Scam of the Child Who Lost or Broke Their Phone: The Bank Must Prove Strong Authentication Before Any Refusal to Reimburse (TJ Paris, 22 May 2026, No. 24/09224)

Paris Court of First Instance (tribunal judiciaire), 9th Chamber, 2nd Section, 22 May 2026, No. RG 24/09224

What happened in this case?

A couple holds a joint account with a private Paris bank; the husband also has a personal account with the same institution. On 19 December 2023, eleven bank card transactions debit their two accounts for a total of €10,805, within a few hours. On the joint account, four identical payments of €961 go to the same beneficiary. On the personal account, six payments of €1,000 and one payment of €961 are added.

The customers explain that they were caught in a now well-rehearsed scenario, known in practice as the “scam of the child who lost or broke their phone”. Specifically, the husband was contacted by a person presenting himself as his daughter, supposedly unreachable on her usual number because her phone was said to be out of order. Put at ease (the fraudster knew personal details and the daughter’s name even appeared in text message exchanges produced in the proceedings), the customer ended up providing the information that enabled the disputed payments. It is therefore a variant of the fake bank adviser scam (or spoofing) applied to the family circle.

The customers react quickly: a report to the National Gendarmerie, dispute forms sent to the bank as early as 3 January 2024, then a registered letter with acknowledgement of receipt from their counsel on 13 February 2024. Failing reimbursement, they summon the bank on 22 July 2024 to establish its liability, relying in particular on Articles L. 133-6 et seq. of the Monetary and Financial Code. They claim reimbursement of the sums debited, interest at the increased rate of 15% from 19 January 2024, capitalisation of interest, and €6,000 for moral damage and the bank’s abusive resistance.

The bank, for its part, refuses to reimburse. Its argument is blunt: the customer allegedly committed gross negligence by handing over all of his card credentials and details to a third party, even one presented as his daughter. It stresses that he had already been the victim of a fraud in 2023 (€4,650, thirteen transactions), which it covered in July of the same year, implying that he should have been more vigilant. Finally, it asserts that the disputed transactions were subject to strong authentication, validated by the customer himself.

Who must prove what in the event of an unauthorised payment?

This is the whole issue in the case, and it is where the decision is valuable. When a customer disputes a transaction that he or she says was not authorised, the natural reflex, fostered by the banks, would be to believe that it is for the customer to demonstrate that he or she had nothing to do with the transaction. It is exactly the opposite. The Monetary and Financial Code, which transposes the second European Payment Services Directive (known as PSD2), places the burden of proof on the payment service provider, that is, the bank.

Article L. 133-23 of the Monetary and Financial Code is the pivot of the reasoning. It provides that, where a user denies having authorised an executed transaction, “it is for his or her payment service provider to prove that the transaction in question was authenticated, duly recorded and accounted for and that it was not affected by a technical or other deficiency”. In other words, it is the bank that bears the risk of proof. If it fails to establish these elements, it must reimburse.

Why must the bank prove strong authentication first?

The court recalls that the bank can escape liability for unauthorised payments only on a double condition: on the one hand, establishing that these payments were authenticated, duly recorded and accounted for, without technical deficiency in its system; on the other hand, demonstrating that the user committed gross negligence. These two conditions are not on the same level: they follow one another in a mandatory logical order.

The wording used in the judgment is remarkably clear: “before establishing the existence of gross negligence excluding any right to compensation for the claimants, the banking institution must prove that the disputed transactions were subject to strong authentication”. Proof of strong authentication is therefore a prerequisite. As long as it is not provided, discussion of the customer’s conduct does not even arise. This is a crucial point: the bank cannot simply wave the customer’s “gross negligence” about to bypass its own burden of proof.

Is the customer’s gross negligence enough to exonerate the bank?

No, and this is the whole subtlety that banks often try to obscure. Gross negligence is only a second condition of exoneration, which can be examined only once the first has been cleared. In this case, the bank was banking heavily on the customer’s disclosure of his card details to a third party, behaviour which, in other disputes, can indeed amount to gross negligence.

But the court did not have to decide this question. Since the bank failed at the very first step, strong authentication, the judge expressly stated that he did not have “to rule on the other conditions required by law to uphold an exoneration of liability of this banking institution”. The customer’s alleged gross negligence, at length developed by the bank, thus became moot. This is a first-rate strategic lesson: challenging the proof of strong authentication makes it possible, in many cases, to render the whole debate on the victim’s conduct unnecessary.

What is strong authentication and how is it proved?

Strong authentication is at the heart of the security framework intended by PSD2. It is not a formality: it is a precise technical requirement, the definition of which is laid down in Article L. 133-4, f of the Monetary and Financial Code.

In practical terms, for a card payment, strong authentication most often takes the form of a combination of a one-time code (OTP), sent to a phone belonging to the customer and previously registered, and validation by biometrics or by a security code. A bank that wishes to exonerate itself must therefore demonstrate that two distinct factors were actually implemented for each of the disputed transactions. This is not a mere assertion: it is technical proof, transaction by transaction.

Is an internal bank table enough to prove strong authentication?

This is the decisive question, and the court’s answer is nuanced but firm. To prove strong authentication, the bank produced a chronological table of the disputed transactions. Depending on the line, this document contained either “a drawing formed of a circle with an irregular outline from which two lines extend to the right”, meant to signify that “the customer validated a notification via his enrolled phone”, or “the sketch of a person topped by a key and a speech bubble”, meant to signify that the customer entered an OTP code received by text message and then validated by biometrics or security code.

First point, favourable to the bank in principle: the court accepts that the probative value of this document cannot be set aside solely because it emanates from the bank itself. A payment service provider can indeed “hardly demonstrate the implementation of strong authentication by means other than” its own technical logs. The judge therefore agrees to regard this table as a commencement of proof in writing (commencement de preuve par écrit) within the meaning of Article 1361 of the Civil Code.

And this is precisely where the bank fails. The court notes that, on examination, the table “reveals neither of the two attributes” from among “knowledge”, “possession” and “inherence” that strong authentication must combine. The explanatory captions, emanating solely from the provider, are not enough: the bank produces no evidence showing that the two factors were actually used. Was the one-time code sent to the customer’s registered phone? Was biometric validation carried out? No document attests to it. Neither the report made by the customer to the gendarmerie nor any other document corroborates the table.

In sum, drawings accompanied by captions written by the bank are not proof of strong authentication. Objective, verifiable elements are needed, demonstrating the concrete implementation of two independent factors. The commencement of proof in writing having not been corroborated, it collapses.

What did the Paris court ultimately decide?

The conclusion is self-evident. As it does not demonstrate that the disputed transactions were subject to strong authentication, the bank is required to reimburse them, “without the court having to rule on the other conditions required by law”, that is, without examining gross negligence. The bank is ordered to pay the couple, together, the sum of €3,844 (joint account), and the husband, alone, the sum of €6,961 (personal account). That is, the whole of the sums fraudulently debited.

These sums bear interest at the increased statutory rate, under the conditions provided for in Article L. 133-18 of the Monetary and Financial Code. The bank is also ordered to pay the costs and €1,500 under Article 700 of the Code of Civil Procedure (code de procédure civile).

What are the limits of this decision for victims?

The victory is clear on the main point, but it is not total, and it would be dishonest to pass over this in silence. The court did in fact reject two important ancillary claims, on a ground that deserves the attention of every victim and their counsel: the full harmonisation of PSD2.

On this basis, the court first rejects the claim for capitalisation of interest: it does not fall within the scope of Article L. 133-18, the provisions of which result from a full-harmonisation directive. It then rejects the claim for €6,000 for moral damage and abusive resistance: this head of claim would have required invoking the general law of civil liability (Article 1240 of the Civil Code), whereas the special regime of Articles L. 133-18 et seq., arising from PSD2, “excludes the application of any alternative liability regime arising from national law”. For the same reason, the contractual interest rate of 15% claimed is set aside in favour of the increased statutory rate alone.

The rigour of this reading may be questioned. While the mechanism for reimbursing unauthorised transactions does fall within the exclusive regime of PSD2, it can be argued that a harm distinct from the mere fraudulent debit, for example the trouble and steps occasioned by a persistent and unfounded refusal to reimburse, does not necessarily coincide with the subject matter of the special regime. The boundary between what PSD2 absorbs and what may remain under general law is still open to discussion, to be clarified by forthcoming decisions and, where appropriate, by the Court of Justice of the European Union. The debate is not closed.

There is also a lever still under-used by victims: the bank’s technical obligations under the RTS standards (the regulatory technical standards that supplement PSD2), which impose precise requirements on strong authentication and transaction monitoring. Failure to comply with these standards can usefully support the argument against the institution. Conversely, one should avoid basing a compensation claim on a bank’s breach of its anti-money-laundering obligations: these obligations pursue a public-policy purpose and do not protect the customer’s private interests. As for filing a criminal complaint and reporting to the authorities, they remain useful for evidential purposes and for recovery, but do not in themselves constitute a civil basis for compensation.

What to do if you are the victim of a fake bank adviser scam?

This decision sketches out a clear roadmap for victims. The first reflex is to dispute the transactions without delay with the bank, in writing, strictly observing the thirteen-month period provided for in Article L. 133-24; beyond that, the claim is time-barred. Keep a record of all your steps: dispute forms, registered letters, complaint receipt or police log entry.

The second reflex is not to be intimidated by the “gross negligence” argument. As long as the bank has not proved strong authentication, transaction by transaction, by objective and verifiable evidence, your conduct need not be discussed. Require the bank to produce real technical proof of the two authentication factors, and not a mere summary table with in-house captions. As this case shows, the absence of such proof is enough on its own to secure reimbursement.

Conclusion

The judgment of the Paris Court of First Instance of 22 May 2026 is excellent news for victims of card fraud. It clearly reaffirms a principle too often mistreated: for an unauthorised payment transaction, it is for the bank to prove that it implemented strong authentication, and this proof must precede any discussion of the customer’s conduct. An internal table embellished with pictograms is not enough; objective elements are needed establishing the effective combination of two independent factors. Failing that, the bank reimburses, regardless of whether the customer was otherwise imprudent.

The decision admittedly has its limits: under the cover of the full harmonisation of PSD2, the court refused moral damage, abusive resistance and capitalisation of interest. This point deserves to be discussed and, no doubt, challenged in future cases. But on the essential point, the full reimbursement of the sums misappropriated, the victim succeeds. For those who know how to take the debate onto the terrain of proof of strong authentication, the balance of power with the bank is reversed. If you are faced with a refusal to reimburse after a fraud, do not hesitate to have your file examined: the case law is today largely on your side.

FAQ: Frequently Asked Questions