EBICS Protocol and Contractual Scope: Unauthorised International Transfers – CA Paris, Pôle 5 ch. 6, 4 February 2026, No. 23/16958

Paris Court of Appeal, Division 5 Chamber 6, 4 February 2026, No. 23/16958

The Factual and Contractual Background

A Long-Standing Banking Relationship and Evolving Payment Methods

Vocalcom, a company specialising in digital “cloud contact centre” solutions, had maintained a banking relationship with Banque Palatine since July 2010. This relationship had been built around several mechanisms for securing payment transactions, which had evolved over time.

From November 2010 onwards, Vocalcom had subscribed to the secure EBICS version T protocol (Electronic Banking Internet Communication Standard). This system required a connection to the banking platform via confidential credentials and the submission of payment orders in the form of electronic files, confirmed by sending a system-generated slip, signed by an authorised signatory of the company, via fax. However, in day-to-day practice, Vocalcom continued to use paper-based payment orders, reflecting a certain inertia in adopting new digital tools.

In 2017, the EBICS TS (Secure Transfer) protocol was introduced. It enabled orders to be validated by electronic signature, thereby enhancing transaction security. However, Vocalcom did not migrate to this new protocol. Faced with this situation, Banque Palatine proposed a derogatory solution on 28 August 2018: the signing of a “Request for Execution of Instructions Transmitted by Fax or Email” for all types of wire transfers. This notice specified the email addresses authorised for transmitting payment orders. Vocalcom accepted this derogatory arrangement.

CEO Fraud: Four Suspicious Wire Transfers

It was in this context that, in September 2020, four fraudulent wire transfers were executed to the detriment of Vocalcom, for a total amount of €2,910,215.04. These transactions fell within what is commonly known as “CEO fraud” or “bogus transfer order scam”, a well-known manipulation technique familiar to economic crime investigators.

The first two transfers, dated 2 and 7 September 2020, for amounts of €456,770.26 and €977,148.26 respectively, were transmitted by email. They came from an email address belonging to Vocalcom, but which was not among the three addresses authorised in the derogatory notice of 28 August 2018. The orders bore a signature resembling that of Vocalcom’s director and referred to the payment of fictitious invoices to a Hungarian company, Webmek Czako Tanya KFT, whose account was held at the Hungarian bank K and H Bank ZRT.

The third and fourth transfers, dated 14 and 21 September 2020, for €979,148.26 and €497,148.26 respectively, were transmitted electronically via the secure EBICS T protocol, accompanied by slips sent by email bearing a signature similar to that of the director. These transfers were also directed to the same Hungarian beneficiary.

The fraudulent scheme was based on identity theft. A fraudster alternately impersonated Vocalcom’s president (using a forged email address) and a lawyer from the KPMG audit firm. He thus convinced Vocalcom’s chief accountant, Mr Y.P., to participate in an alleged “confidential financial transaction to acquire a company based abroad”. The employee, deceived, executed the transfer orders without suspecting the fraud.

It was not until 23 September 2020, during a routine bank reconciliation, that Vocalcom discovered the fraud. The company immediately reported the facts to Banque Palatine, filed a complaint at the police station in the 8th arrondissement of Paris, and then with the Hungarian police on 3 October. Despite the bank’s efforts with its Hungarian counterpart to repatriate the funds, the time that had elapsed between the execution of the transfers and the return request rendered these efforts unsuccessful. The funds had already been dispersed.

Classification of the Payment Transactions: Authorised or Not?

The Legal Framework for Authorised Payment Transactions

The dispute between Vocalcom and Banque Palatine raised a fundamental legal question: should the four disputed transfers be classified as authorised or unauthorised payment transactions within the meaning of the Monetary and Financial Code? This distinction is far from trivial, as it determines the applicable liability regime and, consequently, whether or not the bank is obliged to reimburse the misappropriated sums.

Article L. 133-6 of the Monetary and Financial Code sets out the principle that “a payment transaction is authorised if the payer has given consent to its execution”. This consent must, under the terms of Article L. 133-7 of the same code, be given “in the form agreed between the payer and their payment service provider”. The statute expressly provides that in the absence of such consent, “the payment transaction or series of payment transactions shall be deemed unauthorised”.

This presumption of non-authorisation in the absence of consent complying with the agreed terms is reinforced by Article L. 133-23 of the Monetary and Financial Code, which establishes a reversal of the burden of proof. When a payment services user denies having authorised a transaction, it falls to the payment service provider to prove that the transaction in question was authenticated, duly recorded and accounted for, and was not affected by any technical deficiency. The statute adds that “the use of the payment instrument as recorded by the payment service provider does not necessarily in itself constitute sufficient proof that the transaction was authorised by the payer”.

In short, the legislature has established a protective system for the client, requiring the bank to demonstrate not only the technical execution of the transaction, but also strict compliance with the contractually agreed authorisation procedures.

The Transfers of 2 and 7 September 2020: Non-Compliance with Agreed Terms

With regard to the first two transfers, the Paris Court of Appeal upheld the analysis of the Commercial Court. These transactions had been carried out in execution of orders transmitted by email from an email address that did indeed belong to Vocalcom, but which was not among the three addresses expressly listed in the derogatory notice of 28 August 2018.

This contractual document was clear. It provided that, “on an exceptional basis”, the bank agreed to execute instructions “transmitted through the following two channels”: by fax, or “by email with a scanned copy of the signed orders as an attachment”. The text further specified that “these instructions shall be sent to you from the following email address”, and listed three authorised addresses by name. However, the email address of Mr Y.P., the chief accountant who had transmitted the fraudulent orders, was not among them.

Banque Palatine attempted to argue that an established practice between the parties had authorised the use of this address. The Court of Appeal dismissed this argument. It noted that Vocalcom did not demonstrate a consistent practice under which Mr Y.P.’s address had been used to transmit payment instructions by email. The fact that this employee had communicated with the bank regarding transactions transmitted through another channel (EBICS T), that he had been copied on emails exchanged on other matters, or that the bank held a signature card in his name, did not establish such a practice.

The Court therefore concluded, as the Commercial Court had before it, that the parties’ agreement had not been complied with. Consequently, the payer’s consent had not been given in the agreed form, and the first two transfers had to be classified as unauthorised transactions.

The Transfers of 14 and 21 September 2020: Transactions Outside the Contractual Scope

On this point, the Court of Appeal departed from the Commercial Court. At first instance, the judges had found that the last two transfers, transmitted via the EBICS T protocol, were authorised transactions. The Court of Appeal overturned this analysis and held, on the contrary, that these transfers were also unauthorised.

The Court’s reasoning was based on a careful reading of the contracts governing the use of the EBICS T service. Two documents were at issue: the “Palatine Comptes Entrepreneurs – Palatine Comptes Entreprises” subscription contract signed on 15 July 2010, and the electronic data interchange contract under the EBICS version T protocol, signed on 4 November 2010.

The “Subscription and Options” section of the special conditions of the remote banking service contract revealed that Vocalcom had selected the “Palatine Comptes Entreprises 2” option, but had expressly excluded the “Cross-border and International Transfers” functionality (the answer “no” had been ticked). This exclusion was confirmed by Annex 4 of the EBICS-T contract, entitled “Exchangeable Electronic Data”, Article 1 “Issuing Orders” of which specified the list of services used: the “International Transfers” box had not been ticked, thereby expressly excluding this service from the contractual scope.

The transfers of 14 and 21 September 2020 were international transfer requests to Hungary. They therefore did not fall within the scope of the electronic payment services provided by Banque Palatine to Vocalcom. By executing these orders, the bank exceeded the framework of the contractual authorisations granted by its client.

The Court deduced that the payer’s consent had not been given in the agreed form, since the EBICS T system did not cover this type of transaction. It accordingly dismissed the bank’s reliance on Article 7 of the EBICS-T contract concerning proof of exchanges, which provided in particular that “since the electronic files are transmitted and confirmed by the client using transport certificates simultaneously, the client is deemed to be the author thereof”. This evidential clause could not apply to transactions that, by their nature, fell outside the contractual scope of the EBICS T protocol.

The Requirement for Strong Customer Authentication

The PSD2 Directive and the 2018 Delegated Regulation

Beyond the contractual analysis, the Court of Appeal relied on a weighty legal argument drawn from European regulation on payment services. It invoked Article L. 133-44, paragraph 1, tertio, of the Monetary and Financial Code, as amended by Ordinance No. 2017-1252 of 9 August 2017, transposing Directive No. 2015/2366 of the European Parliament and of the Council of 25 November 2015, known as the PSD2 Directive (Payment Services Directive 2).

This provision came into force on 14 September 2019, i.e. eighteen months after the entry into force of Commission Delegated Regulation (EU) 2018/389 of 27 November 2017. This regulation supplements the PSD2 Directive with regulatory technical standards on strong customer authentication (SCA) and common and secure open standards of communication.

Under Article L. 133-44, the payment service provider must apply strong customer authentication, as defined in point (f) of Article L. 133-4, “when the payer executes a transaction through a remote means of communication that may involve a risk of payment fraud or any other fraudulent use”.

Strong customer authentication is based on the use of two or more elements belonging to the following categories: knowledge (something only the user knows, such as a password), possession (something only the user possesses, such as a mobile phone), and inherence (something the user is, such as a fingerprint). These elements must be independent of one another, so that the compromise of one does not undermine the reliability of the others.

The Obligation Incumbent on the Bank

The Court of Appeal noted that email, the means by which the disputed payment instructions were transmitted to Banque Palatine for the first two transfers, undeniably constitutes “a remote means of communication that may involve a risk of payment fraud or any other fraudulent use”. This finding is all the more self-evident given that email address spoofing and email forgery are favoured vectors of banking cybercrime.

Consequently, Banque Palatine was required to apply strong customer authentication before executing the disputed transactions. However, the bank neither claimed nor demonstrated that it had been authorised to derogate from this obligation, nor that it had actually implemented strong authentication when executing the transfers of 2 and 7 September 2020.

Having failed to prove that the transactions in question were duly authenticated in accordance with the applicable standards, Banque Palatine could not demonstrate that they were authorised by the payer. The absence of strong authentication therefore constitutes a fatal flaw that seals the fate of the first two transfers.

Although the Court did not explicitly develop this reasoning for the next two transfers (14 and 21 September), one may consider that the requirement for strong authentication also applied to those transactions, all the more so as they exceeded the authorised contractual scope.

The Bank’s Strict Liability

The Regime Under Article L. 133-18 of the Monetary and Financial Code

Once the unauthorised nature of the four disputed transfers was established, Banque Palatine’s liability followed automatically from the provisions of Article L. 133-18 of the Monetary and Financial Code. This provision establishes a regime of objective liability that is particularly protective for the client.

Under the first paragraph of this article, “in the event of an unauthorised payment transaction reported by the user under the conditions provided for in Article L. 133-24, the payer’s payment service provider shall reimburse the payer for the amount of the unauthorised transaction immediately after becoming aware of the transaction or after being informed thereof, and in any event no later than the end of the first business day following, unless it has good reason to suspect fraud on the part of the payment service user and communicates such reasons in writing to the Banque de France”.

This mechanism therefore imposes on the bank an obligation of immediate reimbursement, without the client needing to demonstrate any fault on the bank’s part or any loss distinct from the loss of the misappropriated sums. The liability is strict: it suffices that the transaction be classified as unauthorised and that it has been reported within the prescribed time limits.

In this case, Vocalcom had reported the fraud to Banque Palatine on 23 September 2020, immediately upon its discovery. The reporting conditions provided for in Article L. 133-24 were therefore satisfied. The Court accordingly ordered Banque Palatine to reimburse the full amount of the misappropriated sums, namely €1,433,918.52 for the first two transfers and €1,476,296.52 for the following two, with interest at the statutory rate from 23 September 2020.

The Ineffectiveness of Limitation of Liability Clauses

Faced with this statutory obligation to reimburse, Banque Palatine attempted to invoke several contractual clauses designed to limit or exclude its liability. This argument was dismissed by the Court of Appeal, which recalled the strict limits placed by the legislature on freedom of contract in the area of payment services.

With regard to the first two transfers, the bank invoked the following clause from the “Request for Execution of Instructions Transmitted by Fax or Email” of 28 August 2018: “we [Vocalcom] undertake not to dispute the authenticity of an instruction transmitted through one of the channels indicated above provided that it was sent from the fax number or email address mentioned above and that it bears the appearance of the specimen signature deposited with the bank”.

The Court of Appeal held this clause to be inoperative. First, because, as we have seen, the instructions had not been sent from one of the email addresses mentioned in the document of 28 August 2018. Second, and more fundamentally, because Article L. 133-2 of the Monetary and Financial Code does not permit contractual derogation from the provisions of Article L. 133-18.

It is true that Article L. 133-2 authorises the parties to derogate by agreement from certain provisions of the Monetary and Financial Code, including those of Article L. 133-19 relating to losses resulting from unauthorised transactions. However, this faculty of derogation is expressly excluded “in cases where the user is a natural person acting for non-professional purposes”. While Vocalcom is admittedly not a natural person acting for non-professional purposes, Article L. 133-18 is not among the provisions from which contractual derogation is permitted, even between professionals.

This regime of objective, mandatory liability reflects the intention of the European and French legislatures to guarantee a high level of protection for users of payment services, in the face of increasingly sophisticated fraud and the information asymmetry between banking institutions and their clients.

The Client’s Faults Do Not Release the Bank

In a final attempt, Banque Palatine sought to rely against Vocalcom on the faults that it considered had been committed either by the company itself or by its employee, Mr Y.P., the chief accountant who had been deceived by the fraudsters.

The bank accused Vocalcom, among other things, of having failed to safeguard the confidentiality of the credentials and certificates required for using the EBICS T system, of having neglected to regularly check its bank statements, and of having failed to migrate to the EBICS TS system enabling payment by enhanced electronic signature, even though this more secure protocol had been available since 2017. It further denounced the credulity and lack of vigilance of Mr Y.P., who had allowed himself to be manipulated by the fraudsters without carrying out the usual checks.

The Court of Appeal rejected these arguments firmly. It first noted that, with regard to the transfers of 14 and 21 September 2020, the EBICS T credentials and certificates had not been stolen by a third party. No breach of the confidentiality of this data could therefore be attributed to Vocalcom. It was the employee himself who, having been deceived, had placed the fraudulent orders, without disclosing the authentication elements he legitimately held.

Next, and above all, the Court observed that while the bank denounced the negligence and imprudence of Vocalcom and its employee, it did not establish any “fraudulent conduct” on the part of the payer. Article L. 133-19, paragraph V, of the Monetary and Financial Code expressly provides that, “except in the case of fraudulent conduct on their part, the payer shall bear no financial consequences if the unauthorised payment transaction was carried out without the payer’s payment service provider having required the strong authentication of the payer provided for in Article L. 133-44”.

It is therefore not sufficient to invoke negligence, even gross negligence, on the part of the client. Only deliberate fraudulent conduct would be such as to prevent full reimbursement. In this case, Vocalcom and its chief accountant had been victims of a skilful and sophisticated manipulation. Their credulity, regrettable as it may have been, did not constitute personal fraud justifying that they bear the financial consequences of the bank’s failure.

The Practical Significance of This Decision

Lessons for Banks

The ruling of the Paris Court of Appeal of 4 February 2026 sends banking institutions several unequivocally clear messages. These lessons form part of a consistent body of case law that places the security of payment transactions and client protection at the heart of the obligations of payment service providers.

First, banks must scrupulously comply with the authorisation procedures contractually agreed with their clients. When an agreement provides that payment orders may only be transmitted from specifically designated email addresses, the bank cannot execute orders from other addresses, even from within the same company, without carrying out additional verification or obtaining a formal amendment to the contract. Invoking an alleged “practice” that has not been formalised is not sufficient.

Second, institutions must ensure that the scope of services actually provided corresponds exactly to the options subscribed to by the client. If a contract expressly excludes international transfers, the bank cannot execute such transactions without first consulting its client and obtaining their formal agreement to extend the scope of services. This requirement of contractual consistency is not a mere formality: it constitutes an essential element in classifying the transaction as authorised or not.

Third, and this is undoubtedly the most sensitive point, banks must imperatively implement strong customer authentication for all payment transactions carried out through a remote means of communication that may involve a risk of fraud. This obligation, derived from the PSD2 Directive and the 2018 Delegated Regulation, is not optional. It has been binding on all payment service providers since September 2019. Derogatory arrangements based on earlier authorisation methods (email with a scanned copy of a signed order, for example) cannot substitute for strong authentication where this is legally required.

Fourth, contractual clauses designed to limit or exclude the bank’s liability in the event of an unauthorised transaction are, in most cases, inoperative. The liability regime under Article L. 133-18 of the Monetary and Financial Code is mandatory and cannot be set aside by agreement, even between professionals. Banks therefore cannot rely on contractual stipulations purporting to impose on the client the consequences of unauthorised transactions, provided that the legal conditions for reimbursement are met.

Finally, any negligence on the part of the client, however obvious, does not release the bank from its obligation to reimburse, unless deliberate fraudulent conduct by the client is demonstrated. The credulity of an employee in the face of CEO fraud, the failure to regularly check bank statements, or the failure to migrate to a more secure security protocol do not constitute faults such as to exempt the payment service provider from liability.

Lessons for Victim Companies

For corporate clients of banking institutions, this ruling constitutes an important victory and a reassuring precedent. It confirms that French law, in application of European regulation, offers robust protection against the misappropriation of funds resulting from unauthorised payment transactions.

Victims of CEO fraud or other forms of banking scams should take several lessons from this case. First, it is imperative to report any suspicious transaction to the banking institution without delay. The starting point for the one-business-day reimbursement deadline runs from the moment the bank is informed. Any delay may complicate the recovery of funds and weaken the client’s position.

Furthermore, companies must carefully preserve all contractual documents governing their banking relationships: account opening agreements, remote banking service user guides, amendments, and correspondence. These documents constitute the essential evidence base for demonstrating, where necessary, that the agreed terms were not complied with by the bank.

Moreover, even though case law proves protective, it remains prudent for companies to implement internal procedures for controlling and validating payment orders, particularly for large amounts or unusual transactions. The fact that client negligence does not release the bank does not mean that all vigilance should be abandoned. Rigorous organisation not only helps prevent fraud but also enables a faster response when it does occur.

Finally, companies must be aware that, while the bank is required to reimburse the misappropriated sums, effective recovery from the fraudsters themselves is often illusory. Fraudsters generally organise a rapid dispersal of funds across accounts located abroad, making their tracing and seizure extremely difficult. Reimbursement by the bank therefore often represents the only realistic avenue for compensation.

Conclusion

The ruling handed down by the Paris Court of Appeal on 4 February 2026 in the case between Vocalcom and Banque Palatine marks an important milestone in the application of payment services law derived from the PSD2 Directive. By partially overturning the first-instance judgment and ordering the bank to reimburse all four fraudulent transfers, the Court firmly asserts the protective principles governing the relationship between clients and their payment service providers.

This decision illustrates the rigour with which French courts monitor banks’ compliance with the contractual terms for authorising payment transactions. It also underscores the crucial importance of strong customer authentication, a security mechanism now mandatory for transactions carried out remotely that may involve a risk of fraud. The failure to implement such authentication is in itself sufficient to establish that the transaction was unauthorised and to trigger the bank’s strict liability.

Furthermore, the ruling reaffirms that contractual clauses limiting or excluding liability are largely ineffective in the face of the mandatory regime established by Articles L. 133-18 and L. 133-19 of the Monetary and Financial Code. Banks can only escape their obligation to reimburse by demonstrating fraudulent conduct on the part of the client, which requires far more than mere negligence or credulity.

This case law forms part of a broader movement which, at both European and national level, aims to strengthen users’ confidence in dematerialised payment methods. Faced with increasingly sophisticated fraud and the accelerating digitalisation of banking services, the legislature and the courts maintain a high standard of security and diligence incumbent upon financial institutions.

For companies that have been victims of misappropriation of funds, this ruling constitutes an encouraging precedent. It confirms that French law offers effective mechanisms for protection and compensation, provided that victims act promptly and seek the assistance of competent advisers in banking law. Specialist firms, such as lebot-avocat.com, assist companies on a daily basis in these complex disputes, where technical mastery of monetary and financial law rules is a prerequisite for a successful legal action.

FAQ