Fake Bank Adviser Fraud: Société Générale Ordered to Reimburse €6,661 (TJ Lyon, 30 June 2026, No. 25/04819)

Court of First Instance of Lyon, community and protection division (pôle de la proximité et de la protection), 30 June 2026, RG No. 25/04819

What Happened in This Fake Bank Adviser Case?

The facts before the Court of First Instance of Lyon follow a sadly classic scenario, one that banking law practitioners now find in a considerable share of payment fraud cases: the so-called “fake bank adviser” scam, combined with spoofing of the bank’s telephone number.

How Did the Scam Unfold?

On 19 January 2024, at the end of the day, the holder of a current account with Société Générale receives a telephone call. The caller introduces himself as an agent of the bank’s stop-payment department. A decisive detail: the number displayed on her phone is precisely that of this department. This technique, known as spoofing, allows fraudsters to make a number that is not their own appear on the victim’s phone.

The supposed adviser informs her that fraudulent transactions have been detected on her account: a €10,000 transfer from her Livret A savings account to her current account and a €6,661 payment had supposedly “attracted the bank’s attention”. Under the pretext of thwarting these allegedly malicious transactions, he asks her to enter her banking credentials on her phone. In reality, these manipulations result in activating the bank’s “Pass Sécurité” system, raising the card payment limit, carrying out the €10,000 transfer from the Livret A to the current account, and preparing a €6,661 payment to the company AIRBNB.

The conversation lasts about thirty minutes. The text messages received during the call carry Société Générale numbers. It is only after hanging up that the customer checks the notification feed in her online area and realises she has just been the victim of a scam.

Why Was the Payment Debited Despite the Stop Notice?

The customer reacts immediately: the same day, 19 January 2024, she reports the fraudulent transactions to her bank adviser and the stop on her bank card is registered. The next day, 20 January, her adviser confirms that the information has been passed to the “Risk” department, that the account has been placed under a debit block and that the “remote banking” access has been switched to view-only, blocking remote transactions.

And yet, on 23 January 2024, four days after the report, the €6,661 card payment to the company AIRBNB is debited from the account. By letter of 31 January 2024, then again on 4 April 2024, Société Générale rejects its customer’s reimbursement request. She serves formal notice on the bank by registered letter of 12 February 2024, files a complaint form on 4 March 2024 and lodges a criminal complaint for fraud the same day.

Faced with the bank’s persistent refusal, she has Société Générale summoned before the Court of First Instance of Lyon by a bailiff’s writ (acte de commissaire de justice) of 20 January 2025, seeking reimbursement of the €6,661, €1,000 in damages for abusive resistance and €2,000 under Article 700 of the Code of Civil Procedure.

What Is an Unauthorised Payment Under the Monetary and Financial Code?

The court’s reasoning proceeds in two stages, faithful to the structure of the statutory regime: first, classification as an unauthorised payment transaction; second, the search for any gross negligence on the part of the payer.

The consequence of this classification is radical: Article L. 133-18 of the Monetary and Financial Code requires the payment service provider to refund the payer the amount of the unauthorised transaction immediately after becoming aware of it or being notified of it, and in any event by the end of the following business day at the latest, unless it has good reason to suspect fraud by the user and communicates those reasons in writing to the Banque de France. The bank must then restore the debited account to the state it would have been in had the unauthorised transaction not taken place.

In this case, the classification was hardly in doubt. The court notes that Société Générale did not dispute that the payment had occurred as part of a fraudulent telephone call, made by a third party unconnected with its services, who had obtained from the customer the codes needed for the transactions leading to the disputed payment. The court adds a troubling material fact, drawn from the bank’s own documents: the “Pass Sécurité” had been activated from a device running iPhone OS, whereas the customer stated that she owned a Samsung phone. In other words, the security system had been activated on the fraudster’s phone, not on the customer’s.

Is Strong Authentication Enough to Prove Consent?

This is one of the clearest contributions of the judgment. The court states that “the mere fact that the payment was made with strong authentication does not allow consent by the user to be presumed”. On the contrary, it holds, “a payment made as part of a telephone scam is an unauthorised payment falling within the liability regime provided for by Articles L133-18 et seq. of the Monetary and Financial Code”.

This position deserves emphasis, because it undermines the argument banks most frequently raise against fraud victims: “the transaction was validated with your code, so you authorised it”. This shortcut is wrong on two counts. First, the technical validation of the transaction does not establish the payer’s legal consent, which presupposes a free and informed will to make the payment in question. Second, Article L. 133-23 of the Monetary and Financial Code expressly provides that the use of the payment instrument as recorded by the bank “is not necessarily sufficient in itself” to prove that the transaction was authorised by the payer.

In a fake bank adviser fraud, the victim never consents to the fraudulent payment: she believes, precisely, that she is obstructing malicious transactions. Her will is captured and turned against her. The apparent consent obtained by the fraudster is not consent within the meaning of Article L. 133-6 of the Monetary and Financial Code.

Who Must Prove the Customer’s Gross Negligence?

Once the transaction has been classified as unauthorised, the bank has only one remaining way out of reimbursing: to show that the payer acted fraudulently or failed, intentionally or through gross negligence, to meet the security obligations imposed by Articles L. 133-16 and L. 133-17 of the Monetary and Financial Code (Article L. 133-19, IV).

On the evidentiary front, the Lyon judgment applies a now well-established framework. Article L. 133-23 of the Monetary and Financial Code places on the payment service provider the burden of proving that the transaction was authenticated, duly recorded and accounted for, and that it was not affected by a technical deficiency. Above all, it is for the provider to supply the evidence of the user’s fraud or gross negligence.

The court cites two essential milestones in the case law of the Commercial Chamber of the French Supreme Court. First, the judgment of 18 January 2017 (No. 15-18.102): proof of gross negligence cannot be inferred from the sole fact that the payment instrument or the personal data linked to it were actually used. Second, and above all, the judgment of 23 October 2024 (No. 23-16.267), delivered precisely in a spoofing case: no gross negligence can be attributed to an account holder who, contacted by telephone by a person posing as an employee of his bank whose number was displayed, uses the personalised security device at that person’s request to carry out transactions in order to avoid malicious ones.

The judgment of 30 June 2026 falls squarely in this line and shows that the solution laid down by the French Supreme Court in October 2024 now permeates the lower courts, to the direct benefit of victims.

Why Did the Court Rule Out Gross Negligence by the Customer?

Société Générale argued, as is often the case in this type of litigation, that its customer had committed gross negligence by handing over to an unknown third party, by telephone, the confidential codes used to validate the transactions. The court does not deny that this handover took place (it finds that the codes were indeed communicated) but refuses to see gross negligence in it, following a concrete and circumstantial analysis worth setting out in detail.

What Contextual Factors Reduced the Customer’s Vigilance?

The court first notes that the codes were handed over “as part of a fraudulent telephone call” of particular sophistication. According to the criminal complaint and the complaint form, the call came from the same number as Société Générale’s stop-payment department, and the text messages received during the conversation carried the bank’s numbers. The whole technical set-up therefore lent credibility to the caller’s legitimacy.

The court then focuses on the chronology and context of the call, in reasoning that relies on four converging factors: the operation was carried out quickly, within half an hour; it took place in a single telephone call that did not allow the customer to step back; the call came at a time (after 6 p.m.) when it was impossible to reach her dedicated bank adviser for verification; and finally, the conversation was intended “both to alert her to a risk of fraud and to reassure her that her contact was taking care of putting an end to that risk”, a script “likely to reduce” the customer’s vigilance.

This psychological reading of the fraud is remarkably accurate. The fake bank adviser scam rests entirely on creating an anxiety-inducing state of emergency immediately tempered by a protective figure: the fraudster creates the danger and presents himself as the saviour. The victim does not act out of carelessness, but under the sway of a manipulation that exploits her trust in her bank. By holding that handing over the codes “to this contact, admittedly unknown, does not constitute gross negligence”, the court refuses to make the victim bear the consequences of a ruse designed to defeat the vigilance of a normally attentive user.

It should be noted that the court did not stop at the absence of the telephone call log: the customer could not technically show that the number displayed was that of the stop-payment department, but the body of evidence arising from her complaint, the complaint form and the circumstances of the case was sufficient. This should reassure victims who no longer have technical proof of the number spoofing.

Did the Bank’s Lack of Prior Awareness-Raising Matter?

The judgment contains a second valuable evidentiary lesson. Société Générale put forward in evidence an awareness-raising article on this scam technique, supposed to show that its customer had been informed of how to act. The court dismisses this exhibit on two findings: the actual communication of this article to the customer was not shown, and the document was “in any event subsequent to the events”.

The lesson is clear: a bank cannot rely on a general fraud-awareness policy without showing that the customer concerned personally received it before the events in dispute. Generic information campaigns, published on an institutional website or circulated after the fraud, are ineffective in establishing gross negligence on the part of a customer who was unaware of them.

Finally, the court notes, in the customer’s favour, that she “immediately put a stop on her bank card”, behaviour which demonstrates, if need be, her perfect good faith and her promptness once the fraud was discovered, in accordance with the obligation to report without delay under Article L. 133-17 of the Monetary and Financial Code.

What Orders Did the Court Make?

As no gross negligence is established, the legal consequence follows mechanically: the court orders Société Générale to pay its customer €6,661 “in reimbursement of the unauthorised payment”. The bank, having lost, is also ordered to pay the full costs and to pay €1,000 under Article 700 of the Code of Civil Procedure, its own claim on this basis being dismissed. Finally, the court reminds us that the decision is enforceable by operation of law pending appeal (exécution provisoire), in accordance with Article 514 of the Code of Civil Procedure: the bank must pay without waiting for the appeal period to expire or for the outcome of any appeal.

Why Was the Claim for Abusive Resistance Rejected?

The customer also sought €1,000 in damages for abusive resistance, criticising the bank’s twofold refusal to reimburse. The court rejects this claim, recalling the settled line on the matter: on the combined basis of Articles 1240 and 1241 of the Civil Code (code civil), defending legal proceedings is in principle a right and degenerates into abuse “only in cases of malice, bad faith or gross error equivalent to fraud”. In this case, although Société Générale loses, it had not been shown that it displayed such malice or bad faith.

This is the only point of the judgment that may leave victims with a sense of something unfinished. One may indeed ask: when a bank maintains its refusal throughout the proceedings even though the French Supreme Court, by its judgment of 23 October 2024 (prior to the writ of January 2025), had already established the absence of gross negligence on the part of a spoofing victim, and the regime of Articles L. 133-18 et seq. is unambiguous, should the threshold for abusive resistance not be met more easily? Case law nevertheless remains demanding on this point, and the lower courts award compensation for abusive resistance only where bad faith is clearly established. Victims should be aware of this: the essence of the legal battle concerns the reimbursement itself, with additional damages remaining the exception.

What to Do If Your Bank Refuses to Reimburse a Fake Bank Adviser Fraud?

This judgment offers a valuable roadmap to victims of telephone scams faced with their bank’s refusal. Several practical lessons emerge.

First reflex: report the fraud to the bank immediately and put a stop on your card, as the claimant did in this case. Prompt reporting, besides meeting the legal obligation under Article L. 133-17 of the Monetary and Financial Code, is a factor in the judge’s favourable assessment and limits the extent of the loss.

Second step: formalise the dispute in writing. A registered letter with acknowledgement of receipt serving as formal notice to reimburse, based on Articles L. 133-18 et seq. of the Monetary and Financial Code, obliges the bank to take a position. Be careful, however, about the content of your statements: the words used in the complaint and in the criminal complaint can be exploited by the bank to argue gross negligence. Before making any written statement, we strongly advise reading our practical guide: Bank Fraud: What to Say and Not to Say to Your Bank and in Your Complaint.

Third step: file a criminal complaint for fraud. The complaint documents the facts in detail; in the Lyon case, indeed, it was largely on the statements in the complaint that the court relied to reconstruct the fraudster’s modus operandi. Here again, the wording of the complaint is strategic, and the same guide on what to say and not to say will help you avoid phrasing that backfires on victims.

Fourth step, in the event of persistent refusal: summoning the bank before the Court of First Instance. This judgment shows that the lower courts now consistently apply the protective framework set by the French Supreme Court. The bank bears a heavy burden of proof: proving gross negligence otherwise than by the mere use of the payment instrument, showing prior and personal awareness-raising of the customer about the fraud technique in question, and justifying compliance with its own obligations. On this last ground, the obligations arising from the regulatory technical standards (RTS) supplementing PSD2, namely strong authentication and transaction monitoring, are an angle of attack still under-used by victims: a payment that is atypical in its amount, its beneficiary or its timing, made just after a change of limits and the enrolment of a new device, calls into question the quality of the bank’s monitoring system. In our case, the payment was moreover debited four days after the account was placed under a stop and remote transactions were announced as blocked, a troubling circumstance that the court did not even need to rely on to order the bank to pay.

What Should We Take Away from the Judgment of 30 June 2026?

This judgment of the Court of First Instance of Lyon is excellent news for victims of fake bank adviser fraud. It confirms that the line drawn by the Commercial Chamber of the French Supreme Court on 23 October 2024 is having its full effect before the lower courts: a customer trapped by a call spoofing their bank’s number, who hands over their codes believing they are thwarting a fraud, does not commit gross negligence. It reminds us that strong authentication does not amount to consent, that the burden of proof rests entirely on the bank, and that generic awareness campaigns are not enough to exonerate the banker.

For the thousands of victims who each year face a refusal to reimburse based on their alleged negligence, the message is clear: the bank’s initial refusal is not the last word. A well-constructed action, based on Articles L. 133-18 et seq. of the Monetary and Financial Code and on case law that is now firmly established, can secure full reimbursement of the misappropriated sums and, as here, an order that the bank pay the costs of the proceedings. Each case nevertheless remains a matter of its own facts: the chronology of events, the content of the statements made to the bank and in the criminal complaint, and the quality of the evidence file make the difference between a reimbursement and a rejection.

FAQ: Your Questions About Fake Bank Adviser Fraud