CA Toulouse, 2nd ch., 6 January 2026, No. 23/04208
🔑 Key Takeaways
- The regime of Articles L. 133-18 to L. 133-24 of the CMF (Monetary and Financial Code, code monétaire et financier) is exclusive of any other basis of liability: it does not allow a 50/50 sharing of liability between the bank and the customer.
- Where a transaction is unauthorised, the bank reimburses in full, or does not reimburse at all if it proves gross negligence: there is no middle path.
- Using CyberPlus / Sécur’Pass under the influence of telephone manipulation does not amount to free consent.
- A fake call from an “anti-fraud officer” on 24 December 2021, Christmas Eve, is an aggravating circumstance showing the sophistication of the fraud.
- Only the transfers that were not recalled are reimbursed: €10,250 out of the €14,780 initially debited.
Contents ▼
- What Happened? The Fraud of 24 December 2021
- What Had the Court of First Instance Decided?
- Why Is the Regime of Articles L. 133-18 to L. 133-24 Exclusive?
- What Did the Court of Appeal of Toulouse Decide?
- Why Were Only €10,250 Reimbursed Out of €14,780?
- What Is the Scope of This Judgment?
- Conclusion
- FAQ: Frequently Asked Questions
What Happened? The Fraud of 24 December 2021
On 24 December 2021, a customer of Banque Populaire Occitane receives a telephone call. The caller introduces himself as an officer of his bank’s anti-fraud department, warning that attempted suspicious transactions have been detected. The victim is guided to log in to CyberPlus and to validate several transfers presented as “securing” transactions. Three transfers are thus made for a total amount of €14,780.
Why Is the “Anti-Fraud Officer” Scam Particularly Effective?
This technique consists of calling the victim while posing as an employee of the security or anti-fraud department of their bank. The fraudster creates a situation of urgency to push the victim to act quickly and to validate transactions presented as protective. Credibility is reinforced by telephone spoofing and by knowledge of personal data collected beforehand.
The effectiveness of this technique rests on a paradox: the victim is led to validate the fraudulent transactions themselves, believing they are acting in their own interest. The choice of 24 December is no accident: bank services are short-staffed, victims are more preoccupied with holiday preparations, and their natural vigilance may be lower.
🎭 How Vishing Works (the Fake Anti-Fraud Adviser Fraud)
↓
⚠️ Alert: “fraudulent attempts detected, act immediately”
↓
💻 Guidance: log in to CyberPlus
↓
✅ Validation: 3 transfers via Sécur’Pass to “secure” the funds (≈ €14,780)
↓
⚖️ 1st instance: 50/50 split
↓
✅ CA Toulouse (6 Jan. 2026): full reimbursement of the transfers not recalled (€10,250)
What Had the Court of First Instance Decided?
The court had adopted a middle position: it had held that the victim had committed gross negligence, but that the bank had also failed in its obligations, and had split liability equally. This solution, which may seem fair on the surface, is in fact legally incorrect. It disregards the architecture of the statutory regime applicable to unauthorised payments.
Is a 50/50 Split of Liability Legally Possible?
No. This is the fundamental lesson of this judgment. The statutory regime of Articles L. 133-18 to L. 133-24 of the CMF operates on a binary logic: either the transaction is unauthorised and the bank reimburses in full, or the bank demonstrates the customer’s gross negligence and the customer bears all of the losses.
Why Is the Regime of Articles L. 133-18 to L. 133-24 Exclusive?
The regime of Articles L. 133-18 to L. 133-24 of the CMF is described as “exclusive” because it is the only legal route for dealing with unauthorised payment transactions. The parties cannot derogate from it to the detriment of the payer (Article L. 133-2 CMF: these provisions are a matter of public policy).
This exclusive nature is an essential guarantee for consumers. Without it, banks could systematically invoke a contribution by the victim to reduce their obligation to reimburse. The PSD2 Directive precisely ruled out that possibility.
⚖️ The Binary Logic of the Regime of Articles L. 133-18 to L. 133-24 CMF
✅ NO → The bank reimburses IN FULL (Art. L. 133-18 CMF), no split possible
❌ YES → The customer bears ALL of the losses (Art. L. 133-19 para. 4 CMF)
⛔ EXCLUDED SOLUTION: 50/50 split, which disregards the exclusive nature of the regime
Do CyberPlus and Sécur’Pass Prove the Customer’s Consent?
Banque Populaire Occitane argued that the transfers had been validated via Sécur’Pass by the customer personally. The Court rejects this reasoning. As in other recent decisions (CA Riom, CA Versailles), technical validation via Sécur’Pass does not demonstrate the customer’s free and informed consent where the customer was manipulated into validating transactions under the guise of a staged emergency.
What Did the Court of Appeal of Toulouse Decide?
The Court of Appeal of Toulouse sets aside the first-instance judgment in its entirety. It rejects the 50/50 split of liability as contrary to the exclusive regime of Articles L. 133-18 to L. 133-24 CMF. The combination of factors (fake anti-fraud officer, creation of urgency, fraud during the holiday period, manipulation via CyberPlus) rules out characterising the customer’s conduct as “inexcusable”.
Why Were Only €10,250 Reimbursed Out of €14,780?
A transfer recall is the procedure by which a bank asks the beneficiary’s bank to cancel a transfer that has already been executed. This procedure is not guaranteed to succeed: if the funds have already been withdrawn or transferred elsewhere by the fraudster, the recall is unsuccessful. The sooner the dispute is reported, the higher the chances of success.
In this case, €10,250 corresponded to transfers whose funds could not be recovered by recall. This is the amount that the bank was ordered by the Court to reimburse. This aspect underlines the importance of acting as quickly as possible once the fraud is discovered.
What Is the Scope of This Judgment?
The judgment of the Court of Appeal of Toulouse of 6 January 2026 has a twofold scope.
On the substance: it confirms that a fake anti-fraud officer fraud, with manipulation via the online banking interface, does not constitute gross negligence by the customer where the scheme was sufficiently sophisticated.
On procedure: it firmly invalidates the practice of splitting liability 50/50, a solution contrary to the applicable statutory regime. For victims whose claim was partially rejected at first instance on the basis of such a split, this judgment clearly opens the way to an appeal.
It is also worth recalling that the Regulatory Technical Standards (RTS) of the European Banking Authority impose on banks specific obligations to monitor transactions in real time. Banque Populaire, faced with three transfers of unusual amounts executed on 24 December, should in theory have triggered an alert or a preventive block.
📋 What This Judgment Brings in Practice
✅ Gross negligence not established: the fake anti-fraud adviser scam is too sophisticated
✅ Sécur’Pass/CyberPlus: validation under manipulation ≠ free consent
✅ Full reimbursement of the unrecoverable transfers (€10,250)
✅ Signal to the courts: splitting liability is a legal shortcut open to challenge on appeal
Conclusion
The Court of Appeal of Toulouse, in its judgment of 6 January 2026, makes an important contribution to the building of the case law. By invalidating the 50/50 split of liability, it clearly recalls the architecture of the statutory regime: exclusivity, binary logic, burden of proof on the bank.
For victims whose claim was partially upheld at first instance with an unfavourable split of liability, this judgment is a clear invitation to appeal. If you have been the victim of a fake anti-fraud adviser scam and your bank refuses to reimburse you, or has reimbursed only part of the loss, the firm LE BOT Avocat can analyse your case and support you through the dispute process.
