Disclosure of Security Codes Under Manipulation: Fraud Victims Protected – CA Rouen, Civil and Commercial Chamber, 19 February 2026, No. 25/01563

Court of Appeal of Rouen, Civil and Commercial Chamber, 19 February 2026, No. 25/01563

The facts: a well-rehearsed fraud scenario

On 25 October 2023, Ms. [M], a 25-year-old client of Societe Generale, received several persistent calls from the same telephone number. Alarmed by the unusual repetition, she eventually answered. The caller introduced himself as an adviser from her bank’s card opposition department, informing her that a fraudulent purchase had been detected on her account and that immediate action was needed to block it and protect her funds.

The fraudster, who was particularly skilled, invited Ms. [M] to verify for herself online that the number he was calling from matched that of Societe Generale. The verification appeared to confirm his claims, which fully convinced the client that she was speaking with a genuine adviser. The supposed adviser then asked her to provide her client code in order to access her personal online banking space, before giving her a new code. He activated the security pass and guided his client step by step through the actions she needed to perform, supposedly to block a fraudulent transaction.

In reality, the fraudster managed to carry out two transactions: first, a transfer of 3,500 euros from Ms. [M]’s savings account to her current account, followed by a payment of 4,631.64 euros to a mysterious company, Grand Store LLC, domiciled in a foreign country. A third attempted debit, for a much higher amount (17,997.50 euros), failed.

Immediately after these transactions, Ms. [M] contacted her bank’s genuine opposition department to ensure that the block had been properly applied. It was at this point that the operator revealed to her that she had just fallen victim to a scam. She immediately placed a hold on her card and filed a police complaint that same day.

Despite her swift reaction, Societe Generale refused to reimburse the 4,631.64 euros that had been debited, arguing that their client had been grossly negligent. Ms. [M] then brought the matter before the Bernay Proximity Court, which, by judgment of 26 March 2025, ordered the bank to provide full reimbursement, together with interest and damages.

Societe Generale decided to appeal this decision. The case was brought before the Court of Appeal of Rouen, which rendered its judgment on 19 February 2026.

The legal framework: protecting banking clients against unauthorized transactions

The principle of immediate reimbursement

French banking law, through the Monetary and Financial Code, establishes strong protection for clients who are victims of unauthorized payment transactions. This protection stems in particular from the transposition of European directives aimed at harmonizing rules across the European Union.

Article L133-18 of the Monetary and Financial Code sets out the fundamental principle: in the event of an unauthorized payment transaction reported by the client, the bank must reimburse the client immediately, no later than the end of the first business day following its awareness of the fraudulent transaction. The account must be restored to the state it would have been in had the disputed transaction never taken place.

This rapid and automatic reimbursement is the rule. It is then for the bank, if it considers that the client committed a fault, to prove that fault in order to escape liability.

The exception: gross negligence of the client

Article L133-19 of the same Code provides an exception to this reimbursement principle: the client bears the losses if they result from fraudulent conduct on the client’s part, or if the client has failed intentionally or through gross negligence to comply with their security obligations.

These obligations are defined in Articles L133-16 and L133-17 and essentially consist of taking all reasonable measures to preserve the security of personalized security data (codes, identifiers, etc.) and promptly informing the bank in the event of loss, theft, or unauthorized use of the payment instrument.

The burden of proof lies with the bank

Article L133-23 of the Monetary and Financial Code makes an essential point: the use of the payment instrument as recorded by the bank does not, in itself, suffice to prove that the transaction was authorized by the client or that the client committed gross negligence.

In other words, even if the bank’s IT systems show that the correct codes were used and that strong authentication was completed, this does not exempt the bank from providing positive proof that the client acted fraudulently or committed gross negligence.

This rule is protective for the consumer because it prevents the bank from simply noting the effective use of the codes to reject all liability. Recent case law from the Court of Cassation (notably the judgment of 5 March 2025, No. 23-22.687) has confirmed that this rule applies even where a strong authentication system is in place.

The court’s analysis: no gross negligence in cases of psychological manipulation

Building trust through identity theft

The Court of Appeal of Rouen carefully examined the circumstances in which Ms. [M] was led to disclose her personal security codes. It identified several decisive factors that preclude a finding of gross negligence.

First factor: the fraudster’s telephone number was almost identical (differing by just one digit) to the official number of Societe Generale’s opposition department. Ms. [M] had even taken the precaution of checking online that the number matched her bank’s, which reinforced her belief that she was speaking with a genuine adviser.

Second factor: the caller expressly identified himself as an employee of the bank’s card opposition department, citing the detection of a fraudulent purchase requiring immediate blocking. This staging created a sense of urgency conducive to psychological manipulation.

Third factor: the modus operandi relied on identity theft, a sophisticated technique that diminished the victim’s vigilance. The court observed that Ms. [M] genuinely believed she was blocking a fraudulent payment by following the instructions of a bank employee.

A swift reaction by the victim

The court also highlighted Ms. [M]’s responsiveness as soon as she became aware of the fraud. Immediately after the disputed transactions, she contacted the genuine opposition department to verify that the block had been properly applied. It was at this point that she discovered she had been deceived.

Without delay, she requested that all transactions on her card be blocked, which prevented a third debit attempt for a much larger amount (nearly 18,000 euros). That same day, she filed a police complaint for fraud.

This diligence demonstrates that Ms. [M] did not act with recklessness or indifference, but rather that she was the victim of manipulation that occurred within a very short timeframe, conducive to the state of panic deliberately sought by the fraudsters.

The insufficiency of the evidence provided by the bank

Societe Generale attempted to put forward several arguments to demonstrate their client’s gross negligence. In particular, the bank pointed out that Ms. [M] had disclosed her client code and her online banking access code, thereby enabling the validation of the fraudulent transaction. The bank also emphasized that the transaction had been duly authenticated through the strong authentication system (Securipass), with a code sent by SMS to the client’s registered mobile phone.

According to the bank, Ms. [M] should have suspected the deception and realized that her caller was not a genuine adviser. She should have known that it was not necessary to block the entire account for a single suspicious transaction, and that she could have performed these steps directly through her mobile application without disclosing her personal data.

The court rejected these arguments. It held that the fact of having disclosed personal security codes, in a context where the client believed she was dealing with a bank employee and was following their instructions to block a fraud, does not constitute gross negligence.

The existence of strong authentication and the effective use of the correct codes are not, on their own, sufficient to establish the client’s gross negligence. The court thus strictly applied Article L133-23 of the Monetary and Financial Code, which provides that the use of the payment instrument as recorded by the bank does not suffice to prove that the client committed a fault.

The practical consequences: the bank is ordered to pay

Finding that Societe Generale failed to prove their client’s gross negligence, the Court of Appeal of Rouen upheld the first-instance judgment in its entirety. The bank was ordered to reimburse Ms. [M] the sum of 4,631.64 euros, with interest at the statutory rate from 26 October 2023, i.e., the day after the fraud.

The court also confirmed the award of 150 euros in damages for the moral harm suffered by the victim. This moral harm arises from the stress, anxiety, and sense of personal security violation caused by such a scam.

Regarding legal costs, Societe Generale was ordered to pay 1,000 euros under Article 700 of the Code of Civil Procedure for the first instance, and an additional 2,500 euros for the appeal proceedings. These sums represent a contribution toward the legal fees incurred by Ms. [M] in asserting her rights.

Finally, the bank was ordered to pay the court costs, i.e., the procedural expenses (court registry fees, bailiff fees, etc.) of both instances.

In total, this decision will have cost Societe Generale over 8,000 euros, not including its own legal fees and the interest that has continued to accrue since October 2023.

Conclusion

The judgment of the Court of Appeal of Rouen of 19 February 2026 falls within an increasingly protective body of case law for victims of sophisticated banking fraud. It reaffirms that the burden of proving gross negligence rests entirely on the bank and that such proof cannot result from the mere observation that personal security codes were used.

The decision recognizes that social engineering techniques (psychological manipulation, identity theft, creation of a sense of urgency) constitute mitigating circumstances that may preclude a finding of gross negligence, even where the client has actually disclosed their personal security codes.

This case law position is significant because it prevents banks from systematically hiding behind the argument of client negligence to escape their obligation to reimburse. It serves as a reminder that strong authentication, while necessary, is not an absolute safeguard against increasingly sophisticated fraud.

For victims of banking fraud, this judgment confirms the importance of several key reflexes: reacting immediately upon discovering the fraud, contacting the bank’s opposition department without delay, filing a police complaint promptly, and not hesitating to challenge the bank’s refusal to reimburse by bringing the matter before the courts if necessary.

If you are the victim of banking fraud and your bank refuses to reimburse you by invoking alleged negligence on your part, do not hesitate to consult a specialist lawyer. The chances of a successful outcome are real, as this decision of the Court of Appeal of Rouen demonstrates.

FAQ