Electronic Signature and Fraudulent Account Opening: Fortuneo Held Liable (CA Paris, Pole 4, Chamber 9-A, 23 January 2025, No. 23/06951)

Paris Court of Appeal, Pole 4, Chamber 9-A, 23 January 2025, No. 23/06951

The Background to the Dispute: A Fraudulently Opened Account

The case originates in the remote opening of a bank account on 25 September 2021 with the company Arkea Direct Bank, which operates under the Fortuneo brand. The account was opened in the name of Ms [G] [H], but she formally denies being behind it. She states that she was the victim of identity theft orchestrated by her former partner, Mr [U] [K], who allegedly stole her identity documents and payslips to open the account without her knowledge.

The account in question was a bank account with no overdraft facility, accompanied by a credit card. Very quickly, from October 2021, the account went into debit, accumulating a negative balance of €7,644.62. As this situation was not regularised, Fortuneo brought legal proceedings to obtain repayment of that sum, plus interest at the contractual rate of 16% per year.

It was only at the beginning of 2022, when she received a recovery demand from Fortuneo for more than €6,400, that Ms [H] discovered the existence of this fraudulent bank account. Confronted with this revelation, her partner at the time allegedly then admitted to being behind the opening of the account. The situation rapidly deteriorated: the couple separated, and Ms [H] filed several criminal complaints against her ex-partner, in particular for identity theft and domestic violence.

The enquiry carried out by Ms [H] with the Banque de France revealed the extent of the fraud of which she was the victim. Her entry in the National File of Incidents of Repayment of Consumer Credit (Fichier national des Incidents de remboursement des Crédits aux Particuliers, FICP) concerned several reported incidents: an overdraft with Franfinance, an outstanding personal loan balance taken out with the company Younited, an outstanding tied credit balance taken out with PayPal, the overdraft with Fortuneo, and another overdraft with BNP Paribas. All these contracts were allegedly taken out fraudulently by stealing her identity.

The First-Instance Position: Validation of the Contract

Seised of Fortuneo’s claim, the protection litigation judge (juge des contentieux de la protection) of the Saint-Maur-des-Fossés proximity court (tribunal de proximité) gave judgment on 27 January 2023. The judgment favoured the bank, ordering Ms [H] to pay the sum of €7,644.62 as the balance of the bank account, together with interest at the contractual rate of 16% per year from 15 November 2021.

The first-instance judge allowed the bank’s claim, considering that the account-opening contract had been validly formed. He held that the bank had proved the existence of a contract signed electronically by Ms [H], and that this electronic signature offered the guarantees of reliability required by law.

This decision had immediate and serious consequences for Ms [H]. Since the judgment carried provisional enforcement (exécution provisoire), the bank was able to begin enforcement proceedings before the appeal was even examined. Ms [H] was thus subjected to seizure and sale of her goods (saisie-vente) and attachment of her earnings (saisie des rémunérations) proceedings, which caused her significant stress and aggravated her loss.

Faced with a situation she considered profoundly unjust, Ms [H] decided to appeal the judgment on 13 April 2023. She firmly challenged the validity of the contract and sought not only reversal of the judgment but also compensation for the non-pecuniary loss she had suffered as a result of the bank’s lack of vigilance and the enforcement proceedings brought against her.

The Appeal: A Challenge Based on Identity Theft

The Victim’s Arguments

In her appeal submissions filed on 22 July 2024, Ms [H] developed a detailed argument aimed at demonstrating that she was not the signatory of the bank account opening contract. Her argument rested on several complementary pillars which, taken together, created a body of consistent evidence in support of the identity theft thesis.

First, she relied on the criminal complaints she had filed. The first complaint, filed on 11 March 2022 at the police station, specifically concerned the identity theft committed by her former partner. This complaint was supplemented on 5 July 2022 to bring to the investigators’ attention the information obtained from the Banque de France concerning the multiple fraudulent contracts taken out in her name. A second complaint filed the same day concerned domestic violence committed by Mr [K] in the context of their separation.

Second, Ms [H] challenged point by point the identification details provided to the bank when the account was opened. She showed that the email address used to open the account ([Email 12]) was not hers. She habitually used another address ([Email 13]), as shown by several official documents: an order confirmation from Bouygues Télécom of 25 July 2018, the taking out of an EDF contract on 15 January 2021, and her rent receipt for September 2021.

Likewise, the mobile telephone number recorded when the account was opened ([XXXXXXXX02]) was not hers. Ms [H] produced her mobile phone bills from Bouygues Telecom for September 2021 and June 2023, which showed a different number ([XXXXXXXX01]). She argued that the number recorded in the file was in fact that of Mr [K], her ex-partner.

Third, she highlighted the manifest inconsistencies in the documents produced by the bank to justify opening the account. One of the most glaring anomalies concerned the proof of address: the account had been opened on 25 September 2021, but to prove Ms [H]’s address, the impostor had produced an EDF invoice dated 29 November 2021, a document dated two months after the account was opened. This chronological aberration should have alerted the bank.

Fourth, Ms [H] challenged the validity of the electronic signature. She noted that in the Protect&Sign evidence file produced by the bank, the summary stated that the files entitled “Contrat2”, “Contrat3”, “Contrat4”, “Contrat5” and “Contrat6” had not been signed by the signatory. This information was crucial: if six pages of the contract out of seven had not actually been signed, how could the bank claim that the contract as a whole had been validly concluded?

Finally, she argued that the bank had never been able to prove actual delivery of a bank card to her home. Yet the sending and receipt of a bank card normally constitute important evidence of the reality of the contract and of the customer’s consent. The absence of this element reinforced her doubts about the validity of the entire account-opening process.

Beyond challenging the debt itself, Ms [H] sought compensation for the non-pecuniary loss she had suffered. She claimed €10,000 in damages, on account of the bank’s lack of vigilance, which had allowed this identity theft, and also of the significant stress caused by the seizure and sale and earnings attachment proceedings brought against her despite her legitimate objections.

The Bank’s Defence

In its submissions filed on 14 June 2024, the company Arkea Direct Bank defended the regularity of the account-opening procedure and the validity of the electronic signature obtained. It asked for the first-instance judgment to be upheld in all its provisions.

The bank based its defence mainly on the reliability of the electronic signature system used. It produced the evidence file for the contract, created by the company Protect&Sign, together with an LSTI (Label de Sécurité des Technologies de l’Information) certificate for DocuSign’s electronic signature certificate creation service, which guaranteed the regularity of the process. According to the bank, this certification was proof until evidence to the contrary, and Ms [H] had not provided sufficient evidence to rebut that presumption.

As to the multiple files “contract” to “contract 6”, the bank explained that since the account-opening contract was seven pages long in total, it was normal for the customer to have had to sign seven separate documents, each corresponding to one page of the contract. This explanation was intended to dispel the doubts raised by Ms [H] about the fact that several files had allegedly not been signed.

As regards the email address and the telephone number, the bank argued that nothing proved that the email address used was not Ms [H]’s, as she could have several email addresses. Likewise, it disputed the claim that the recorded telephone number was Mr [K]’s, considering that the evidence produced on this point was not conclusive.

The bank also emphasised that it had required and received the usual identity and solvency documents: Ms [H]’s residence permit, proof of address (the disputed EDF invoice), payslips, and a home insurance certificate dated 23 September 2021. In its view, these elements constituted a sufficient body of evidence to establish that it was indeed Ms [H] who had opened the account.

Finally, the bank stressed that payments had been made into the account after it was opened: an initial payment of €500 on 4 October 2021, followed by other payments afterwards. These banking transactions, according to the bank, confirmed that Ms [H] did have access to the account and was actually using it.

As regards the enforcement proceedings, the bank justified its actions by stating that it held a first-instance judgment carrying provisional enforcement, and that it was therefore entitled to implement recovery procedures without waiting for the outcome of the appeal. It opposed any claim for compensation for non-pecuniary loss, considering that it had acted in accordance with its rights.

The Court’s Analysis of the Electronic Signature

The Legal Framework for Electronic Signatures

The Paris Court of Appeal had to rule on the validity of the electronic signature affixed to the account-opening contract. This question is central in disputes over contracts concluded remotely, because the electronic signature is the main element for establishing the customer’s consent and proving the existence of the contract.

The applicable legal framework is defined by several complementary provisions. Article 1353 of the Civil Code (Code civil), in the version applicable to the dispute, provides that a person who claims performance of an obligation must prove it, and conversely, a person who claims to have been released must justify payment or the fact that extinguished the obligation. This general rule on the burden of proof applies fully in banking matters: it is for the bank to prove the existence and validity of the contract on which it relies.

Article 1366 of the Civil Code specifies that an electronic document has the same evidential force as a paper document, provided that the person from whom it emanates can be duly identified and that it is drawn up and kept in conditions such as to guarantee its integrity. This provision therefore sets two cumulative conditions: certain identification of the signatory and a guarantee of the document’s integrity.

Article 1367, paragraph 2 of the Civil Code adds that, when it is electronic, a signature consists in the use of a reliable identification process guaranteeing its link with the document to which it is attached. The reliability of this process is presumed, until proof to the contrary, when the electronic signature is created, the signatory’s identity is ensured and the integrity of the document is guaranteed, under conditions set by decree of the Council of State (Conseil d’État).

Decree No. 2017-1416 of 28 September 2017 on electronic signatures specifies that the reliability of an electronic signature process is presumed, until proof to the contrary, when that process uses a qualified electronic signature.

This legal framework therefore establishes a presumption of reliability in favour of qualified electronic signature processes. However, this presumption can be rebutted by evidence to the contrary. That is precisely what Ms [H] sought to demonstrate before the Court of Appeal.

The Inconsistencies Noted in the File

In its in-depth analysis of the file, the Paris Court of Appeal noted numerous inconsistencies which, taken together, were enough to cast doubt on the reality and sincerity of the electronic signature affixed to the bank account opening agreement.

The first major inconsistency concerns the absence of a file number making it possible to link the Protect&Sign evidence file with certainty to the disputed account-opening request. This absence is a significant flaw in the chain of evidence, because it does not make it possible to establish with certainty that the evidence file produced corresponds to the contract signed in Ms [H]’s name. The court expressly noted that “although the respondent does produce the LSTI certification attesting to the reliability of the process used, together with a copy of Ms [H]’s identity document, the evidence file provided mentions no file number making it possible to link it to the disputed account-opening request”.

The second series of inconsistencies concerns the postal addresses. The account-opening file indicated that Ms [H] lived at [Address 7] in [Locality 9]. Yet the EDF invoice produced to justify that address was made out in Ms [H]’s name at a different address: [Address 3] in [Locality 9]. This discrepancy is all the more problematic because the EDF invoice was dated 29 November 2021, two months after the account was opened on 25 September 2021. How could a document dated in the future serve to justify an address at the time the contract was taken out? This chronological aberration should immediately have alerted the bank to the suspicious nature of the request.

Furthermore, the home insurance certificate produced, dated 23 September 2021, did relate to the address at [Address 7], but Ms [H]’s payslips for July and August 2021 also showed the address at [Address 3]. There was therefore a manifest inconsistency between the various supporting documents produced, some showing one address and others a different address.

The court also noted the inconsistencies concerning the login email address. The address stated in the account-opening file was [Email 12], whereas Ms [H] showed that she habitually used the address [Email 13]. This habitual use was proved by several official documents: a Bouygues Télécom telephony order confirmation of 25 July 2018, the taking out of an EDF contract on 15 January 2021, the confirmation in her EDF customer area, and her rent receipt for September 2021. All of these documents attested to the exclusive use of an email address different from the one entered when the Fortuneo account was opened.

As regards the telephone number, the court found that Ms [H]’s mobile phone bills from Bouygues Telecom for September 2021 and June 2023 related to the number [XXXXXXXX01], whereas the number [XXXXXXXX02] had been entered in the file. Although the court noted that it could not be established with certainty, as the appellant claimed, that the latter number was indeed Mr [K]’s on the basis of the text message exchanges produced alone, this discrepancy nevertheless constituted a further element in the body of evidence in favour of identity theft.

The court also noted Ms [H]’s apparent residential instability in the documents produced, which did not match the address declared when the account was opened. In her complaint of 11 March 2022, she stated that she lived at [Address 3], in that of 16 March 2022 at [Address 5], and in her complaint of 5 July 2022 again at [Address 3]. Her telephone bill of 27 September 2021 showed an address at [Address 6] in [Locality 14], and her payslips for January and February 2024 and her 2023 tax notice showed the address at [Address 5]. By contrast, no document corroborated residence at [Address 7], the address declared when the Fortuneo account was opened.

Beyond these documentary inconsistencies, the court took into account the steps taken by Ms [H] to report the fraud. She filed a complaint at the police station on 11 March 2022 for identity theft, supplemented that complaint on 5 July 2022 after obtaining information from the Banque de France, and also filed a complaint for domestic violence committed by her ex-partner in the context of their separation. The consistency of these steps with her account of the facts also weighed in the court’s assessment.

Finally, the court noted that Ms [H] had been the recipient of multiple reminder letters and formal notices concerning contracts she denied having taken out: a personal loan with the company Younited, a bank account opening with Hello Bank, an account with BNP Paribas, and an account with BforBank. This multiplication of banking incidents occurring in the same period, all disputed by the person concerned, corroborated the thesis of systematic identity theft rather than a mere wish to evade her contractual obligations.

The Bank’s Duty of Vigilance

Verifying the Customer’s Identity

Beyond the technical question of the validity of the electronic signature, the Paris Court of Appeal examined the obligations borne by banks in verifying the identity of their customers, particularly in the context of contracts concluded remotely.

These obligations derive from several legislative and regulatory provisions. According to the information available, the provisions of the Monetary and Financial Code (code monétaire et financier) impose on banks vigilance obligations in the fight against money laundering and terrorist financing. These obligations include in particular identifying the customer and verifying their identity by means of supporting documents.

In the context of remote account opening, these checks are all the more important because the banker does not physically meet the customer and therefore cannot visually ensure that the person present matches the identity documents produced. This situation requires the bank to exercise enhanced vigilance and a critical analysis of the documents sent to it.

The bank’s duty of vigilance is not limited to simply receiving identity documents. It also involves checking the consistency of the information provided, ensuring that the various supporting documents produced match, and detecting any anomalies that could reveal an attempted fraud or identity theft.

This duty of vigilance forms part of the broader framework of the bank’s contractual liability towards its customers. Even though, in the present case, Ms [H] denied being a customer of the bank, the institution remains bound, towards third parties who are victims of identity theft, by an obligation not to facilitate the commission of fraud through insufficient verification.

Case law has gradually developed and clarified this duty of vigilance. The courts consider that banks, as sector professionals, have the expertise and technical means needed to detect attempted fraud. They cannot content themselves with a superficial or purely formal verification of the documents sent to them.

The Breaches Found

In its analysis, the Paris Court of Appeal clearly identified Fortuneo’s breaches of its duty of vigilance. These breaches are all the more serious because they concerned manifest inconsistencies that should immediately have alerted a diligent bank.

The first breach concerns the acceptance of proof of address dated after the account-opening date. The court noted that “the bank account was opened on 25 September 2021, yet to justify Ms [H]’s address, the impostor produced an EDF letter dated 29 November 2021, that is, a later document”. This timing anomaly was so obvious that it could not escape even a cursory check. Proof of address dated in the future cannot, by definition, prove an address at the time the contract was taken out.

The second breach concerns the mismatch between the address declared in the account-opening file and the addresses appearing on the various supporting documents produced. The file stated residence at [Address 7], whereas the EDF invoice and the payslips showed [Address 3]. This discrepancy should have led the bank to ask for clarification or additional supporting documents before validating the opening of the account.

The third breach relates to the lack of in-depth verification of the email address and telephone number declared. The bank simply accepted the contact details provided without seeking to verify them or cross-check them against other sources of information. Yet, in the context of remote account opening, these contact details are essential elements for contacting the customer and securing the account.

These breaches are all the more open to criticism because the bank had sophisticated technical means for remote account opening. It used an electronic signature system certified by a recognised provider (DocuSign), which shows that it had invested in security tools. However, these technological tools do not remove the need for human analysis of the documents sent and the detection of manifest inconsistencies.

The Court of Appeal concluded that “the company Arkea Direct Bank, under the Fortuneo brand, did not show sufficient diligence in verifying the identity of its counterparty and the veracity of the documents provided when inconsistencies were manifest”. This wording is particularly severe for the bank, because it clearly establishes its breach of an essential obligation.

This breach engages the bank’s civil liability on the basis of Article 1240 of the Civil Code (formerly Article 1382), which provides that “any act whatsoever of a person which causes damage to another obliges the person by whose fault it occurred to make reparation for it”. By failing to carry out the checks that were required, the bank facilitated the identity theft of which Ms [H] was the victim and must therefore compensate the resulting loss.

The Court of Appeal’s Decision

The Reversal of the Judgment

At the end of its in-depth analysis, the Paris Court of Appeal reversed the first-instance judgment in all its provisions, with the exception of the rejection of the bank’s claim for irrecoverable costs (frais irrépétibles). This almost total reversal amounts to a complete repudiation of the assessment made by the proximity court judge.

The court concluded that “all of these elements are enough to cast doubt on the reality and sincerity of the electronic signature affixed to the bank account opening agreement on 25 September 2021 and lend credence to the existence of identity theft”. This wording is important because it does not rule definitively on the established existence of identity theft (which falls within the jurisdiction of the criminal court), but considers that sufficient doubt had been created to rebut the presumption of validity of the electronic signature.

Applying the principle that the burden of proof lies on the person claiming performance of an obligation, the court considered that the bank had not provided sufficient proof of the validity of the contract on which it relied. The inconsistencies noted in the file, the multiple complaints filed by Ms [H], and the discovery of multiple other fraudulent contracts taken out in the same period created a body of evidence sufficient to dismiss the bank’s claim.

As a result of this assessment, the court dismissed all of Arkea Direct Bank’s payment claims relating to the balance of the bank account validated on 25 September 2021. Ms [H] is therefore not required to pay the €7,644.62 claimed by the bank, nor the interest at the contractual rate of 16% per year.

The court nevertheless took care to recall an important point: “the respondent remains liable by operation of law for the repayment of the sums received in performance of the judgment that is reversed”. This clarification means that if the bank actually received sums from Ms [H] in performance of the first-instance judgment (in particular through the seizure proceedings), it will have to return them to her. This reminder stems from the general principle that the reversal of a judgment retroactively removes its effects.

Compensation of the Victim

Beyond rejecting the bank’s payment claim, the Paris Court of Appeal also examined Ms [H]’s claim for compensation for the non-pecuniary loss she had suffered.

On this point, the court made an important distinction. It first considered that the bank could not be criticised for having begun enforcement proceedings against Ms [H] after the first-instance judgment. That judgment carried provisional enforcement by operation of law, which lawfully allowed the bank to recover its claim without waiting for the outcome of the appeal. In this respect, the bank merely exercised its procedural rights.

By contrast, the court held the bank liable on another basis: the lack of diligence in verifying the customer’s identity when the account was opened. The court expressly held that “the company Arkea Direct Bank, under the Fortuneo brand, did not show sufficient diligence in verifying the identity of its counterparty and the veracity of the documents provided when inconsistencies were manifest”. This breach engages the bank’s civil liability on the basis of Article 1240 of the Civil Code.

The loss compensated corresponds mainly to the inconvenience and stress caused to Ms [H] by being asked to pay a debt that was not hers, by being entered in the FICP (National File of Incidents of Repayment of Consumer Credit), and by having to take multiple steps to have her status as a victim of identity theft recognised. This inconvenience includes in particular the steps taken with the police (filing complaints), the exchanges with the Banque de France, the legal consultations, and the time spent defending her rights in court.

The sum of €800 awarded by the court may seem modest given the extent of the inconvenience suffered. However, it corresponds to a standard assessment of non-pecuniary loss in this type of litigation. Courts generally tend towards a certain moderation in assessing non-pecuniary loss linked to administrative or judicial difficulties, favouring symbolic but real compensation.

This order requiring the bank to compensate the victim of identity theft is important because it recognises that banks bear responsibility for preventing fraud. They cannot content themselves with invoking the technical reliability of their electronic signature systems if they do not carry out a minimal check of the consistency of the documents sent to them.

As regards costs and irrecoverable costs, the court reversed the judgment that had ordered Ms [H] to pay the first-instance costs. It ordered Arkea Direct Bank to pay the costs at first instance and on appeal, which is the logical consequence of the bank losing on its claims. In addition, the bank was ordered to pay Ms [H] the sum of €2,000 under Article 700 of the Code of Civil Procedure (Code de procédure civile), in reimbursement of the irrecoverable costs incurred for her defence (lawyers’ fees in particular).

The Scope of This Decision

The Burden of Proof in Banking Matters

This decision of the Paris Court of Appeal provides important clarifications on the allocation of the burden of proof in banking contracts concluded remotely with an electronic signature. It confirms several case-law principles that are essential for consumer protection.

First, the decision recalls that the presumption of reliability attached to certified electronic signature processes is not an irrebuttable presumption. It can be rebutted by evidence to the contrary. This contrary evidence does not necessarily require technical expertise on the electronic signature system. It can result from a body of consistent evidence casting doubt on the real identity of the signatory.

In this case, Ms [H] did not challenge the technical reliability of the DocuSign system used by the bank. She did not request an expert report to show that the electronic signature process had flaws. She simply demonstrated, through objective and verifiable evidence, that she was not the one who had signed the contract. This pragmatic approach was endorsed by the Court of Appeal.

Second, the decision stresses that the bank cannot content itself with producing the technical certification of the electronic signature system. It must also be able to link the evidence file with certainty to the disputed contract (presence of a file number or other identifying elements), and to demonstrate the consistency of the elements extrinsic to the contract (identity documents, proof of address, contact details).

Third, the court recalls that manifest inconsistencies in the documents produced cannot be ignored on the pretext that the technical signature system is reliable. An invoice dated in the future, addresses that do not match across the various documents, unusual contact details: all these elements must be taken into account in the overall assessment of the validity of the contract.

This approach effectively protects consumers who are victims of identity theft. It prevents the technical sophistication of electronic signature systems from becoming an instrument serving fraud, by allowing banks to hide behind technical certification to escape liability for a failure of vigilance.

Consumer Protection Against Identity Theft

This decision forms part of a broader movement in case law towards protecting consumers against the risks linked to the dematerialisation of banking relationships and the proliferation of identity theft fraud.

Banking identity theft has become a massive phenomenon with the development of online banking services. Fraudsters have increasingly sophisticated means of obtaining their victims’ identity documents (theft, phishing, purchase on the dark web) and of opening accounts or taking out credit in their name. Victims often discover the fraud several months after the event, when they receive repayment demands or are entered in the FICP.

In the face of this threat, banks have put in place increasingly elaborate security systems, particularly in the area of electronic signatures. However, as this case shows, these technical systems are not enough to prevent all fraud unless they are accompanied by human vigilance capable of detecting manifest inconsistencies.

The decision of the Paris Court of Appeal sends a strong signal to banks: they cannot discharge their duty of vigilance by invoking the technical reliability of their systems. The security of remote banking transactions rests on a balance between technological sophistication and human analysis of the documents produced. Banks must invest not only in high-performing technical tools, but also in training their teams to detect attempted fraud.

This case law also forms part of the broader framework of consumer law. Articles L. 312-1 et seq. of the Consumer Code (code de la consommation) strictly regulate relations between credit institutions and their customers. These provisions aim to protect the weaker party to the contract (the consumer) against potential abuse by professionals. From this perspective, requiring banks to carry out in-depth checks before opening an account is a concrete manifestation of that protection.

Moreover, the decision highlights the importance of filing a criminal complaint in cases of identity theft. The complaints filed by Ms [H] were decisive elements in the file, even though they had not yet led to a criminal conviction at the time of the civil judgment. Filing a complaint creates an official, dated record of the challenge to the debt, which considerably strengthens the victim’s position in subsequent civil proceedings.

The decision also illustrates the value for victims of identity theft of gathering as much information as possible from the Banque de France. The FICP entry and the information provided by that body enabled Ms [H] to discover the extent of the fraud of which she was the victim and to show that the opening of the Fortuneo account formed part of a series of scams orchestrated by the same person.

Conclusion

The judgment handed down on 23 January 2025 by the Paris Court of Appeal is an important decision in the fight against banking identity theft and in protecting consumers in the context of the dematerialisation of banking services.

By reversing the first-instance judgment and dismissing Fortuneo’s payment claim, the Court of Appeal sent a clear message: the technical reliability of an electronic signature system does not relieve banks of the need to carry out a minimal check of the consistency of the documents sent to them when an account is opened remotely.

The inconsistencies noted in this case were manifest: proof of address dated in the future, addresses that did not match across the various documents, unusual contact details. These anomalies should have alerted any diligent bank and led to an in-depth check before the account was validated.

The decision also recalls that the presumption of reliability attached to certified electronic signatures can be rebutted by a body of consistent evidence. The victim of identity theft does not have to demonstrate technical flaws in the signature system; she can simply prove, through objective evidence, that she was not the one who signed the contract.

The compensation awarded to Ms [H] for non-pecuniary loss, although modest, recognises the bank’s responsibility in facilitating the fraud through its lack of vigilance. It is also an incentive for banks to strengthen their verification procedures when accounts are opened remotely.

For people facing a similar situation, this decision opens up interesting prospects. It shows that it is possible to effectively challenge a bank debt resulting from identity theft, provided one assembles a solid file containing objective and verifiable evidence: filing a criminal complaint, documents proving that the contact details used are not one’s own, information obtained from the Banque de France, and a demonstration of the inconsistencies in the bank’s file.

This case law comes in a context where banking fraud by identity theft is growing exponentially. It helps to rebalance relations between banks and consumers who are victims of such fraud, by recalling that responsibility for prevention does not rest solely on customers, but also on professionals who have the expertise and technical means to detect anomalies.

For banks, this decision is an incentive to strengthen their control procedures when accounts are opened remotely. Beyond technical electronic signature systems, it is essential to put in place automated consistency checks (verifying that the proof of address is not later than the request, matching of addresses across the various documents) and to train teams to detect the warning signs characteristic of attempted fraud.

Finally, this decision recalls the importance of a comprehensive approach to combating banking fraud, combining the accountability of credit institutions, the protection of victims, and criminal prosecution of the perpetrators of fraud. In this case, the complaints filed by Ms [H] against her ex-partner are still under investigation. If the criminal liability of the alleged perpetrator of the identity theft is established, this will further strengthen the victim’s position and could give rise to additional compensation.

FAQ