Bank Identity Theft: Loan Taken Out Without Your Knowledge, Unjustified FICP Registration (Your Rights and Remedies)

What is bank identity theft and how does it happen?

Bank identity theft occurs when a malicious third party uses your personal data (identity document, proof of address, payslips) to open a bank account, take out a loan or carry out financial transactions in your name and without your knowledge. This phenomenon is growing rapidly, particularly with online banks, whose fully dematerialised account-opening procedures are a prime target for fraudsters.

How can your personal documents fall into the hands of fraudsters?

Victims of bank identity theft have not necessarily been careless. Documents often leak in ordinary situations:

• Sending supporting documents as part of a joint and several guarantee for a lease, to a landlord or a third party who misuses them
• Replying to a fraudulent job offer requiring the provision of identity documents and payslips
• Phishing via a website or e-mail imitating a government body or a bank
• Mail theft or fraudulent access to a letterbox
• A data leak at a third-party organisation that held your information

Once they have obtained your documents, the fraudsters put together a complete file, sometimes embellished with falsified payslips and a fictitious address, to open an account and take out a loan. The funds are then quickly transferred abroad via international money transfer platforms, even before the fraud is discovered.

Why are online banks particularly exposed?

100% digital banks offer account-opening procedures without any physical meeting. Identity verification then relies on the online transmission of documents and, in the majority of cases, on a simple one-time password (OTP) sent by SMS. Yet this process is insufficient under the applicable European law and does not guarantee that it is actually the holder of the identity who signed the contract.

Moreover, obvious warning signs (a domiciliation address of an association notorious in frauds, a telephone number inconsistent with the supporting documents, immediate use of the account for massive international transfers) are sometimes ignored for lack of sufficient control procedures when the file is processed.

What are the concrete consequences of a fraudulent loan taken out in your name?

The discovery of a loan taken out without your knowledge can come suddenly and trigger a series of serious consequences.

Can the bank demand repayment of a loan whose signing you dispute?

This is the central question in every bank identity theft case. The legal answer is clear: the bank cannot obtain a judgment ordering you to pay if it is unable to prove that you personally and validly signed the loan agreement.

Who bears the burden of proof?

In accordance with the general principles of the law of evidence (Article 1353 of the Civil Code (code civil): “a person who claims performance of an obligation must prove it”), it is for the bank to show that the contract was indeed signed by you, and not by a third party who stole your identity. In practice, institutions produce an electronically signed contract and a transactional evidence file. But that electronic signature must still be valid under Articles 1366 and 1367 of the Civil Code and Regulation (EU) No. 910/2014 (the eIDAS Regulation).

What is a valid electronic signature on a loan agreement?

Article 1367 of the Civil Code reserves the presumption of reliability for the qualified electronic signature (QES) alone. Decree No. 2017-1416 of 28 September 2017 specifies that this presumption requires an advanced signature created using a qualified creation device, based on a qualified electronic signature certificate within the meaning of the eIDAS Regulation.

Almost all online loans are signed using a simple or advanced signature, which benefits from no presumption of reliability. Where the bank can demonstrate neither the use of a QES, nor the existence of an individual qualified certificate issued for the signatory, nor the implementation of a certified identity verification process, its claim for repayment cannot succeed if it is seriously disputed.

What technical anomalies make it possible to challenge the evidential value of the evidence file?

• Mismatch of the OID (Object Identifier): the signature service actually used (e.g. Protect&Sign®, identified by its OID) does not match the service certified by the accreditation body (LSTI, COFRAC…) mentioned in the certificate of conformity produced by the bank
• No linking number between the transactional evidence file and the loan agreement relied on, making it impossible to verify that the file corresponds to the disputed transaction
• No IP address in the evidence file
• Expiry of the certification body’s certificate of conformity at the date of the events
• Purely declarative authentication: an OTP code sent to a user whose identity was not verified by a qualified trust service provider (PSCoQ), with no in-person identity check or certified video identification
• Absence of the signatory’s individual qualified certificate, which is nevertheless the only document attesting that identity was verified before signing

What legal arguments can defeat the bank’s claim for repayment?

The absence of a qualified electronic signature and of a presumption of reliability

Under Articles 1366 and 1367 of the Civil Code and Decree No. 2017-1416, a bank that cannot justify the use of a QES benefits from no legal presumption. It then falls to the bank to positively demonstrate that the process used is reliable, which it generally cannot do where authentication amounts to sending a code to a person whose identity has not been verified by a certified provider.

Failure to comply with the investigative measures ordered by the judge

Where the bank fails to produce documents ordered by the pre-trial judge (juge de la mise en état), such as the signatory’s individual qualified certificate or proof of the identification means used, the court may, pursuant to Article 11 of the Code of Civil Procedure (Code de procédure civile), draw all consequences from this omission and consider that the required documents were not drawn up when the disputed contracts were signed.

The body of anomalies showing the identity theft

Alongside the legal arguments, the following factual elements make it possible to establish positively that the victim was not behind the signing:

• Fictitious postal address corresponding to an association’s domiciliation address for homeless people, a type of address notoriously used in online banking fraud
• Inconsistent telephone numbers: the number in the contract differs from the one on the telephone supporting documents provided, and both are unknown to the victim
• E-mail address unknown to the victim, who usually communicates from a different address
• Falsified payslips, confirmed as such by the victim’s employer
• Immediate and abnormal use of the account: massive transfers to international money transfer platforms on the day of opening, incompatible with the authorised overdraft limit
• Bank details (RIB) supplied from a banking institution that itself acknowledged being the victim of a fraud involving theft of the victim’s identity
• Missing documents in the bank’s file (tax assessment notice, RIB) whose production would reveal the institution’s own negligence when processing the file

The bank’s own written acknowledgement of the identity theft

Where the bank acknowledged in writing, even before summoning the victim for payment, that the victim was a victim of identity theft, this acknowledgement is an extrajudicial admission that can be relied on against it, which overturns any presumption in the institution’s favour and deprives its claims of any serious basis.

The bank’s liability for breach of its duty of vigilance

Where obvious anomalies should have alerted the institution when it processed the file, the bank’s liability may be engaged under Article 1240 of the Civil Code: an institution that failed to carry out the basic checks that glaring inconsistencies required incurs liability towards the victim and may be ordered to compensate the resulting loss.

What should you do immediately if you discover a loan taken out in your name without your consent?

How does the firm LE BOT Avocat defend victims of bank identity theft?

The firm regularly acts in defence against payment claims by credit institutions based on contracts signed through identity theft, as well as on behalf of claimants seeking compensation for the loss suffered. These cases, which combine consumer credit law, the evidential regime for electronic signatures and bank liability, require analysis that is both technical and legal.

An in-depth technical analysis of the opposing file

The firm systematically analyses all the documents produced by the institution: the transactional evidence file, the electronic signature provider’s certificates of conformity, the OIDs of the services used, and the general terms of identification. This analysis makes it possible to identify decisive evidential deficiencies: absence of a QES, mismatch between the certified service and the service actually used, expiry of the certificate of conformity, absence of a linking number between the evidence file and the contract relied on.

Building a body of evidence of the identity theft

In parallel, the firm builds the factual file of the identity theft: criminal complaints, employer certificates, the history of the victim’s real addresses and contact details, and correspondence with the other banking institutions that were victims of the same fraud. The aim is to set against the bank a body of serious, specific and concordant presumptions that positively establish that the contract was not signed by the victim.

Judicial defence and obtaining compensation

The firm defends the victim before the civil courts (tribunal judiciaire and Court of Appeal), both at first instance and on appeal. Counterclaims for compensation are brought where the conditions are met: non-material loss, loss of a chance resulting from the inability to carry out a property project because of the unjustified FICP registration, and irrecoverable costs. A request for an injunction, subject to a daily penalty, to remove the FICP registration is also made, in order to bring the loss to a swift end.

The applicable legal framework

• Articles 1366 and 1367 of the Civil Code: conditions for the validity of electronic writings and signatures; presumption of reliability reserved for the qualified electronic signature
• Decree No. 2017-1416 of 28 September 2017: technical conditions allowing an electronic signature to benefit from the presumption of reliability in Article 1367 of the Civil Code
• Regulation (EU) No. 910/2014 of 23 July 2014 (eIDAS): levels of electronic signature (simple, advanced, qualified); requirements applicable to qualified trust service providers; identity verification obligations before issuing a qualified certificate (Art. 24)
• Article 1240 of the Civil Code: tort liability of the bank for breach of its duty of vigilance
• Article 11 of the Code of Civil Procedure: consequences drawn from the failure to produce documents ordered by the judge
• Article 226-4-1 of the Criminal Code: criminalisation of identity theft

Frequently Asked Questions