Fake Bank Adviser Scam: The Bank Must Reimburse Despite Strong Authentication (TJ Saint-Brieuc, 30 June 2026, No. 25/00709)

Saint-Brieuc Court of First Instance, 1st Civil Chamber, 30 June 2026, RG No. 25/00709

What happened in this fake bank adviser case?

The scenario has sadly become a classic of banking fraud. On 31 August 2024, at around 3 p.m., a customer of Caisse d’Épargne et de Prévoyance Bretagne – Pays de Loire received a text message asking her to click on a link to sort out an alleged parcel delivery problem. She entered her personal and banking details on the fraudulent page. The trap was set: the fraudsters now had her data.

That same evening came the second act. A man posing as an adviser from the Caisse d’Épargne “fraud department” called her. His script was well rehearsed: money had allegedly been fraudulently debited from her account and, to be reimbursed, she needed to raise her bank card limit and then approve a transaction on her phone. The customer complied, before suspecting the deception and blocking her bank card online. She filed a criminal complaint for fraud (escroquerie) at the police station that very day, 31 August 2024.

Too late to stop the machinery: on 3 September 2024, a transfer of €14,894.60 was debited from her current account. By letter of 10 September 2024, she gave her bank formal notice to reimburse the sum within ten days. By letter of 14 October 2024, the bank refused, considering that its customer had “contributed to her own loss through her negligence”.

The fraud unfolded as follows:

Before the court, the customer sought an order requiring the bank to reimburse her €14,894.60 on the basis of Article L. 133-18 of the French Monetary and Financial Code (code monétaire et financier). The bank asked for the claim to be dismissed: in its view, the customer had been grossly negligent, and the transaction, validated with a strong authentication device, had to be presumed authorised. The court ruled in the customer’s favour on every point.

Why does a transfer approved by the victim remain “unauthorised”?

This is the heart of the judgment and its most interesting contribution. The bank argued that the transaction, carried out “in the agreed form” (that is, validated by the customer herself using the strong authentication device), was presumed authorised. The reasoning seems intuitive: how can anyone claim a transfer was not authorised when they approved it themselves on their own phone?

What do Articles L. 133-6 and L. 133-7 of the Monetary and Financial Code say?

The court answers by going back to the statutory texts. Under Article L. 133-6 of the Monetary and Financial Code, a payment transaction is authorised “if the payer has given consent to its execution”. Article L. 133-7 adds that this consent is given “in the form agreed between the payer and its payment service provider”. Finally, Article L. 133-23, paragraph 2, states that the use of the payment instrument as recorded by the provider “is not necessarily in itself sufficient to prove that the transaction was authorised by the payer”.

Is consent given under a fraudster’s influence genuine consent?

No, the court holds, in a passage worth quoting: “Where, as in this case, the transfers were made in the context of a telephone scam and executed without the customer’s knowledge, the customer’s consent to the transaction is vitiated, so that it cannot seriously be argued that this is an authorised transaction falling outside the liability regime laid down in Articles L 133-18 et seq. of the Monetary and Financial Code.”

In other words, the physical act of validation is not legal consent. The customer did press a button on her phone, but she believed she was acting on her bank’s instructions to stop money being diverted, not ordering a transfer of almost €15,000 to a third party. Her will was captured by the fraudulent scheme: consent was vitiated, so the transaction was unauthorised, and the protective regime of Articles L. 133-18 et seq. applies in full.

The court also notes in passing that the bank did not even dispute that its customer had been the victim of a scam, which is an awkward position to hold while arguing at the same time that the transaction was “authorised”.

This classification has an important procedural consequence, which the judgment is careful to point out: once the payment service provider is sued over an unauthorised transaction, only the regime of Articles L. 133-18 to L. 133-24 applies. The customer was therefore not entitled to argue, in parallel, that the bank had breached its duty of vigilance under ordinary contractual liability. This regime is exclusive: a double-edged sword that you need to understand before drafting your summons.

Does strong authentication prove the customer’s consent?

No, and this is the second major lesson of the judgment. The bank made validation by strong authentication the centrepiece of its defence: the transaction had been approved through the Sécur’Pass device on the customer’s smartphone, so it was regular.

The court dismantles the argument with remarkable clarity: “proof that strong authentication was used cannot suffice to show that the disputed transaction was indeed authorised. Authentication is a procedure enabling the payment service provider to verify the identity of a payment service user or the validity of the use of a specific payment instrument, and in no way means that the payer consented to the transaction.”

The distinction is fundamental. Strong authentication answers the question “who is acting?”; consent answers the question “what do they want?”. A fraudster who manipulates a victim over the phone does not hack the security device: he gets its legitimate holder to operate it. Authentication works perfectly; it is the intention that is hijacked. The court draws a conclusion that is likely to be quoted in courtrooms in Brittany: “This case shows that the device supposed to prevent any form of misappropriation fails when faced with a fraudster who knows its every weakness.”

This finding matches what litigation reveals case after case: strong authentication devices, designed to stop third parties from fraudulently using payment data, are structurally powerless against manipulation fraud, where the holder is the one who approves. Treating them as a presumption of consent would strip the unauthorised transaction regime of any effect precisely in the most widespread frauds today.

Who must prove gross negligence, and why did the bank fail?

The bank had one last line of defence: its customer’s gross negligence, which, under Article L. 133-19 of the Monetary and Financial Code, makes the payer bear the losses caused by the unauthorised transaction.

Who bears the burden of proof?

The judgment methodically restates the evidential framework of Articles L. 133-19 and L. 133-23: when a user denies having authorised a transaction, it is for the payment service provider to prove that the transaction was authenticated, properly recorded and entered in the accounts, and was not affected by a technical breakdown, but also, and above all, to prove fraud or gross negligence by the user. And that proof “cannot be inferred from the mere fact that the payment instrument or the personal data linked to it were actually used”.

This rule is settled case law: the Cour de cassation has long held that a bank wishing to make its customer bear the losses must prove both gross negligence and the absence of any technical failure in the transaction (Cass. com., 12 November 2020, No. 19-12.112). Any doubt benefits the customer.

Did the failure to warn about fake adviser scams count?

Yes, and it is a striking feature of the judgment. The court notes that the bank “does not prove that it regularly informed its customers”, and more specifically the claimant, “about the practices of fake advisers”, in particular when setting up the strong authentication device linked to her account, nor that it had made sure its customer had “properly understood how it works”.

The practical lesson is valuable: in the debate over gross negligence, the prevention actually provided by the bank comes into play. A bank that rolls out a remote validation tool without showing that it warned its customers about the most common misuse of that tool, the fake adviser call, is poorly placed to blame the victim for falling for it. Banks are also required, under the regulatory framework stemming from PSD2 and its technical standards (RTS), to ensure the security of strong authentication and to monitor transactions: an angle that is still under-used in these disputes.

Is approving a transaction under manipulation gross negligence?

No, the court holds, after a very concrete assessment of the psychology of fraud. The victim did change her bank card limit and then approve a payment order she had not initiated, but “in the context of a fraud prevention speech delivered by an unidentified caller”, whose knowledge of how the services attached to her account worked “could necessarily have led her to believe that she was acting on the bank’s instructions and in her own interest”. The fraudster made her believe “that she had to act quickly to stop the misappropriations, ruling out, in the urgency, any form of logical reflection”.

This reasoning follows directly from the judgment handed down by the Commercial Chamber of the Cour de cassation on 23 October 2024 (No. 23-16.267), published in the official reports: no gross negligence can be attributed to an account holder who, contacted by someone posing as an employee of their bank, uses their personalised security device at that person’s request to thwart supposedly malicious transactions. In that spoofing case, where the fraudster displayed the bank adviser’s phone number, the Court held that the trust created by the call lowered the victim’s guard more than a simple fraudulent email would. The Saint-Brieuc court applies this analysis to the “ordinary” fake adviser, without even requiring proof that the caller’s number was spoofed.

As all the conditions for reimbursement were met (prompt reporting in accordance with Article L. 133-24, an unauthorised transaction, and gross negligence not proven), the Caisse d’Épargne was ordered to reimburse €14,894.60, plus €1,500 under Article 700 of the Code of Civil Procedure and legal costs.

What does this judgment mean for victims?

This judgment of the Saint-Brieuc Court of First Instance, delivered at first instance, obviously does not carry the authority of a Cour de cassation ruling. But it shows how the lower courts now receive and apply the protective case law that emerged from the judgment of 23 October 2024: a realistic assessment of psychological manipulation, a refusal to treat strong authentication as an evidential totem, and a strict approach to the bank’s burden of proof.

Three statements in the judgment are particularly worth raising in similar cases. First, the classification of the transaction as unauthorised because consent was vitiated, which defeats the argument, systematically raised by banks, of validation “in the agreed form”. Second, taking into account the bank’s failure to warn about fake adviser scams as a factor ruling out gross negligence. Finally, the finding that the strong authentication device “fails when faced with a fraudster who knows its every weakness”, a judicial acknowledgement that the flaw being exploited is not the victim’s gullibility but the very design of the system.

In all honesty, one caveat is needed: the outcome of these disputes still depends on the facts. Courts still find gross negligence where the victim ignored obvious warning signs or disclosed their codes in inexcusable circumstances. Each case is argued on its evidence: a precise timeline of events, the content of the messages, the history of the bank’s alerts, and how quickly the fraud was reported.

What should you do if you fall victim to a fake bank adviser scam?

The right reflexes play out within a few hours. Immediately block your payment instruments and report the disputed transaction to your bank, in writing, without delay. Article L. 133-24 of the Monetary and Financial Code sets a maximum reporting period of thirteen months after the debit, but every day counts for tracing the funds. Expressly request reimbursement on the basis of Article L. 133-18: the bank must re-credit the account no later than the end of the first business day after the report, unless it can justify suspecting fraud on your part.

Be careful, however: what you write to your bank and what you state in your criminal complaint can make or break your case. Clumsy wording such as “I approved the transaction” or “I gave my codes” is systematically used by banks to argue gross negligence. Before making any statement, read our practical guide: Banking fraud: what to say and not to say to your bank and in your complaint.

If reimbursement is refused, do not give up: the bank’s initial refusal is only a negotiating position, which the courts regularly overturn, as this judgment shows. A formal notice grounded in law and, failing that, a summons before the court make it possible to obtain reimbursement, interest and compensation for legal costs. A banking law attorney will know how to build the body of evidence (timeline, documents, case law) that makes the difference.

FAQ: your questions on reimbursement after fake adviser fraud