Fraudulent Transfers After a Fake Adviser: Bank Ordered to Reimburse €32,580 for Lack of Proof of Authentication (Paris Court of Appeal, 23 September 2026, No. 25/14752)

Paris Court of Appeal (cour d’appel), Pôle 5 chamber 6, 23 September 2026, No. 25/14752 (appeal from a judgment of the Paris Court of First Instance (tribunal judiciaire) of 3 July 2025, RG No. 24/02552)

How does a fake adviser fraud lead to €32,580 of transfers?

The judgment begins with a chronology that shows the classic mechanism of phishing fraud followed by a call from a “fake adviser”. It is worth going through it in detail, because each step later serves as a foothold for the analysis of the evidence.

On 21 March 2023, the customer received an SMS from an unknown number. The message linked to a page imitating the website of the fines administration and informed him of a late payment of a €35 road traffic fine. Two days later, on 23 March 2023, he entered his bank card details on this fake site: number, security code and expiry date.

On 27 March 2023, the fraudsters used these details to initiate a purchase of €1,209.90. A notification was sent to the customer’s phone, and he refused the confirmation. This is the vigilant reflex he puts forward before the court. A few moments later, he received a call from a person with a withheld number who introduced himself as an adviser from BNP Paribas. This fake adviser told him that fraudulent transactions had been made on his account and that it was possible to remedy them.

On 27 March 2023, between 14:16 and 17:11, seven transfers were executed to bank account details (relevés d’identité bancaire) added to the list of beneficiaries. The customer discovered the fraud only on 28 March 2023, when he noticed a negative balance on his business account: €32,580 had been misappropriated. The same day, he disputed the transactions with his bank, filed a complaint at the police station and requested reimbursement. The bank replied on 31 March 2023 that no failing could be attributed to it, then confirmed its refusal on 17 April 2023.

The customer summoned the bank before the Paris Court of First Instance on 7 February 2024. The court dismissed his claim in July 2025. He appealed on 22 August 2025, and the court gave its judgment on 23 September 2026, after a hearing on 4 June 2026.

Who bears the burden of proving authentication?

The basis of the dispute is the regime governing unauthorised payment transactions, as it arises from the Monetary and Financial Code. The customer argues that he never consented to the transfers, never disclosed his username and password, and never validated any authentication request. The bank does not really dispute that the customer did not consent to the transactions. It argues, however, that the losses result from a serious failing on his part.

The court then sets out the principle that governs the entire outcome. Under Article L. 133-23 of the Monetary and Financial Code, where a payment service user denies having authorised a transaction that has been executed, it is for their provider to prove that the transaction was authenticated, duly recorded and accounted for, and that it was not affected by a technical or other deficiency. The same provision specifies that the use of the payment instrument as recorded by the provider is not necessarily sufficient to prove that the transaction was authorised or that the payer was grossly negligent.

This rule has a decisive consequence: the bank cannot begin by demonstrating that the customer was grossly negligent. It must first establish the technical regularity of the transaction. The judge moves on to examine the customer’s fault only if this first step is cleared. The court puts it thus: since the bank does not provide proof that the transactions were authenticated, there is no need to assess whether the customer may have been grossly negligent.

This architecture of proof is one of the most important points for victims. A bank that merely produces a generic computer record has not, by that alone, won its case, even if it asserts that the strong authentication system worked.

Why was the bank’s record not enough for the court?

The bank had produced two exhibits: exhibit No. 10, entitled “Computer records of the addition and then validation of transfer beneficiaries using the digital key”, and exhibit No. 12, “Computer records of the transfers”. Each contains an “authentication method” field filled in with the code “MOBILE-MBE”, supposed to indicate that the login and authentication were carried out from a mobile device by means of a digital key.

The court is not satisfied with this code. It notes that exhibit No. 10 is barely legible and, above all, that it does not detail the elements that would make it possible to verify the authentication. It lists what is missing:

• the complete authentication log files;
• the source IP addresses of each login and of each disputed transaction;
• the complete technical identification of the device or devices used to validate the transactions (device fingerprint, model, operating system, application version);
• the geolocation data associated with the transactions;
• the complete enrolment history of the digital key on the customer’s device, with the activation date, the associated device and any changes or resets;
• the technical details of the “push” notifications supposedly sent for each addition of a beneficiary: unique identifier, sending timestamp, delivery status and read status.

Nor does the bank show that the digital key had been enrolled on a device belonging to the customer at a date prior to the fraud. This point is decisive: strong authentication has evidential value only if the device was indeed linked to the person before the events.

The absence of an account agreement, a blind spot in the bank’s case

Finally, the court notes an element that could, on its own, have tipped the balance. The bank produces no contractual document binding the parties: neither an account-opening agreement, nor general or specific terms and conditions. Yet, in order to verify the authentication system applicable to the business account at the time of the transfers, the court needed to know whether it was an electronic device associated with a computer or a digital key associated with a mobile phone.

Apart from the two listings produced, the bank submitted only commercial brochures on the digital key and on the beneficiary-addition function. Marketing documents cannot take the place of an agreement. For a customer who disputes the device claimed, the absence of the contract is therefore a central argument, and it should be systematically checked in every case.

The conclusion is clear: the bank does not prove that the disputed payment transactions were authenticated, duly recorded and accounted for, and that they were not affected by a technical or other deficiency. The court therefore orders it to reimburse €32,580 to the customer.

Does the customer’s gross negligence still have to be examined?

The bank argued that the customer had been grossly negligent. It stressed that he had spoken with a stranger on the phone, that he had been informed of the risks of spoofing by its emails and by its website since December 2022, that he had admitted to the investigators that he had been in communication with the fraudster, and that seven notifications entitled “Addition of beneficiary” had been validated on his phone. It also relied on case law under which the judge must look for gross negligence where it is alleged.

The customer replied that he had been the victim of a highly sophisticated phishing attack, that he had reacted vigilantly by refusing the first purchase, and that he had reported the fraud as soon as he discovered it. He added that the wording “addition of beneficiary” was technically opaque to an unwary user.

The court did not have to decide this debate. Since the bank does not prove authentication, the question of gross negligence becomes moot. This economy of reasoning has an important practical effect: it spares the judge from ruling on the fault of a victim where the bank has not established the technical proof of the transaction.

One should nonetheless guard against drawing from this a general rule that gross negligence is never open to debate. In cases where the bank produces complete, consistent and individualised logs, the debate on the customer’s fault regains its full place. The judgment does not say otherwise; it merely recalls the order in which the judge must reason.

What late-payment penalties must the bank pay?

The customer also claimed the late-payment penalties provided for in Article L. 133-18 of the Monetary and Financial Code. He argued that the bank, informed of the unauthorised transactions on 28 March 2023, had to reimburse at the latest on the following working day, that is 29 March 2023. The bank replied that these penalties are due only where it has failed in its obligation to reimburse, and that the customer’s gross negligence could justify its refusal.

The court grants the claim. It notes that the bank does not dispute having been informed of the disputed transactions as early as 28 March 2023, and applies the statutory scale, which provides for three tiers:

The court also orders the capitalisation of interest in the terms of Article 1343-2 of the Civil Code (code civil), which means that accrued interest itself bears interest. It orders the bank to pay the costs of the first-instance and appeal proceedings, and imposes payment of €2,000 under Article 700 of the Code of Civil Procedure (code de procédure civile).

The reasoning on penalties is interesting because it decouples the two questions. The bank argued that its resistance was not wrongful since the customer might have been grossly negligent. The court answers that, as long as the bank has not proved authentication, it has not demonstrated any justification for its refusal. The delay is therefore attributable to it.

What should a fake adviser victim take from this?

This judgment does not invent a new rule, but it offers a useful framework for victims, which can be summarised in four questions to put to the bank before any discussion of fault.

First question: does the bank prove authentication? You should ask for the complete logs, the IP addresses, the identification of the devices and the enrolment history of the device. Along the same lines, a Paris Court of Appeal judgment of 1 April 2026, delivered by the same chamber, held the proof of strong authentication to be insufficient: see the analysis of that decision. A mere “MOBILE” or “MOBILE-MBE” in a column is not enough, as the decision shows.

Second question: was the device the one that is claimed? The bank must demonstrate which authentication system applied to the account. For business accounts, the secure device and the digital key are not interchangeable. The agreement and the general and specific terms and conditions are therefore documents to be requested.

Third question: were the notifications actually sent and read? The court expects precise technical data on “push” notifications: identifier, sending timestamp, delivery and read status. For another judgment delivered in a BNP Paribas fake adviser case, see this analysis.

Fourth question: did the bank react in time? The decision does not rule on this point, but it should be examined: the date on which the bank was informed starts the late-payment penalties running, and the speed of the reaction (dispute, complaint, request to recall the funds from the receiving banks) remains an element of the case.

In practical terms, the victim must act without delay. The report of the unauthorised transaction to the bank must be made within thirteen months of the debit date, on pain of being time-barred, unless the bank has not provided the information relating to the transaction. In the case decided, the customer acted on the very day he discovered the fraud, according to his pleadings.

Finally, the statements made to the bank and to the police matter. On how to present the facts to your bank and in a complaint without harming yourself, the firm’s article Bank Fraud: What to Say and Not to Say to Your Bank and in Your Complaint details the pitfalls to avoid. In this judgment, the complaint filed on the same day was accepted by the court as proof of the fraud itself.

What are the limits of this judgment and what may follow?

Three precautions are needed before transposing this decision to another case.

First, the judgment is specific to its facts. It applies a well-established principle, that of Article L. 133-23, to specific items of evidence. It lays down no new rule on the notion of gross negligence, and it does not examine the merits of the customer’s fault. Its value is chiefly evidential.

Second, the nature of the account. The account concerned is, in part, a business account. The decision does not develop the question whether the protective regime for payment service users applies in full to this type of account, nor whether the parties could derogate from it by contract. The bank does not appear to have raised a contractual objection on this point, but the question may be raised in other cases, and should be anticipated.

Finally, the possibility of an appeal on points of law. A court of appeal decision may be the subject of an appeal on points of law (pourvoi en cassation). It is therefore advisable to check, in the following months, whether the bank brings one, before regarding the outcome as final.

One angle remains under-used in this type of case: the bank’s obligations under the regulatory technical standards on strong authentication (RTS), which supplement the PSD2 Directive and require a security and transaction-monitoring mechanism. The judgment does not rely on this text. It may nonetheless serve as a framework for demanding precise logs, in addition to Article L. 133-23.

Conclusion: Technical Proof as a Precondition

The judgment of 23 September 2026 recalls something obvious that is too often lost sight of: before placing any fault on the customer, the bank must demonstrate that the transaction was properly authenticated. For a fake adviser victim, this requirement changes the nature of the debate. It is no longer only a question of whether she let herself be fooled, but whether the bank can prove, through complete technical data and contractual documents, that the transfers were validated according to the device it relies on.

In a case where the transactions take place within a few hours, the technical logs are the central exhibit. The banks hold them. It is therefore for them to produce them, and the Paris court recalls this firmly.

FAQ: Frequently Asked Questions on Fraudulent Transfers After a Fake Adviser