Fake Adviser Fraud: The Bank Ordered to Pay Despite Secur’Pass Validation (TJ Toulon, 28 May 2026, No. 25/05033)

Court of First Instance of Toulon, 2nd Chamber, 28 May 2026, case No. RG 25/05033

What happened in this fake bank adviser case?

The scenario is by now sadly classic. On 8 July 2024, a customer of Caisse d’Épargne et de Prévoyance Côte d’Azur, a retired woman aged 88, receives a telephone call from an individual presenting himself as an agent of her bank. The caller is credible: he has precise information about her identity, address and date of birth. He tells her that fraudulent transactions are under way on her bank account and that it urgently needs to be “secured”, along with her bank card.

Under the sway of this staging, several payment transactions are carried out between 8 and 10 July 2024, for a total of €11,661.82. Their nature raises eyebrows: they are flight and hotel bookings with Air France, Air Maroc, Opodo, Transavia and Booking. Plane tickets and hotel nights, bought in a rush over three days, from the account of an 88-year-old retiree.

On 19 July 2024, the customer disputes these transactions with her bank. The answer comes on 22 July 2024: refusal to reimburse. The institution’s argument is the one every victim knows by heart: the transactions were validated by means of the “Secur’Pass” strong authentication system, by entering the personal code or using the phone’s biometric functions, with no technical deficiency found. The customer files a complaint at the police station the same day. After her claim is rejected, she summons the bank before the Court of First Instance of Toulon by a writ of 6 August 2025, in order to obtain reimbursement of the transactions and damages.

Before the court, she seeks €11,661.82 as compensation for her financial loss, €3,000 for non-pecuniary loss for abusive resistance, together with legal costs. The bank, for its part, argues that her claims are inadmissible, in the alternative that they should be dismissed, and even claims, with remarkable audacity against an octogenarian customer receiving full legal aid, €3,000 in damages against her.

Why do payments validated under manipulation remain “authorised” transactions?

The starting point of the reasoning deserves a closer look, because it conditions the entire litigation strategy of victims of fake adviser fraud. In her initial writ, the claimant argued that the disputed transactions were “unauthorised” transactions within the meaning of the Monetary and Financial Code, the usual ground, that of Articles L.133-18 et seq., which require the bank to reimburse immediately unless it proves fraud or gross negligence (négligence grave) on the part of the payer.

But during the proceedings, the evidence provided by the bank confirmed that the transactions had indeed been validated through the Secur’Pass system, following an increase in the customer’s bank card limit. In her final pleadings, the claimant therefore acknowledged this reality: she accepted that she had physically taken part in the process of validating the payments (even though that validation took place under the effect of a fraudulent manoeuvre) and redirected her action to the ground of ordinary contractual liability, provided for in Articles 1217 et seq. of the Civil Code, alleging that the bank had breached its duty of vigilance.

The court endorses this analysis: since the customer no longer disputes having taken part in the validation, the transactions cannot be characterised as unauthorised transactions, nor as incorrectly executed transactions. The special regime of Articles L.133-18 et seq. “is not intended to apply”. On the other hand (and this is the whole contribution of the judgment), the bank’s liability “may, on the other hand, be sought on the basis of ordinary contractual liability, having regard to its duty of vigilance in the execution of payment transactions”.

Could the bank rely on “estoppel” to defeat the claim?

The bank tried to turn this change of basis into a procedural trap. It argued that the claimant’s claim was inadmissible, by application of the principle that no one may contradict themselves to the detriment of others (sometimes called “estoppel”), for going back on the characterisation of “unauthorised” transactions given in her writ.

The court rejects the argument on two grounds. First, on the procedural front: the claimant objected that this plea of inadmissibility, raised before the trial panel, fell within the exclusive jurisdiction of the pre-trial judge (juge de la mise en état) (Article 789 of the Code of Civil Procedure (code de procédure civile)). The court replies that the principle invoked “does not constitute an autonomous plea of inadmissibility within the meaning of Article 122 of the Code of Civil Procedure”: it stems from the requirement of procedural fairness and merely seeks to discuss the scope of a party’s successive claims. The argument therefore did not fall within the exclusive jurisdiction of the pre-trial judge.

Can the legal basis be changed during the proceedings?

Next and above all, the court holds that “a party remains entitled to change the legal basis of its claims during the proceedings provided that it changes neither the subject matter of the dispute nor the material facts relied on in support of its claims”. In this case, the facts remained strictly identical from start to finish: only the legal analysis evolved, in light of the evidence provided during the proceedings, from which it emerged that the transactions had indeed been validated through Secur’Pass.

Such an evolution of the argument “does not, on its own, amount to a wrongful procedural contradiction causing harm to the opponent”. The bank, which had moreover made lengthy submissions on the merits as to the applicable liability regime and the duty of vigilance, showed no concrete infringement of its rights of defence. The plea of inadmissibility is rejected.

The practical lesson is important for victims: discovering during the proceedings that the transactions were technically validated by oneself is not fatal to the action. Moving from the ground of the unauthorised transaction to that of ordinary liability is procedurally possible, provided the facts relied on remain the same.

How did the duty of vigilance make it possible to hold the bank liable?

This is the heart of the judgment. The court recalls that “the payment service provider is bound, as part of its duty of vigilance, to detect apparent anomalies, material or intellectual, affecting the transactions submitted to it”. This duty must admittedly be reconciled with the principle of non-interference by the banker in its customer’s affairs (non-immixtion); it is therefore for the judge “to assess concretely whether the disputed transactions had characteristics atypical enough to require additional checks by the banking institution”.

Which apparent anomalies did the court identify?

The court notes “several cumulative factors” establishing the existence of apparent intellectual anomalies. First, the customer was aged 88 at the time of the events. Second, the disputed transactions, concentrated over an extremely short period (8 to 10 July 2024), represented a particularly high total amount of €11,661.82, devoted exclusively to travel and accommodation expenses. Finally, the bank statements produced showed that these transactions were “radically unusual in light of the normal operation of the account”: a modest standard of living, with recurring daily expenses rarely exceeding a hundred euros.

The conclusion was inescapable: “the size of the payments made and their singularity in relation to the operation of the account” should have attracted the banking institution’s attention. Note the very concrete method: the court cross-references the customer’s profile (age, spending habits), the nature of the expenses (travel bought in a rush), their concentration in time (three days) and their amount (more than a hundred times the usual daily spend). This is exactly the kind of atypical pattern detection that banks’ monitoring systems are supposed to perform.

Why did the delay between the alert and the debit count against the bank?

The judgment adds a second layer to the reasoning, which is particularly interesting. It emerged from the pleadings that the disputed transactions had only actually been debited on 5 August 2024, although the customer had alerted the bank on 19 July 2024 that they were fraudulent. In other words: “the bank thus had, for several days, explicit information about a fraud reported by its customer concerning transactions not yet finally debited”.

And the court concludes, in the decisive ground of the judgment: “In these particular circumstances, CAISSE D’EPARGNE ET DE PREVOYANCE COTE D’AZUR could not limit itself to citing the use of the Secur’Pass system against its customer without carrying out further checks or taking protective measures.” Even while reiterating “the strict framework of the banker’s duty of non-interference in the management of customer accounts, recently recalled by the French Supreme Court (Cour de cassation)”, the court holds that, in view of the particular facts of the case (the customer’s age and way of life), the bank breached its contractual duty of vigilance. Its liability is established.

Why does the victim obtain only €7,000 out of €11,661.82?

The award is not for the full amount. The court notes that it emerges from the file that the claimant “herself validated the disputed transactions and provided the necessary information to the fraudster”, and that “this fault on the part of the victim contributed to the occurrence of her own loss”.

Having regard to “the circumstances of the case, the claimant’s age, the particularly sophisticated nature of the fraud, but also the claimant’s own faulty conduct that allowed the transactions to be executed”, the court sets the compensable loss at €7,000, that is, about 60% of the amount diverted. One may question this reduction: when the court itself stresses the “particularly sophisticated nature” of the scheme and the victim’s advanced age, her “fault” looks more like the result the scam was designed to achieve than an independent act of carelessness. The logic of apportionment could, at the very least, have tilted more clearly in the customer’s favour. It remains that the outcome is markedly more favourable than the all-or-nothing approach of the MFC regime, where gross negligence deprives the victim of any reimbursement.

The claim for abusive resistance is, on the other hand, rejected: “the mere rejection of a claim for compensation does not, in itself, constitute a distinct fault giving rise to a right to damages”, and the claimant did not demonstrate any separate loss. The bank, as the principal losing party, is ordered to pay the costs and €2,500 under Article 700 of the Code of Civil Procedure (the customer having full legal aid). Finally, the judgment recalls that it is provisionally enforceable by operation of law: the compensation is payable without waiting for the outcome of any appeal.

What is the significance for victims of bank spoofing?

This judgment of the Court of First Instance of Toulon forms part of an increasingly structured line of case law, which refuses to leave victims of fake adviser fraud without recourse solely on the ground that they “validated” the transactions. It offers three practical lessons.

First, the characterisation of a transaction as “authorised” does not close the courtroom door. It simply shifts the debate: from the special regime of the Monetary and Financial Code to ordinary contractual liability. On that ground, the bank can no longer content itself with pointing to the absence of any “technical deficiency” in its authentication system: it must answer for its ability to detect manifestly atypical payment patterns.

Second, the customer’s profile becomes central again. The victim’s age, standard of living, account history: these are all things the bank knows perfectly well and which make the anomaly “apparent”. A rush of plane tickets for €11,661.82 in three days on the account of an 88-year-old retiree whose daily spending is under €100 is not a transaction like any other, and banks’ information systems are precisely designed to spot this kind of break in behaviour.

Third, and perhaps the most original contribution, the chronology of the debit matters. Where the customer reports the fraud before the transactions are finally debited, the bank’s inaction becomes an established fault: informed of a reported fraud, it must carry out further checks and take protective measures, not mechanically cite the Secur’Pass validation.

Does strong authentication shield the bank from any liability?

No, and this judgment demonstrates it clearly. Strong authentication (Secur’Pass, biometric validation, one-time code) is a security mechanism required by European payment services regulation; it is not a certificate of non-liability. It allows the bank to establish that the transaction was technically validated by the customer, which rules out the unauthorised transaction regime. But it says nothing about the vigilance the institution showed in the face of a manifestly abnormal pattern of transactions.

It should also be noted that the regulatory technical standards (RTS) supplementing PSD2 require payment service providers, beyond strong authentication itself, to have transaction monitoring mechanisms intended to detect fraud patterns. This basis, still under-used in litigation, supports the idea that a bank whose systems let through without reaction a break in behaviour as flagrant as the one in this case fails to meet its own regulatory obligations. It is a lever complementary to the ordinary duty of vigilance upheld by the court.

What should you do if you yourself validated fraudulent payments?

If you have been the victim of a fake bank adviser and you validated transactions under the fraudster’s influence, the first priority is to report the fraud to your bank, in writing, without delay. This judgment shows that the speed of the report can become a decisive argument if the transactions have not yet been finally debited. Block your card, file a complaint, and keep all the evidence: statements, screenshots, call history.

Beware, however: what you write to your bank and what you state in your complaint can be used against you, as the bank will scrutinise each of your wordings to establish alleged gross negligence or to minimise its own failing. Before making any statement, read our guide: Bank Fraud: What to Say and Not to Say to Your Bank and in Your Complaint.

Finally, do not be discouraged by a refusal to reimburse based on Secur’Pass validation: as this judgment shows, that refusal is not the end of the story, but the start of the legal debate.

What should be taken from this judgment?

The judgment of the Court of First Instance of Toulon of 28 May 2026 confirms that there is a solid route to compensation for victims of spoofing who themselves validated the fraudulent transactions: the bank’s ordinary contractual liability, based on its duty of vigilance. The customer’s age, the radically atypical nature of the spending, the concentration of the transactions, an alert given before the final debit: these are all factors which, taken together, made the fraud detectable and required the bank to react otherwise than by brandishing its strong authentication system.

Admittedly, the apportionment of liability reduces the compensation, and it is regrettable that the very sophistication of the scam, nevertheless stressed by the court, did not lead to a more lenient assessment of the “fault” of an 88-year-old victim. But the essential point lies elsewhere: a bank that rejects a claim in three lines on the ground that “Secur’Pass was used” now risks being held liable, with provisional enforcement by operation of law. Each fake adviser fraud case deserves a precise analysis: chronology of the transactions, account history, date of the report, date of the debit. It is these details that, as here, tip a case.

FAQ: Frequently Asked Questions