Fake Bank Adviser Scam: The Bank Must Prove Use of the Code, Not Infer It (CA Paris, 26 June 2025, No. 23/16429)

Paris Court of Appeal (Cour d’appel de Paris), Pôle 4 ch. 9 A, 26 June 2025, No. RG 23/16429

What Happened in This Case?

A couple, holders of a current account at Crédit Lyonnais (LCL), dispute a series of transactions made on their account between 10 and 13 October 2022, for a total of €7,597.99. The details of the debits perfectly illustrate the modus operandi: a card payment of €50, two “invoice regularisations” of €200 and €300, a FNAC payment of €4,799.99 and a final debit of €2,248.

The scenario, classic but formidably well put together, unfolded in several stages. It all begins with a phishing text message purporting to come from Netflix: one of the spouses clicks on the link and enters their banking details. Nothing unusual happens in the following days. A week later, two text messages appear on their phone, and this is where the fraud becomes sophisticated: these messages are displayed in the bank’s usual message thread, following genuine text messages from Crédit Lyonnais, with credible wording (“A transaction for an amount of EUR 1,019.00 at FNAC.COM is awaiting validation”).

There follows a call from a fake adviser presenting himself as an agent of the “fraud department”, who provides a tracking case number (also received in the message thread). This fake adviser explains that an express delivery service will replace the Visa Premier card and collect the old one for “recycling”. A fake courier does indeed turn up, hands over a new (dummy) card and leaves with the real one. Finally, a last text message, still in the same thread, invites the victim to “block the card” via a link leading to a mirror website (“https://opposition-cartes.fr/LCL”), where the card number and PIN are entered.

The Paris Local Court (tribunal de proximité) had ordered LCL to reimburse all the sums. The bank appealed, arguing that strong authentication made its customers liable and that the fraud could only have been carried out thanks to their “active collaboration”. The Paris Court of Appeal upholds the reimbursement in full, and goes further.

Who Must Prove What When a Transaction Is Disputed?

To understand the scope of the judgment, one must go back to the evidential mechanism that governs unauthorised payments. It is a special, protective regime provided for by the Monetary and Financial Code (code monétaire et financier).

Article L. 133-23 of the Monetary and Financial Code organises the burden of proof in two stages. First, where the customer denies having authorised a transaction, it is for the bank to prove that the transaction “was authenticated, duly recorded and accounted for and was not affected by a technical or other deficiency”. Next, and this is the heart of the mechanism, the provision specifies that “the use of the payment instrument as recorded by the payment service provider shall not necessarily, of itself, be sufficient to prove that the transaction was authorised by the payer or that the payer failed, intentionally or through gross negligence, to fulfil their obligations”.

The court summarises this mechanism with a two-question grid that every bank must pass:

Why Did the Bank Lose on the Burden of Proof?

The bank fails at the very first step. The court observes that LCL produces, by way of exhibits, only generic items: press articles on Netflix phishing, a copy of a Visa Premier bank card, the summons, the judgment, the notice of appeal and the general terms and conditions. No exhibit shows that it was the couple’s personal authentication data that were used, or that there was no technical failure.

The court puts it bluntly: it is for the bank to prove this point, and “it cannot merely assert that the transactions could only have been made thanks to these identification elements […] without demonstrating it positively”. In other words, the deductive reasoning (“since the transaction was authenticated, the customer necessarily used their card and code”) is rejected. The bank expounded at length on the merits of strong authentication without ever producing the logs or technical evidence specific to the case.

Is Strong Authentication Enough to Make the Customer Liable?

The bank argued that the addition of the phrase “not necessarily” to Article L. 133-23 meant, a contrario, that a transaction validated by strong authentication is deemed authorised. The court refuses this reading. Strong authentication is a requirement that bears on the bank; it does not create an irrebuttable presumption against the customer. Even where authentication is strong and the data were used, the bank must still prove the customer’s fraud or gross negligence. Strong authentication is therefore not a legal shield for the bank: it is a technical obligation that falls on it.

Did the Couple Commit Gross Negligence?

Even if the bank had passed the first evidential step (which is not the case), it would have failed on gross negligence. The court examines each alleged behaviour in turn and dismantles the bank’s argument point by point.

Is Disclosing One’s Account Number a Fault?

On the initial Netflix phishing, the court notes that the husband admitted having clicked on a link and entered his banking details, but that he never stated that he had given his PIN or even his card number on that occasion. Yet, the court stresses, the bank account number is not among the confidential items that must never be disclosed: it appears on all cheques, on the bank identity details (RIB) requested by many administrations, and “circulates, without fault on the part of the account holder, through very many hands”. This information in principle only allows transactions to be made for the benefit of the account, not to its detriment. Above all, even supposing negligence at this stage, nothing shows that it was the origin of the subsequent debits.

Why Does the Hijacked Message Thread Change Everything?

This is the most valuable contribution of the judgment. The fraudulent text messages appeared in the genuine message thread of Crédit Lyonnais, following genuine messages from the bank concerning, for example, the availability of school certificates or the activation of Apple Pay. For the court, “the fact that it was a message inserted in this way into this thread with his bank was such as to put him at ease”. The customer could therefore, without fault, respond to the person presenting himself as an agent of the fraud department.

The court moreover recalls the now well-established nuance in case law: a user who answers a call appearing on their phone as coming from their bank commits no fault, whereas a user who answers messages whose fraudulent nature should have been obvious, or clicks on manifestly suspicious links, commits gross negligence. Here, the insertion into the legitimate thread clearly places the couple in the first category.

Is Handing Over One’s Card to a Fake Courier Gross Negligence?

The bank insisted on the handing over of the card to the courier and on the fact that the couple should have spotted the fake card. The court rejects both arguments. On the one hand, it is in no way established that the PIN was given to the courier: this does not emerge from any statement. And failing to destroy the card before handing it over is not gross negligence, since a card without its code, which the customer already believed to be blocked, could not, in his mind, be used for anything.

On the other hand, the widespread use of home deliveries, including on public holidays, made the existence of such an express replacement service credible, especially as banks themselves send cards by post. As for the fake card, only its wording was incomplete: for an average and reasonable consumer, the rest of its appearance was not obviously distinguishable from a real card, and the accompanying letter was “particularly credible”. A bank customer not being an expert, failing to notice immediately an incomplete wording does not constitute gross negligence.

Finally, even entering the card number and PIN on the mirror blocking website is not enough to characterise gross negligence: put at ease by the use of the message thread, which appeared safe, and faced with a mirror website “that had all the appearance of the bank’s website” with a credible address, the customer could act without characterised fault. The court also notes that the report was made on the very day the fraudulent payments appeared, 10 October 2022, so no failing in raising the alert can be held against them.

Why Is the Bank Ordered to Pay Damages for Abusive Resistance?

This is the second striking lesson. Where the court below had refused to compensate non-material damage, the court reverses and awards €500 in damages. The reason is scathing: the bank “merely proceeded by assertions without demonstrating in any way that the disputed transactions had been carried out using the code, even though it expounds in its pleadings on the merits of strong authentication”. This stance, refusing reimbursement while being unable to provide the slightest proof, amounts to abusive resistance that caused non-material damage to the customers.

The signal is important for victims: a refusal to reimburse based on mere assertion, with no technical evidence in support, can be penalised in itself, beyond the simple return of the funds. Abusive resistance becomes an additional lever for compensation.

What to Take Away If You Are a Victim of a Fake Bank Adviser Scam?

This judgment confirms an increasingly clear line of case law, demanding of banks and protective of victims. Several practical reflexes emerge from it.

First, do not be impressed by the strong authentication argument. As long as the bank does not produce technical evidence specific to your case showing that your data were actually used, its position is legally fragile. Mere reference to its general terms and conditions or to press articles on phishing is not enough.

Next, document the sophistication of the fraud: a screenshot showing that the fraudulent text messages slipped into the bank’s genuine message thread, the appearance of the fake website, the credibility of the fake card and its accompanying letter. It is precisely these elements that tip the assessment towards excusable carelessness rather than gross negligence.

Report and notify without delay as soon as you discover the transactions: here, notifying on the very same day was decisive in dismissing any criticism of failing to act. File a criminal complaint, which is useful for the detailed account of the fraud, without forgetting that a criminal complaint is not, in itself, a civil basis for reimbursement.

Finally, on the question of residual levers, bear in mind that the technical obligations imposed on banks by the RTS Regulation (the Regulatory Technical Standards that supplement PSD2: effective strong authentication, transaction monitoring, detection of abnormal patterns) are an angle that is still under-exploited. Where a bank fails to demonstrate the effective implementation of these standards, its liability can be sought on that basis.

Overall, this judgment offers victims of fake bank adviser scams a turnkey line of reasoning: demand positive proof of the use of the authentication data, refuse the automatic deduction drawn from strong authentication, and rely on the sophistication of the scheme to rule out gross negligence, or even obtain damages for abusive resistance.

FAQ: Frequently Asked Questions