CA Bordeaux, 1st civil chamber, 9 June 2026, No. 23/05481
🔑 Key Takeaways
- The Bordeaux Court of Appeal upholds the order against Caisse d’Épargne to reimburse €6,000 embezzled by a fake adviser, and adds €1,000 for moral damage.
- The burden of proof lies on the bank: it is for the payment service provider to demonstrate that the transaction was authenticated, duly recorded and not affected by a technical deficiency (Art. L. 133-23 of the Monetary and Financial Code (code monétaire et financier)).
- The bank did not produce the log journal, only internal screenshots: no transaction number, no “Secur’pass” code, no confirmation SMS. Strong authentication was therefore not proved.
- “Spoofing” (the bank’s number displayed, knowledge of the adviser’s name) put the customer at ease: the court rules out gross negligence.
- The mere disclosure of a password is not enough to establish the payer’s consent (Cass. com., 10 December 2025, No. 24-20.778).
- The bank’s failure to comply with its obligation of immediate reimbursement (Art. L. 133-18) justifies separate compensation for moral damage.
Contents ▼
- What happened in the case decided in Bordeaux?
- Who must prove what in the event of a fraudulent transfer?
- Why did the bank lose despite its “Secur’pass”?
- Are “spoofing” and a fake adviser enough to establish gross negligence?
- Why was Caisse d’Épargne also ordered to pay for moral damage?
- What is the significance of this decision for fraud victims?
- What should you do if you are the victim of a fraudulent transfer?
- FAQ: Frequently Asked Questions
What happened in the case decided in Bordeaux?
The case begins on 22 December 2021. A Caisse d’Épargne customer receives a telephone call. At the other end of the line, a person introduces himself as an adviser from the “opposition department” of her bank. The number displayed on her telephone is indeed that of the institution. The caller knows her account number and the name of her usual adviser. All the trust signals are green.
The fake adviser explains that her account is the target of fraudulent financial movements: transfers are supposedly being made to the United States, on the initiative of a certain “[F]”. To “stop” these manoeuvres, he asks her to reset her password and to give him the new code. Convinced that she is being hacked and can put an end to the attack, the customer complies. The same day, cautious nonetheless, she sends an email to her real bank adviser to check. This email goes unanswered: the adviser was on leave.
In the night of 26 to 27 December 2021, the blow falls. The customer receives a message informing her that a transfer of €6,000, the whole of her savings, held in her Livret d’Épargne Populaire (a regulated savings account), has just been made to the account of a certain “[N] [X]”. In the meantime, a beneficiary had been added to her account, the funds had passed from her savings to her current account, then from the current account to this new beneficiary. The customer alerts her bank again by email. In all, she will notify the institution three times. She is never called back.
There follows a classic obstacle course: a formal notice of 10 January 2022, the bank’s refusal on 22 March 2022 on the ground that the customer was “solely responsible” for the fraud, a further formal notice by a lawyer on 7 June 2022, another refusal. The customer eventually summons Caisse d’Épargne on 7 February 2023.
The Court of First Instance (tribunal judiciaire) of Angoulême, by judgment of 31 October 2023, rules in her favour on the essentials: the bank is ordered to reimburse the €6,000, but the customer’s claim for damages is dismissed. The bank, dissatisfied, appeals the whole of the judgment. The customer, for her part, challenges the rejection of her moral damage claim. It is this cross-appeal that the Bordeaux court decides on 9 June 2026.
A payment transaction is said to be “unauthorised” where the account holder has not given consent to the order executed. In payment law, authorisation presupposes genuine consent by the payer: the fact that security data were used does not mean that the transaction is, legally, authorised.
Who must prove what in the event of a fraudulent transfer?
This is the heart of the decision, and it is the question that alone determines the outcome of most banking fraud disputes. The bank maintained that the transactions had been “authorised” within the meaning of Articles L. 133-6 and L. 133-23 of the Monetary and Financial Code, and that the customer could therefore not rely on Article L. 133-19 (which governs the reimbursement of unauthorised transactions). In the alternative, it invoked the customer’s “gross negligence”, alleging that she had knowingly disclosed her credentials.
The Bordeaux court sweeps this construction aside by recalling the fundamental rule of the regime derived from the European Payment Services Directive (PSD2). The disputed transactions fall under Articles L. 133-12 et seq. of the Monetary and Financial Code, in the wording resulting from Order No. 2017-1252 of 9 August 2017. And Article L. 133-23 is unambiguous: where a user denies having authorised a transaction, “it is for their payment service provider to prove that the transaction in question was authenticated, duly recorded and accounted for and that it was not affected by a technical or other deficiency”.
In payment matters, it is the bank, not the customer, that must prove that the disputed transaction was indeed authenticated and technically flawless. If it fails to do so, it must reimburse. The customer does not have to show that they were the victim of fraud: it is enough for them to deny having authorised the transaction.
The same provision adds a decisive clarification: “the use of the payment instrument as recorded by the payment service provider is not necessarily sufficient in itself to prove that the transaction was authorised by the payer”. In other words, the mere fact that the codes “worked” proves neither the customer’s consent nor her gross negligence.
The court relies on a series of decisions of the Commercial Chamber of the French Supreme Court (Cour de cassation) which now form solid case law:
→ Cass. com., 23 October 2019, No. 18-15.823: proof of gross negligence cannot be inferred from the mere fact that the payment instrument was actually used.
→ Cass. com., 12 November 2020, No. 19-12.112 and Cass. com., 30 April 2025, No. 24-10.149: before blaming the customer for gross negligence, the bank must first prove that the transaction was authenticated and free of technical deficiency.
→ Cass. com., 10 December 2025, No. 24-20.778 (F-B): the mere disclosure of the password makes it possible to initiate an order, but is not enough to establish the payer’s consent. That consent must be proved by the bank.
The logic is relentless: as long as the bank has not cleared the first hurdle, proving the regular authentication of the transaction, it cannot even reach the second, that of the allegation of gross negligence. It is an order that banking institutions regularly try to reverse, and that the courts put back the right way round.
Why did the bank lose despite its “Secur’pass”?
Caisse d’Épargne put forward its “Secur’pass” device, presented as strong authentication combining an element known only to the customer, the use of a mobile telephone and a personal characteristic (fingerprint, facial recognition). On paper, the device ticks the boxes for the strong authentication required by European law. On paper only.
Derived from the PSD2 Directive, strong authentication relies on at least two independent elements belonging to the categories “knowledge” (a password), “possession” (a telephone) and “inherence” (a fingerprint, a face). It is designed so that the compromise of one of the factors is not enough to validate a transaction. This is precisely what is meant to prevent a fraudster, even in possession of a password, from emptying an account.
The problem for the bank is that it never managed to prove that this strong authentication had actually been deployed for the disputed transactions. The court notes the gaps in the file precisely:
✗ No log journal, only copies of internal screens from the bank’s software.
✗ The operation adding the beneficiary “[X]” on 26 December is not detailed and contains no reference code as to the time of activation of “Secur’pass”.
✗ The €6,000 transfer appears without a transaction number or “Secur’pass” code, even though that device is mentioned.
✗ The ordering party is identified as… the fraudster “[X]” himself.
✗ Nothing shows that a confirmation SMS was sent to the customer’s telephone.
The court draws a damning factual conclusion for the institution: the addition of a beneficiary, then the transfers from the savings account to the current account and from the current account to that beneficiary, were carried out with a single act of authentication, without any validation by SMS or email. A revealing detail: the bank’s screen record states that the operation was performed by an “agent 99999999”, “functional station 000000”, an identity that the bank itself was unable to explain.
The conclusion is inescapable: “the bank does not demonstrate that strong authentication was used for these transactions, nor does it explain the reasons for this technical deficiency”. Yet the absence of strong authentication is not a technical detail. It is precisely the failure that allowed a third party, using a single password disclosed under pressure, to empty the account. Had the device really worked, the customer would have received an SMS code to validate each transaction, which never happened.
The customer denies having authorised the transaction
↓
The bank must prove strong authentication + the absence of technical deficiency
↓
Screenshots ≠ log journal → insufficient proof
↓
Strong authentication not demonstrated
↓
The bank reimburses, without even having to examine the customer’s negligence
Are “spoofing” and a fake adviser enough to establish gross negligence?
Even though the question of gross negligence had, strictly speaking, become superfluous (the bank having already failed to prove authentication), the court takes care to answer it. And its answer is instructive for all victims of this type of scam.
“Spoofing” refers to the impersonation of a trusted correspondent. In telephone spoofing, the fraudster makes the official number of the victim’s bank appear on the victim’s screen. Combined with personal information (the adviser’s name, the account number), the technique creates an almost perfect illusion of legitimacy, designed to neutralise the victim’s distrust.
The court describes the mechanism of manipulation with finesse. The customer disclosed her codes on 22 December 2021 while believing that she was dealing with a Caisse d’Épargne employee: the number displayed was the bank’s, the caller knew her account number and the name of her adviser, and he made her believe she was being hacked. She thought that, by passing on this code, she was putting an end to the attack. The court expressly characterises these facts as identity impersonation (“spoofing”) and stresses that they “put [the customer] at ease and lowered her vigilance”, all within a very short time, by telephone, and even as she was attempting, in vain, to verify the information with her real adviser.
The court concludes that “it cannot be argued that [the customer] voluntarily passed on her password or her code” in a way that would establish gross negligence. The disclosure was obtained by trickery, in a context of urgency manufactured from scratch. The real point of failure is not the customer’s vigilance but the bank’s security system, “insufficient to allow these transfers without recourse to the ‘Secur’pass'”, which alone would have made it possible to require the entry of data and a code received by SMS.
Gross negligence is conduct of characterised imprudence which, alone, allows the bank to refuse to reimburse an unauthorised transaction (Art. L. 133-19, IV). But case law assesses it strictly: a victim manipulated by a fraudster exploiting the bank’s official appearance does not, in principle, commit gross negligence. It is for the bank to prove it, and it cannot infer it from the mere use of the codes.
This assessment follows the now consolidated position of the French Supreme Court: the sophistication of “spoofing” is precisely what, most often, rules out gross negligence. The more credible the staging, the less the victim can be blamed for having been convinced.
Why was Caisse d’Épargne also ordered to pay for moral damage?
This is the most interesting contribution of the decision, because it overturns the first-instance judgment on this point. The Angoulême court had refused to compensate the customer’s moral damage. The Bordeaux court awards her an additional €1,000.
The basis for this order deserves attention. The court relies on Article L. 133-18 of the Monetary and Financial Code, which requires the bank to reimburse the amount of an unauthorised transaction immediately after being informed of it, and at the latest by the end of the following business day, unless it has good reasons to suspect fraud by the user, reasons which it must then communicate in writing to the Banque de France.
As soon as an unauthorised transaction is reported to it, the bank must in principle reimburse the customer without delay, at the latest the following business day. It may defer this reimbursement only if it suspects fraud by the customer themselves, provided that it informs the Banque de France in writing. Failing to comply with this timetable, it engages its liability.
In this case, the bank never met any of these conditions. It had no good reason to suspect fraud by the customer: on the contrary, the emails she sent it, the telephone call made to the bank and the filing of a criminal complaint showed that she was the victim, not the author, of the fraud. And the bank did not communicate any reasons in writing to the Banque de France either. Yet, although the events took place in the night of 26 to 27 December 2021, the customer had to serve a formal notice on the bank on 10 January 2022, then again through a lawyer on 7 June 2022, without the institution complying with her demands.
The court infers that the bank failed to comply with its legal obligation, which caused the customer a distinct moral damage: the significant stress experienced during these long months of waiting and refusals. Hence the award of €1,000 under this head, in addition to the €6,000 of financial loss and €3,000 in irrecoverable costs (frais irrépétibles) on appeal.
This part of the decision is valuable. It means that the bank’s failure to comply with its obligation of prompt reimbursement is not neutral: the mere fact of dragging out a file, multiplying refusals and forcing the victim into several years of legal proceedings can be penalised in itself, independently of the return of the embezzled capital.
What is the significance of this decision for fraud victims?
The judgment of 9 June 2026 invents nothing: it faithfully applies the PSD2 regime and the case law of the French Supreme Court. But its value lies in the clarity with which it articulates the various levers, and in the severity it shows towards a bank that had been content to assert without demonstrating.
First lesson: screenshots do not amount to proof of strong authentication. Too often, institutions produce extracts from their own systems, formatted for the occasion, hoping they will carry the judge’s conviction. The Bordeaux court reminds us that a genuine, time-stamped log journal is required, tracing each step of the authentication. Failing that, the doubt benefits the customer.
Second lesson: the absence of a validation SMS is a powerful indication of the absence of strong authentication. When an account is emptied without any code having been sent to the account holder’s telephone, it is often because the security device did not play its role, and liability shifts to the bank.
Third lesson: moral damage is compensable where the bank drags its feet over reimbursement. Victims have every interest in making a separate claim under this head, documenting the stress, the repeated steps taken and the time elapsed between the report and the reimbursement.
One limit on its scope can nonetheless be noted. The court’s reasoning remains largely dependent on the evidentiary shortcomings of that bank, in that case. A bank that produced a complete log journal, demonstrating an impeccable strong authentication path, would shift the debate onto the more difficult ground, for the victim, of gross negligence. The decision therefore does not dispense with a careful, case-by-case analysis of the technical evidence actually filed. Above all, it confirms one thing: the first battle is won or lost on proof of authentication, and it is the bank that bears the burden of it.
What should you do if you are the victim of a fraudulent transfer?
The Bordeaux decision sets out a practical roadmap for anyone finding themselves in a comparable situation.
① Report immediately the transaction to the bank, by any traceable means (email, registered letter), and keep every proof of sending.
② Block your card or accounts without delay and request reimbursement in writing on the basis of Articles L. 133-18 and L. 133-19 of the Monetary and Financial Code.
③ File a criminal complaint: the complaint does not, on its own, found civil compensation, but it usefully establishes the reality of the fraud and your status as a victim.
④ Demand the log journal: ask the bank for proof of strong authentication. Its absence is a central argument.
⑤ Document the moral damage: keep a record of the refusals, the reminders and the time elapsed.
As regards legal grounds, a word of caution is in order. There is a temptation to invoke the bank’s breaches of its anti-money laundering vigilance obligations (AML/CFT) in order to claim damages. This route is closed: the French Supreme Court has held that these obligations have “the sole purpose” of combating money laundering and terrorist financing, and that a victim cannot rely on them to obtain compensation. By contrast, one lever remains under-exploited: the technical security obligations imposed on banks by the RTS (the European Banking Authority’s technical standards that supplement PSD2 on strong authentication and the detection of anomalies). Where the bank has failed to meet these standards, as here, by letting a cascade of transactions through without strong authentication, it is on this ground, and on that of Articles L. 133-18 et seq., that compensation is built.
Key Takeaways
The Bordeaux Court of Appeal’s decision of 9 June 2026 confirms a reality that banks are slow to absorb: faced with a disputed payment transaction, it is not for the customer to prove that they were duped, but for the bank to prove that the transaction was properly authenticated. Screenshots are not enough. An account emptied without a single validation SMS betrays a failure of the security device, and that failure has a price. The additional order for moral damage also sends a clear signal: the bank’s passivity in the face of a victim who raises the alarm repeatedly has a cost.
If you have been the victim of a fake adviser, of “spoofing” or of a transfer that you never authorised, and your bank refuses to reimburse you by invoking your alleged negligence, this decision shows that the fight is far from lost. The firm LE BOT Avocat, dedicated to banking law, supports fraud victims in reconstructing the evidentiary file and in holding their institution liable.
