Bank Spoofing: BNP Paribas Ordered to Reimburse Despite Strong Authentication (TJ Paris, 9 June 2026, No. 24/13522)

Paris Court of First Instance (tribunal judiciaire), 9th chamber, 2nd section, 9 June 2026, RG No. 24/13522

What happened in this fake adviser case?

On 17 August 2023, a BNP Paribas customer receives a telephone call. The name of her bank appears on her smartphone screen: the call comes from a number she had herself saved in her contacts, that of the customer service of the group’s online subsidiary. On the line, an individual introduces himself as an agent of the fraud department. He knows personal information about her and tells her that fraudulent transactions are under way on her account.

The caller then describes a “cancellation procedure”: go to the banking app and validate, one by one, the cancellation of the suspicious transfers. The customer complies. She would state spontaneously to the investigators: “I was asked to validate each cancellation with my code and indeed, while following my bank account on the app at the same time, these fraudulent transfers were disappearing.” In reality, each “validation” authorised a new outgoing transfer.

The next day, when checking her account, she discovers the scale of the disaster: eight transfers for a total of €47,488.55, sent to an account opened in her name, without her knowledge, with a third-party payment institution. She files a complaint on 22 August 2023. Thanks to a funds recall procedure started quickly, part of the sums, €24,745.57, is recovered, and the bank adds €500 “as a goodwill gesture”. This leaves a balance of €22,242.98 that the institution refuses to reimburse, on the ground that the transactions were validated by strong authentication and that the customer allegedly committed gross negligence.

The customer sues the bank. By judgment of 9 June 2026, the Paris Court of First Instance upholds her claims in full.

Which legal regime applies to unauthorised transfers?

The court begins by setting out the framework, and that framework is exclusive. Where the liability of a payment service provider is sought on account of an unauthorised transaction, only the regime of Articles L. 133-18 to L. 133-24 of the Monetary and Financial Code (code monétaire et financier) applies, which transpose the European Payment Services Directive (Directive 2007/64/EC, known as PSD, extended by PSD2). Any other ordinary-law liability regime must be set aside.

The guiding principle protects the customer. Where an unauthorised transaction is reported within the time limits, the bank must in principle reimburse, unless it has good reasons to suspect fraud by the customer himself. The default rule is therefore reimbursement; the exception is a reasoned refusal.

Who bears the burden of proof?

This is where the legal balance of power is decided, and it tilts in the customer’s favour. Where the bank seeks to avoid reimbursing, it is for the bank to prove:

The Code and the case law add a crucial clarification, which the court repeats word for word: proof of gross negligence cannot be inferred from the mere fact that the payment instrument, or the data linked to it, were actually used. In other words, a simple log of connections or the usage history of the “digital key” is not enough. The bank must go beyond the technical finding and demonstrate genuinely faulty, characterised conduct.

Is strong authentication enough to prove that the customer authorised the transfer?

That was the bank’s entire argument: eight transfers, eight strong authentications triggered and working correctly (4:14 pm, 4:21 pm, 4:24 pm, 4:26 pm, 4:29 pm, 4:31 pm, 4:35 pm, 4:37 pm). For the institution, the matter was settled: transactions authenticated, therefore authorised, therefore for the customer’s account.

The court accepts that strong authentication did work and that the transactions were not affected by a technical deficiency. But it refuses the equation the bank wanted to impose. Strong authentication does not mean valid authorisation. The text is clear: the use of the payment instrument as recorded by the bank, including the production of a log of connections, “is not necessarily, in itself, sufficient to prove that the transaction was authorised by the payer”.

This nuance is essential for all fraud victims. A fraudster who manipulates his victim into validating the transactions herself will pass the strong authentication step without difficulty; that is indeed the whole point of the scheme. The technical security of the system says nothing about the reality of consent. The judge therefore puts the debate back where it belongs: did the customer commit gross negligence?

What is gross negligence, and why was it not established?

The bank argued that the customer had necessarily disclosed her access codes and validated the eight transactions herself, when she could have refrained from doing so. Indeed, the court acknowledges this: the customer’s validations did not have the effect of cancelling the transfers, but of executing them. Objectively, it was she who triggered the payments.

But the judge does not stop at this material finding. The court focuses on the context of deception in which these validations were given. And that context makes all the difference.

Does spoofing lower the customer’s guard?

The customer produced a screenshot, dated by its metadata to 4 September 2023, showing an incoming call on 17 August 2023 at 4:00 pm, lasting 49 minutes. The call came from numbers saved in her “bank” contact entry. The bank disputed this: according to it, one of the two numbers (0820 820 001) did not belong to it, and the screenshots had been “fabricated for the purposes of the case”.

The court dismisses the objection with remarkable firmness. It finds that the second number is, “contrary to what the bank curiously claims”, indeed a number assigned to BNP Paribas, that of its customer service. The customer had saved these numbers under the name of her bank. Conclusion: when she was contacted by the fraudster, she legitimately believed she was on the line with her institution, all the more so as the subsidiary concerned does belong to the BNP Paribas group.

The judge then applies the solution laid down by the French Supreme Court (Cour de cassation) in its judgment of 23 October 2024: “the customer’s vigilance was legitimately lowered during her conversation with the fraudster.” Because she believed she was speaking to her bank, and because she saw the transfers appear to disappear “live” with each validation, she was reinforced in her error. In these circumstances, no gross negligence can be held against her. The bank is ordered to reimburse €22,242.98.

Why must the bank pay interest increased by fifteen points?

This is probably the most dissuasive contribution of the decision. Beyond the principal, the court orders BNP Paribas to pay interest at the statutory rate increased by fifteen points. And it does so by squarely rejecting the bank’s argument.

The bank argued that it was not required to make any reimbursement until a court had ruled against it; that such interest would allow the customer to enrich himself by deliberately delaying his action; and that this threat would infringe its right of defence. Three arguments, three rejections.

From what date does this interest run?

The court lays down a clear rule: having the increased interest run only from the judgment “would deprive” the provisions of Article L. 133-18 “of any effect”. This is because it is under its sole responsibility that the bank decides to refuse reimbursement by relying on gross negligence: in doing so, it takes the risk that the court will not accept that negligence. If it loses that gamble, it must bear the consequences from the outset.

As for the argument that the customer would be “enriched” by delaying action, the judge describes it as “ineffective”: the Code already requires the customer to report the transaction without delay, and at the latest within thirteen months on pain of being time-barred, it being recalled that a customer who intentionally or through gross negligence delays reporting may lose the right to reimbursement (the court here cites the CJEU judgment of 1 August 2025, Case C-665/23). The risk relied on by the bank is therefore already neutralised by law.

Result: as the customer informed her bank on 18 August 2023, interest at the statutory rate increased by fifteen points runs from 18 September 2023, that is, after the thirty-day period has expired. Over almost three years of proceedings, and on a principal of €22,242.98, the bill is heavy. That is precisely the effect intended by the legislature.

What is the significance of this decision for fraud victims?

This judgment invents nothing: it rigorously applies a protective regime that banks too often seek to neutralise. But it does so on three fronts of direct interest to anyone who has fallen victim to a fake adviser.

First, it clearly separates strong authentication from authorisation. Too many refusals to reimburse rest on the shortcut “authenticated transaction = authorised transaction”. This judgment recalls that the Code says exactly the opposite: technical proof does not relieve the bank of the need to demonstrate gross negligence.

Second, it consolidates the notion of vigilance legitimately lowered by spoofing. Where the fraudster impersonates the bank’s official number, the customer does not have to bear alone the consequences of a deception that the bank itself failed to prevent. The fact of having physically validated the transactions is not enough to deprive her of her right.

Finally, it strengthens the penalty for delay. By having the interest increased by fifteen points run from the outset, the court turns the refusal to reimburse into a costly gamble for the bank. It is a considerable negotiating lever, too often overlooked in out-of-court claims.

A final word on a still under-exploited front. Beyond the debate on gross negligence, institutions are bound, under the regulatory technical standards (RTS) supplementing PSD2, by precise obligations regarding authentication, transaction monitoring and the detection of unusual fraud patterns. Eight transfers of more than €6,000 within twenty-three minutes, to a newly opened account, from a device that the bank itself described as “unknown and unusual”: one may legitimately question the effectiveness of the monitoring system. This lever, distinct from anti-money laundering obligations (which, for their part, do not give rise to compensation for victims), deserves to be systematically examined. Filing a complaint and, where appropriate, reporting to the authorities remain useful for recovery purposes, without in themselves constituting a basis for civil compensation.

Conclusion

The decision of the Paris Court of First Instance of 9 June 2026 is good news for victims of fake adviser fraud. It recalls that the bank cannot hide behind strong authentication to refuse reimbursement, that it is for the bank to prove gross negligence, which is never presumed, and that spoofing legitimately lowers the customer’s vigilance. Above all, it heavily penalises the refusal to reimburse by having the interest increased by fifteen points run from the origin of the dispute, and not from the judgment.

If you have been the victim of an unauthorised transfer and your bank relies on strong authentication or on your alleged gross negligence to refuse to reimburse you, this judgment shows that the game is far from lost. Each case deserves a precise analysis of the evidence produced by the bank and of the context of the fraud. The firm LE BOT Avocat, dedicated to banking law, assists victims in challenging these refusals and recovering the diverted sums.

FAQ: Frequently Asked Questions