s negligence; yet a bank that keeps the money in the meantime becomes the judge of its own evidence. Finally, if the refund could wait until the end of a trial, the protection intended by Europe would exist only on paper [1].
It is important to be precise about what the judgment does not say. It does not say that a negligent customer will always be refunded in the end. It says that the bank must refund first, then, if it considers that the customer was grossly negligent, sue the customer and prove it before a judge. Gross negligence still exists; it has simply moved. It used to be at the entrance, as a ground for refusing to pay; it is now at the exit, as an argument for recovering the money afterwards.
2. Why this changes things in practice in France
The law was already written, but practice had turned it upside down
French law says exactly the same thing as the directive. Yet in practice, banks refused to refund by invoking negligence, and it was up to the customer to go to court. An ordinary trial, what is called proceedings “on the merits” (procédure au fond), generally lasts two to three years. For all that time, the money stays with the bank.
There is, however, a fast procedure: summary proceedings (référé). A judge can, within a few weeks, order someone to pay a sum as an interim payment (provision) when the debt “is not seriously contestable”; the judge can also order an end to a “manifestly unlawful disturbance” (trouble manifestement illicite), that is to say an obvious breach of a rule of law [2]. In theory, a refusal to refund an unauthorised transaction should have fallen within this procedure. In practice, it was almost closed. All the bank had to do was say “the customer was negligent” for the summary-proceedings judge to answer, in substance: the question is too complicated for me, go to the merits court. Of seventeen summary-proceedings decisions issued in France on this subject since 2017, nine refused the refund, most often for this reason. Some courts resisted: in Lyon, in Bourges, in Montpellier, courts of appeal granted interim payments, ruling that it was for the bank to prove negligence, and that it did not do so [3]. But in Paris, where cases are concentrated, referral to the merits was the rule [4]. A Paris court of appeal even approved, in 2024, a surprising practice: a bank had refunded a couple who were victims of a fake courier, then, three weeks later, had taken the money back from the account by invoking their negligence [5]. This is exactly what the Court of Justice has just prohibited.
Negligence is no longer an argument before the summary-proceedings judge
The reasoning is simple. If gross negligence does not allow the bank to refuse to refund, it cannot be used either to say that the debt is “seriously contestable”. The summary-proceedings judge therefore no longer has to ask whether the customer was negligent. The judge has three things to check: was the transaction made without the customer’s authorisation? Did the customer report it without delay, and at the latest within thirteen months? Did the bank report to the Banque de France in writing a suspicion of fraud by the customer? If the answers are yes, yes, no, the bank must refund, and the summary-proceedings judge can compel it to do so. The bank keeps the right to then bring proceedings against its customer for negligence, but it will be for the bank to do so, and after having paid.
Two practical pieces of advice follow. First, report the transaction by a means that leaves a trace (email, registered letter, message in the customer area), because the Court of Cassation has ruled that a customer who cannot prove the date of the report loses the right to a refund [6]. Second, ask for the penalties: the law provides that the sums due bear interest at the statutory rate increased by 5 points, then by 10 points after seven days, then by 15 points after thirty days, from the date of the report [7]. Few victims know this.
3. The condition: the transaction must be clearly “unauthorised”
Everything above applies only to unauthorised transactions. This is therefore where banks will now take the fight: instead of saying “you were negligent”, they will say “you authorised the transaction”. It is therefore necessary to know how to distinguish the cases where that discussion is impossible from those where it remains open.
- Your phone or your card was stolen
- The fraudster acted from his or her own device
- The order did not go through the agreed channel
- There was no strong authentication
- The bank itself admitted the facts
Summary proceedings can get you refunded within a few weeks
- You validated it yourself, over the phone, with a fake adviser
The debate will concern your consent and the bank’s evidence
The cases where there is nothing to argue about
Your phone or your card was stolen. A transaction made by a thief is, by definition, not authorised. Some banks tried to argue the opposite because the code had been entered; the courts of appeal replied that the transactions were “unauthorised since they followed a theft”, and that entering a code does not prove that it was you who entered it [8]. Be careful, however: in these cases, negligence is often found in the end, for example if you waited two days to block the card. Summary proceedings will get you refunded, but the bank may then claim the losses back if it proves this negligence.
The fraudster acted from his or her own device. When the validation code was received “on a device other than” yours, you did not authorise the transaction, full stop [9]. When transfers were validated from an internet address and a mobile operator that are not yours, or from five unknown addresses after your phone was stolen, the bank does not even manage to clear the first step that the law imposes on it: proving that the transaction was properly authenticated and that there was no technical failure. And as long as it has not cleared this step, the question of your negligence does not even arise [10].
The order did not go through the agreed channel. A company had agreed with its bank that transfers would go through a secure computer protocol. A swindler sent an order by fax, with an imitated signature, and the bank executed it. The Court of Cassation ruled that the bank, which had accepted an order through a channel that had not been agreed, could not accuse its customer of gross negligence [11].
There was no strong authentication. Since 2019, for any remote transaction, the bank must require two independent proofs of your identity, for example a password and a validation on your phone. If it did not do so, the law is unequivocal: you bear no loss, even if you were negligent [12]. This is the case most favourable to summary proceedings. And it is for the bank to prove that it did require this authentication, with genuine technical logs, not a simple “OK” entry in a table [13].
The bank itself admitted the facts. A bank that refunded and then took the money back, or that writes in its pleadings that it “never argued” that you had ordered the transactions, will struggle to say the opposite before the summary-proceedings judge [14].
The case that remains disputed: the fake adviser
This is the most frequent scenario today. You receive a call; the number displayed is your bank’s; your caller introduces himself or herself as your adviser or as the anti-fraud department, explains that an attack is under way, and asks you to validate in your app transactions that he or she presents as cancellations or “securing” operations. You validate. The money leaves. Here, it is you who pressed the button, and the bank will say that you consented.
What do the judges say? The Court of Cassation has issued three important judgments on the fake adviser [15]. In all three, it ruled only on the question of negligence: it did not say whether the transaction was authorised or not. This must be stated clearly, because the opposite is often read. In these cases, the bank had not disputed that the transaction was unauthorised, because it had chosen to plead negligence, or had disputed it unsuccessfully, because it produced no technical evidence and the history showed that the beneficiaries had been created under an identifier that belonged to no user of the company [16].
On the question itself, the Court of Cassation laid down two rules in 2025 and 2026. First rule: the fact that your code was used “is not necessarily sufficient” to prove that you authorised the transaction, and a judge who deduces your consent from the use of the code reverses the burden of proof [17]. In other words, authenticating is not authorising. Second rule: a judge cannot say that your consent is “not seriously contestable” without checking that the bank proves it [18]. Several courts have drawn the conclusion that a transfer validated under the influence of a fake adviser is an unauthorised transaction, because consent was extorted by deception [19].
But other judges have said the opposite: if you validated with your strong authentication, the transaction is authorised, and the only remaining question is whether the bank breached its duty of vigilance, which is much harder to establish [20]. Two Paris summary-proceedings judges reasoned in this way [4]. And for businesses, it is even more delicate: the law allows banks to insert into professional contracts a clause under which any transaction validated with the security device is presumed to come from the customer, and a court of appeal applied such a clause in 2026 [21].
What will make the difference: the bank’s evidence
In this last case, everything will depend on the evidence. If the bank argues that you authorised the transaction, it is for the bank to prove it. The summary-proceedings judge is entitled to look at what it produces. A bank that merely asserts that it uses a system “compliant with regulations”, with generic screenshots or an unexplained table, should not raise a serious doubt: the courts already reject such documents as insufficient. By contrast, a bank that produces complete logs (session identifier, device, internet address, time of each validation, text of the notifications sent) will probably obtain a referral to a trial on the merits, because the question of whether your validation, in those conditions, amounts to consent has not been settled.
4. What banks will reply
“We suspect fraud.” This is the only exception the law leaves them, and some will be tempted to abuse it. But it requires “reasonable grounds” for suspecting fraud by the customer himself or herself, not mere carelessness, and a written report to the Banque de France, which the bank will have to show to the judge. A purely formal report, made after the fact, should not be enough.
“You authorised the transaction.” This is the main battleground, explained above. It makes it necessary to prepare the summary proceedings by asking the bank, from the time of the complaint, for the technical logs of the transaction, and by relying on their absence.
“You reported it too late.” The thirteen-month period concerns the report, not the lawsuit: if you reported within thirteen months, you can bring proceedings within the ordinary five-year period [22]. But reporting “without delay” remains an obligation, and a delay may be held against you as negligence, but after the refund, not before.
“We ask that you pay us the losses.” The bank can bring this lawsuit. But the summary-proceedings judge cannot award it a sum that depends on a discussion of the merits, nor set off your refund against a disputed claim. The two procedures will follow separate paths. This is precisely the order that the Court of Justice wanted to restore.
In summary
The judgment of 15 October 2026 does not put you in the right in advance. It puts things back in order: when a transaction was not authorised, the bank refunds, then argues. If your phone was stolen, if the fraudster operated from a device that was not yours, if the order went through a channel that had not been agreed, if the bank did not require strong authentication, or if it itself admitted the facts, the summary-proceedings judge can get you refunded within a few weeks. If you validated the transaction yourself over the phone with a fake adviser, the debate will concern your consent, and it will be decided on the technical evidence that the bank is able to produce. In every case, gross negligence has not disappeared; it has become what it should always have been: an argument that the bank puts forward before a judge, after having refunded, and not a decision that it takes alone.
Notes
[1] CJEU, 1st ch., 15 Oct. 2026, Case C-70/25, https://curia.europa.eu/juris/liste.jsf?num=C-70/25
[2] Code of Civil Procedure (Code de procédure civile), Art. 835 (paras. 1 and 2) and 873; Monetary and Financial Code, Art. L. 133-18.
[3] Court of Appeal of Lyon, 22 March 2023, No. 22/03169 ; Court of Appeal of Bourges, 16 Dec. 2021, No. 21/00664 ; Court of Appeal of Montpellier, 7 May 2025, No. 24/02637 ; Court of Appeal of Paris, 11 Oct. 2018, No. 17/23273.
[4] Judicial Court (tribunal judiciaire) of Paris, summary proceedings, 13 Sept. 2024, No. 24/02938 ; 16 Oct. 2024, No. 24/51043 ; 29 Nov. 2024, No. 24/04700 ; 26 May 2025, No. 25/50258 ; 29 Jan. 2026, No. 25/05203 ; Court of Appeal of Paris, Division 1, Ch. 3, 12 Dec. 2023, No. 23/09290.
[5] Court of Appeal of Paris, Division 1, Ch. 8, 4 Oct. 2024, No. 24/02086.
[6] Cass. com. (Court of Cassation, commercial chamber), 4 Feb. 2026, No. 22-22.609, https://www.courdecassation.fr/decision/6983561bcdc6046d47e18e11
[7] Monetary and Financial Code, Art. L. 133-18, para. 2.
[8] Court of Appeal of Rennes, 26 May 2026, No. 24/00645, https://www.courdecassation.fr/decision/6a167ceccdc6046d4710ab2d ; Court of Appeal of Paris, 16 Apr. 2026, No. 25/07690.
[9] Judicial Court of Nice, 10 Feb. 2026, No. 24/00689.
[10] Judicial Court of Paris, 19 Sept. 2025, No. 25/01965 ; Court of Appeal of Paris, 2 July 2026, No. 25/11923, https://www.courdecassation.fr/decision/6a47f2d493c619cd1f46e4fb ; Cass. com., 20 Nov. 2024, No. 23-15.099.
[11] Cass. com., 8 Oct. 2026, No. 25-17.510.
[12] Monetary and Financial Code, Art. L. 133-19, V ; Cass. com., 30 Aug. 2023, No. 22-11.707 ; 22 Oct. 2025, No. 24-19.749, https://www.courdecassation.fr/decision/68f8713d0274fc2d1f4a1367
[13] Court of Appeal of Douai, 19 March 2026, No. 25/01396.
[14] Court of Appeal of Douai, 11 June 2026, No. 25/02773 ; Court of Appeal of Paris, 4 Oct. 2024, cited above.
[15] Cass. com., 23 Oct. 2024, No. 23-16.267, https://www.courdecassation.fr/decision/67189203d8ceca1cd7018c82 ; 12 June 2025, No. 24-13.777, https://www.courdecassation.fr/decision/684a6c103ec57bb95fcfd57f ; 4 March 2026, No. 24-19.588, https://www.legifrance.gouv.fr/juri/id/JURITEXT000053641896/
[16] Court of Appeal of Versailles, 28 March 2023, No. 21/07299, https://www.courdecassation.fr/decision/6423d93778684f04f581456b ; Court of Appeal of Paris, 7 Feb. 2024, No. 21/17709, https://www.courdecassation.fr/decision/65c4840686d70a000846d034
[17] Cass. com., 1 July 2026, No. 25-13.134, https://www.courdecassation.fr/decision/6a44aea5cdc6046d476bb1a3
[18] Cass. com., 10 Dec. 2025, No. 24-20.778, https://www.courdecassation.fr/decision/693927a5c988783351cb6532
[19] Judicial Court of Saint-Brieuc, 30 June 2026, No. 25/00709 ; Judicial Court of Lille, 27 May 2026, No. 25/00111 ; Court of Appeal of Paris, 2 Apr. 2026, No. 25/00442.
[20] Judicial Court of Toulon, 28 May 2026, No. 25/05033 ; Court of Appeal of Toulouse, 12 May 2026, No. 23/02325.
[21] Monetary and Financial Code, Art. L. 133-2 ; Court of Appeal of Bordeaux, 15 June 2026, No. 24/00486.
[22] Cass. com., 2 July 2025, No. 24-16.590 ; 20 May 2026, No. 25-13.721.
