Fake Bank Adviser Fraud: Without Proof of Strong Authentication, the Bank Must Reimburse (Paris Commercial Court, 13 June 2025, No. J2025000378)

Paris Commercial Court (tribunal des activités économiques, TAE), Chamber 1-10, 13 June 2025, No. J2025000378

What Happened in This Case?

In the early hours of 7 July 2023, the president of a car company receives a telephone call. The caller presents himself as an agent of her bank (the neobank Qonto) and explains that her account has been hacked and needs to be “secured” by means of a code sent by SMS to the company’s number. The managing director hands over the code. On arriving at her office, she discovers that several payment transactions have been debited from her account without her consent.

The reaction is immediate. The same day, at 5:12 pm, she files a complaint at the police station for four unauthorised transactions (€10,000, €8,000, €1,777 (rejected) and €1,540). At 6:16 pm, she disputes the transactions with the bank and sends it the complaint. The bank initiates a funds recall procedure: a first partial return of €4,797.58 is recredited on 11 September 2023, and a second of €3,479.10 on 29 April 2024. Net of these recoveries, €11,263.48 remains borne by the company.

On 23 October 2023, the company formally demands that the bank reimburse it in full, on the basis of Article L. 133-18 of the Monetary and Financial Code. On 17 November 2023, the bank refuses, raising the customer’s “gross negligence” (Art. L. 133-19, IV). The company then brings the matter before the court. Having, as a precaution, first sued the holding company “Qonto SA” and then the payment institution that actually operates the service (SAS Olinda, for which “Qonto” is the trade name), it succeeds on 13 June 2025.

Why Did the Court Dismiss “Qonto SA” from the Case?

The first difficulty, purely procedural but instructive: whom to sue? The company had initially summoned “Qonto SA”. Yet this entity is a holding company, whose purpose is to hold equity interests; it has no contractual link with the customer. The institution that actually operates the payment service and holds the account is SAS Olinda, licensed as a payment institution, which uses “Qonto” as its trade name. The court therefore dismissed the holding company from the case and ruled solely against the payment institution.

The practical lesson is useful: behind a well-known brand name there may be a structure of several companies. Before taking action, you must identify the legal entity that actually holds the licence and is the counterparty to the account agreement. Wrongly identifying the defendant is not fatal (here the company rectified it by summoning the right entity), but it wastes time and may generate costs.

Which Regime Applies to an Unauthorised Fraudulent Transfer?

The court recalls the framework. The liability of the payment service provider (PSP) in the event of an unauthorised transaction is governed by Articles L. 133-18 et seq. of the Monetary and Financial Code, which transpose the European Payment Services Directive (PSD2, Directive 2015/2366 of 25 November 2015). An important point: this regime is exclusive. Where an unauthorised payment transaction carried out by means of a payment instrument is at issue, only the regime of Articles L. 133-18 to L. 133-24 applies, to the exclusion of any other basis of liability under national law.

This principle of immediate reimbursement is the cornerstone of the protection. It is subject to qualifications, notably where the bank demonstrates gross negligence (négligence grave) by the payer (Art. L. 133-19, IV) or fraudulent conduct on their part. But, and this is where the judgment is illuminating, these qualifications apply only on condition that the bank has, beforehand, met its own obligations of proof and security.

Who Must Prove What: the Bank or the Customer?

This is the heart of the decision. The bank criticised the company for producing no evidence on the circumstances of the fraud: no copy of the SMS received, no explanation of how the fraudster could have accessed the online space without the access codes. Presented this way, the victim’s case seemed fragile. And yet she won. Why? Because the burden of proof does not rest on her.

Article L. 133-23 of the Monetary and Financial Code is unambiguous: where a user denies having authorised a transaction, it is for their payment service provider to prove that the transaction was authenticated, duly recorded and accounted for, and not affected by a technical deficiency. The provision adds, and this is decisive, that the mere use of the payment instrument as recorded by the bank “is not necessarily sufficient” to prove that the transaction was authorised by the payer or that the payer failed through gross negligence to meet their obligations.

To this reversal is added an even more powerful rule, laid down by paragraph V of Article L. 133-19: “unless they acted fraudulently, the payer bears no financial consequences if the unauthorised payment transaction was carried out without the payer’s payment service provider requiring strong authentication”. In other words, if the bank did not require (and does not prove that it required) strong authentication, the loss remains with it, whatever the customer’s attitude (the only reservation being fraud committed by the customer themselves).

What Is Strong Authentication?

Strong customer authentication (often referred to by its acronym “SCA”) is a requirement arising from PSD2 and specified in Article L. 133-44 of the Monetary and Financial Code. For risky operations such as initiating an electronic payment or a remote transaction, it requires combining at least two independent authentication elements belonging to different categories: something the customer knows (a password, a code), something they possess (a phone, a registered device) and something they are (a biometric datum). The aim is to make impersonation and remote account takeover much more difficult.

Why Were the Bank’s “Technical Logs” Not Enough?

The bank did not merely assert: it produced evidence. It submitted “technical logs” (its exhibit No. 5) supposed to establish that, on 7 July 2023, the customer had approved an unusual connection using her “trusted device” registered since March 2023, and then that the four disputed transactions had been authorised by a strong authentication process. It argued in particular that the presence of a “token” number in these logs demonstrated that the transactions had been validated.

The court did not accept this argument, and its reasoning is worth citing in spirit: it found that it was “impossible to rule on the relevance of the information” presented and on its evidential value, noting that the bank alleged, without demonstrating it, that the presence of a “token” in the logs would prove validation by strong authentication. Screenshots of internal logs, whose technical meaning and reliability the judge cannot verify, do not amount to proof of strong authentication.

The court draws the radical consequence provided for by the texts: since the bank failed to prove that it had required strong authentication for each of the transfers, and in the absence of any fraudulent conduct alleged against the managing director, it applies paragraph V of Article L. 133-19 and orders the bank to reimburse €11,263.48. The most striking passage of the judgment is where it specifies that it rules in this way “without any need to analyse or determine the exact circumstances” by which the fraudster was able to carry out the transactions, including how he obtained the identifiers and codes. The bank’s evidential failure makes any debate on the victim’s conduct unnecessary.

This is where this judgment stands apart from other decisions on fake bank adviser fraud, where the debate focuses on the customer’s gross negligence. Here, the victim was in an uncomfortable factual position: she admitted having handed over a code, did not produce the SMS, and did not enlighten the court on the exact course of the fraud. On a purely intuitive approach, her imprudence could have been held against her. But the mechanism of Article L. 133-19, V, short-circuits this debate: the preliminary question is not “was the customer negligent?”, it is “did the bank prove that it required strong authentication?”. As long as the answer is no, the customer is protected.

Do Partial Reimbursements Amount to an Acknowledgement of Debt?

A word on an argument that the company had put forward and that the court rejected; for the sake of accuracy, it must be mentioned. The company argued that the two partial reimbursements made by the bank (the “recall”) amounted to an admission: by recrediting the account, the bank would have acknowledged the principle of its debt and the absence of fault on the customer’s part.

The court did not follow it on this point. Article L. 133-21 of the Monetary and Financial Code organises a funds recovery procedure: the payer’s provider “endeavours” to recover the sums, which is merely an obligation of best efforts. By recrediting the account following successful fund recalls, the bank was only performing this obligation, without acknowledging its liability for the fraudulent transactions. The “admission” argument was therefore rejected. This changed nothing in the outcome, since the order to pay rested on the lack of proof of strong authentication; but it is a reminder that a claim must be built on the right basis.

What Is the Significance for Victims of Bank Fraud?

This judgment comes from a court of first instance (the Paris Commercial Court) and was delivered at first instance: it is open to appeal and does not carry the authority of a judgment of the French Supreme Court (Cour de cassation). Its value is not that of a binding precedent. But it illustrates, in a particularly clear way, a mechanism that victims and their advisers have every interest in mastering: the lever of strong authentication and of the burden of proof.

The practical significance is considerable. Too many refusals to reimburse rest on a peremptory assertion (“the transactions were validated by strong authentication”) that the bank never seriously documents. This judgment shows that it is necessary to systematically demand proof of this authentication, and to discuss it technically: a “token” number, a screenshot of an internal log or an obscure label do not amount to demonstration. It is for the bank to convince the judge, not for the customer to clear their own conduct.

A complementary avenue deserves to be explored in every case. Beyond the requirement of strong authentication, European regulation imposes precise technical standards on institutions: the regulatory technical standards (RTS) supplementing PSD2, covering genuinely robust authentication, continuous monitoring of transactions, and detection of transactions that are abnormal in amount, payee or speed. When a series of unusual transfers goes through without triggering the slightest alert, the real quality of the bank’s security system can be called into question. This is an angle that is still underused, and it is built case by case.

In practice, the reflexes remain the same and carry weight in the case: block the card or account without delay, file a complaint quickly, dispute in writing with the bank, keep all traces (statements, SMS, emails, call logs) and formally demand that the institution reimburse. In the event of refusal, recourse is often possible. LE BOT Avocat assists individuals and businesses who are victims of bank fraud in challenging refusals to reimburse and in holding the institution liable where the conditions are met.

FAQ: Frequently Asked Questions