Fraudulent Transfer and Fake Adviser: The Bank Must Reimburse Despite Strong Authentication (CA Montpellier, 21 May 2026, No. 25/02512)

Montpellier Court of Appeal, 4th Civil Chamber, 21 May 2026, case No. RG 25/02512

What happened in this case?

On 10 October 2022, a couple holding accounts at Caisse d’Épargne is contacted by telephone by a person claiming to be the bank’s fraud department. The caller is convincing: he describes precisely the transactions made on their accounts, knows their balance, and creates an atmosphere of urgency and trust. Under this pressure, the spouses make two transfers: €9,530 from their joint account, then €6,720 from the husband’s personal account.

The very next day, 11 October 2022, they realise they have been defrauded. They lodge an objection, alert the bank (which unsuccessfully attempts a “recall” operation to retrieve the funds) and file a criminal complaint for fraud with the gendarmerie. In March 2023, they send the bank a formal notice to reimburse them. The bank refuses. They then bring the matter before the Court of First Instance (tribunal judiciaire) of Montpellier, which finds in their favour on 10 April 2025 and orders Caisse d’Épargne to re-credit both accounts. The bank appeals. On 21 May 2026, the Montpellier Court of Appeal upholds the judgment in full.

Authorised or unauthorised transaction: why is it decisive?

The whole dispute turns on a legal characterisation. The Monetary and Financial Code, as interpreted by the French Supreme Court, distinguishes between two radically different situations.

The court recalls the analytical framework laid down by the French Supreme Court. On one side, the unauthorised transaction: the user never intended to pay, as in “spoofing” or fake adviser fraud (Com., 12 June 2025, appeal No. 24-13.777, published). On the other, the authorised transaction: the user did order the payment to an account they believed to be legitimate, sometimes after manipulation, as in “CEO fraud” (Com., 30 April 2025, appeal No. 24-11.255).

This distinction is not a mere matter of vocabulary: it governs the entire liability regime. In an unauthorised transaction, the customer’s protection is strong, because the Monetary and Financial Code places on the bank a reimbursement obligation as a matter of principle. In an authorised transaction, the ground is harder for the victim, because they themselves gave a valid order. Here, the court confirms the first judge’s analysis: the spouses never intended to make any transfer, they were the dupes of a scheme. The applicable regime is therefore that of unauthorised transactions.

What is “spoofing”, or fake adviser fraud?

“Spoofing” refers to the usurpation of a digital identity: the fraudster makes the bank’s real number appear on the target’s phone and presents themselves as an adviser or an anti-fraud officer. Often, they already hold personal data (name, recent transactions, balance) obtained through phishing or a data leak, which makes their pitch all the more credible. The aim is to get the victim to disclose their codes or to validate transfers themselves “to secure their account”. It is one of the most formidable frauds, because it relies on the trust that customers naturally place in their bank.

Who must prove gross negligence?

Once the characterisation as an unauthorised transaction is accepted, the burden of proof becomes the central issue, and it does not rest on the customer. The court states the rule clearly: it is for the bank, pursuant to Article L. 133-19 of the Monetary and Financial Code, to prove that the customers breached, intentionally or through gross negligence, the obligations set out in Articles L. 133-16 and L. 133-17. If the bank fails to provide this proof, the authorisation is deemed not to have been given, pursuant to Article L. 133-7.

Why did the couple not commit gross negligence?

The bank does not concede defeat: it accuses the customers of three instances of gross negligence. First, having consented to the transfers on the strength of an implausible story, without even calling the bank to check. Second, having ignored the institution’s alert emails warning that fraudsters could spoof its telephone number. Third, having entered bank details (RIB) twice that showed the funds were going to another institution, without arousing the slightest suspicion.

The court examines each of these complaints and rejects them, relying on the concrete sequence of events. Far from being passive or careless, the spouses on the contrary carried out repeated checks:

From this body of evidence, the court draws an unambiguous conclusion: the sequence of events shows that the customers were normally diligent in promptly reporting the fraud. No gross negligence, still less any intentional fault, is established with regard to Articles L. 133-16 and L. 133-17 of the Monetary and Financial Code. The court below was therefore right to order the bank to reimburse. The judgment is upheld.

This reasoning matters for victims. It enshrines a common-sense idea too often forgotten in banks’ refusal letters: being deceived by a skilful fraudster is not a fault. On the contrary, having tried to verify (by checking one’s account, by calling the fraud department back) supports the customer’s diligence, even if those checks were defeated by the sophistication of the scheme.

Does strong authentication protect the bank?

This was the bank’s central argument. It relied on Article L. 133-19 V of the Monetary and Financial Code, from which it follows, a contrario, that where the transaction was carried out with strong authentication (Article L. 133-44), the payer bears the financial consequences of the unauthorised transaction. Caisse d’Épargne maintained that it had put this strong authentication in place by requiring the login and password, which it discloses only to its customers.

The judgment does not, however, endorse the bank’s argument. The court decides the dispute on the ground of gross negligence, which it finds not established, and on that basis confirms the reimbursement. In other words, relying on strong authentication is not enough, on its own, to shift the financial burden onto the customer where the bank fails to show a serious breach on the customer’s part. This is a useful signal: institutions cannot hide behind the magic formula of “strong authentication” to systematically refuse any reimbursement.

On this point, there is an avenue that victims and their advisers should systematically explore. Beyond gross negligence alone, European payments regulation imposes precise technical standards on banks (the regulatory technical standards (RTS) supplementing PSD2): genuinely strong authentication, continuous monitoring of transactions, detection of abnormal transaction patterns. Where a transfer that is unusual in its amount, its beneficiary or its speed slips past these detection mechanisms, the bank’s liability can be debated on this basis, which is still too rarely invoked. Each case deserves a precise analysis of the security measures actually deployed by the institution.

What should you remember if you are the victim of a fraudulent transfer?

This judgment is an encouraging decision for victims of fake adviser fraud. It confirms a protective line of case law: where the fraud is spoofing and the customer never intended to pay, the unauthorised transaction regime applies, under which the bank must reimburse unless it proves gross negligence. And this proof, as the court shows, is not easy to provide: having been deceived by an elaborate scheme, having tried to verify and having reacted quickly are marks of diligence, not of negligence.

That said, precision is needed. Each case depends on its facts, and the characterisation is decisive. A fraud where the victim voluntarily discloses their validation code after an explicit alert message from their bank may be assessed more severely; CEO fraud, characterised as an authorised transaction, falls under a different and more demanding regime. This shows how important it is to have your situation analysed: the boundary between authorised and unauthorised transactions, the assessment of gross negligence and the examination of the bank’s security arrangements are all levers that are decided in the detail.

In practice, a few reflexes markedly increase the chances of obtaining reimbursement: lodge an objection immediately, file a complaint without delay, keep all traces (statements, emails, call logs), and send the bank a formal notice in writing. If it refuses, recourse is often possible. LE BOT Avocat assists victims of bank fraud in challenging refusals to reimburse and in holding the institution liable where the conditions are met.

FAQ: Frequently Asked Questions