Fake Bank Adviser Scam: Caisse d’Épargne Ordered to Reimburse €10,002 for Lack of Proof (TJ Nice, 9 June 2026, No. 22/04823)

Court of First Instance of Nice, 4th Civil Chamber, 9 June 2026, No. 22/04823

What happened in this case?

The story has become sadly commonplace, which is precisely what makes this decision instructive. A man managed his mother’s bank accounts, held with Caisse d’Épargne et de Prévoyance Île-de-France. One day in February 2022, he received a text message from a telephone number, asking him to call that number back to confirm or deny a transaction of €917.13. Worried, he called back: in his mind, the aim was to block a suspicious transaction, certainly not to authorise it.

Several telephone calls followed from an individual posing as a trusted contact. This person asked him to carry out a number of manipulations on the screen of his banking app. The customer complied, convinced he was securing his accounts. In reality, he had just been caught in a particularly sophisticated “fake bank adviser” fraud.

The consequences were not long in coming. His own accounts and his mother’s were debited by a series of fraudulent payments, to beneficiaries named “Money” (€5,000 in two instalments) and “Boulanger” (also €5,000 in two instalments), for a total of €10,002, including €2 in transfer fees. A detail that would prove important: the documents produced later revealed that the fraudster was operating from IP addresses located outside the region, even in Morocco.

The customer reacted immediately: he alerted the bank the day after the events, then filed a criminal complaint on 1 April 2022, about six weeks after the fraud. He then asked his bank to reimburse the sums debited. Caisse d’Épargne refused, citing the payer’s alleged negligence, claiming that he had passed his authentication codes to the fraudsters. With no agreement reached (the bank’s own mediator having taken a categorical position against the customer), the matter was brought before the Court of First Instance of Nice. After the mother’s death, her two daughters voluntarily joined the proceedings, as her successors in title.

What was the legal issue in dispute?

The whole difficulty in this type of case comes down to a question of characterisation: was the payment transaction authorised or unauthorised? The entire applicable regime and, above all, the allocation of the burden of proof depend on the answer.

The bank’s position consisted in circumventing this characterisation. According to Caisse d’Épargne, the customer had in reality given an “objective consent” to the transactions: since he had himself carried out manipulations on his app, since the payments had been “duly authenticated” through the Secur’Pass service, and since this strong authentication system had, in its view, suffered no failure, the transactions had to be treated as authorised. And if they were authorised, the protective regime of Articles L. 133-1 et seq. of the Monetary and Financial Code (code monétaire et financier), reserved solely for unauthorised transactions, had to be set aside. Only in the alternative did the bank invoke the customer’s gross negligence to escape liability.

The customer, for his part, argued exactly the opposite: he had never consented to the transfers, had never validated the addition of the beneficiary accounts, and it was for the bank, as payment service provider, to prove fraud or gross negligence on his part. The whole point of the judgment lies in the choice between these two readings.

Who must prove what in the event of a fraudulent transfer?

The Nice court takes care to recall the evidentiary framework laid down by the Monetary and Financial Code, and this is the heart of the decision. The central provision is Article L. 133-23.

This last sentence is decisive. The legislator expressly anticipated the argument that banks systematically raise: “the transaction was technically authenticated, so the customer must have authorised it”. The law answers: no, the technical trace is not sufficient in itself. The bank must go further and provide concrete evidence demonstrating either the genuine authorisation of the transaction, or the user’s fraud or gross negligence.

The court also links this burden of proof to Article L. 133-19 of the same code, which sets out the circumstances in which the payer’s liability is not engaged. Two provisions deserve attention. First, the payer bears no financial consequences, unless acting fraudulently, where the unauthorised transaction was carried out without the bank requiring strong authentication. Second, the payer bears losses only if they result from fraudulent conduct on their part or from a failure, whether intentional or through gross negligence, to comply with their security obligations. In other words, the mere fact of having been deceived is never enough: negligence of a particularly serious nature is required.

Could the bank rely on “objective consent”?

This is Caisse d’Épargne’s main argument: the customer, through his own manipulations and thanks to the Secur’Pass system, supposedly gave objective consent to the transactions. The court rejects it point by point, in a remarkably well-structured piece of reasoning.

Why do “keypad manipulations” not amount to validation?

First finding: the customer never acknowledged having validated the disputed transactions with Secur’Pass. He merely stated that he had carried out “the keypad manipulations” requested by his contact. Yet operating a keypad at a fraudster’s request is not the same as knowingly executing the strong authentication code for a specific payment. The court draws a logical conclusion: there is neither proof nor admission that the customer himself carried out the strong authentication of the fraudulent transfers.

This distinction is essential for all victims. Fake adviser fraudsters excel precisely at getting the victim to perform a series of seemingly harmless actions, without the victim understanding that they are validating a transfer. Acknowledging having “carried out manipulations” is therefore not acknowledging having authorised a payment. A bank that wishes to escape liability must demonstrate the precise link between an act of validation and each disputed transaction, which Caisse d’Épargne failed to do.

Why did the instant addition of beneficiaries count against the bank?

The customer had raised a formidable technical observation. Normally, adding a new transfer beneficiary account involves several validation steps, spread over several days, precisely to prevent a fraudster from emptying an account straight away. Yet in this case, the beneficiary accounts were added and then credited within minutes. This abnormal immediacy reveals, at the very least, a malfunction or a weakness in the system.

The court notes that the bank “does not respond” to these highly relevant observations. Worse still: the general terms and conditions of the remote banking service, the only ones produced, referred for the strong authentication arrangements for transfers to the deposit account agreement, an agreement which was never disclosed. Likewise, the security limits applicable to the accounts were not stated. All of these evidentiary shortcomings turn against the institution.

Why did reimbursing 11 transactions out of 15 undermine the bank’s credibility?

The most implacable argument is probably this one. The customer had reported fifteen disputed transactions online. Of these fifteen, the bank had spontaneously reimbursed eleven, refusing reimbursement for only four. Yet, on reading the listing produced by the bank itself (its exhibit No. 2), these fifteen transactions appeared under similar circumstances, some being recorded as validated with Secur’Pass, others as reimbursed.

The court stresses that the bank “cannot reasonably explain” this difference in treatment between comparable transactions. How can it be justified to reimburse eleven fraudulent transactions and then plead a supposed authorisation for the remaining four, when they stem from the same modus operandi? This internal inconsistency ruins the credibility of the defence: if the bank accepted the unauthorised nature of eleven transactions, it cannot seriously argue that the other four were consented to. The court rightly sees this as confirmation that proof of consent has not been provided.

All in all, on the issue of consent, the conclusion is inescapable: the bank does not provide sufficient proof that the customer objectively consented to the transactions, or that he understood the scope of the manipulations requested. It therefore fails to meet the requirements of Article L. 133-23. The recharacterisation as unauthorised transactions is established.

Was the customer’s gross negligence established?

The alternative argument remained: failing consent, the bank invoked the customer’s gross negligence to avoid reimbursing. Here again, the court refuses to follow it.

Should the fraudulent text message have alerted a vigilant customer?

The bank argued that the initial text message contained grammatical errors and that its “apparently” fraudulent origin should have alerted the customer. The court dismisses this argument with welcome common sense. First, such grammatical mistakes are not sufficient to be spotted by a normally diligent user: they commonly appear in text messages, including those from perfectly legitimate French correspondents. Second, nothing in the message suggested that the sender was located abroad.

The judge adds a technical observation of prime importance: unlike an email, whose sender’s real address can be checked, a text message does not make it possible to identify the sender. The channel itself therefore deprives the recipient of a means of verification. The customer cannot be blamed for failing to detect a deception that the technical medium precisely prevented him from exposing.

Why is telephone fraud treated differently from email phishing?

The court here draws on the case law of the French Supreme Court (Cour de cassation), relating to a judgment of the Versailles Court of Appeal of 23 October 2024. The Court held that the lower courts have sovereign discretion to assess the factual circumstances in light of Article L. 133-19, and that they do not breach the law by finding that a customer may legitimately have lowered their guard when faced with a telephone call, compared with what would be expected when faced with mere emails.

This gradation is valuable for victims. The psychological pressure of a live call, the voice of a contact who sometimes knows details of the file, the manufactured urgency: all of this creates a context in which vigilance relaxes more easily than when faced with an email that can be re-read calmly. The court concludes that, in this case, the bank does not prove a lack of vigilance on the part of a normally informed customer.

Finally, the judge notes the customer’s promptness: he warned the bank the day after the events and filed a criminal complaint about six weeks later, well within the statutory period of thirteen months for reporting an unauthorised transaction. This diligent conduct finally disqualifies the allegation of negligence.

What should victims take away from this decision?

At the end of its analysis, the court orders Caisse d’Épargne et de Prévoyance Île-de-France to pay the total sum of €10,002, together with interest at the statutory rate from the date of the summons, as well as €1,800 in irrecoverable costs (Article 700 of the Code of Civil Procedure, Code de procédure civile) and the court costs. The losing party in the proceedings is the bank.

The practical significance of this judgment goes beyond the individual case. It confirms an increasingly clear line in the lower courts: strong authentication is not a blank cheque for banks. Waving a system such as Secur’Pass or “3D Secure” does not relieve the institution of having to demonstrate that the customer genuinely, and with full knowledge, validated each disputed transaction. The technical trace of an authentication is a starting point of proof, never conclusive proof of consent.

This decision also highlights a lever that victims still under-use. Beyond the burden of proving consent, banks are subject to precise technical obligations under the regulatory technical standards (the RTS, supplementing the PSD2 Directive): robust strong authentication systems, transaction monitoring and detection of abnormal patterns. The addition of a beneficiary immediately followed by instant transfers, to unreliable accounts, from remote IP addresses (even located in Morocco), is exactly the type of anomaly that these monitoring systems should flag. Where these standards are disregarded, they may in themselves ground the bank’s liability. Conversely, a failure of anti-money-laundering vigilance obligations (AML/CFT) is not a useful basis: the sole purpose of these obligations is to combat money laundering and terrorist financing, and the victim cannot rely on them to obtain compensation. Filing a criminal complaint and, where appropriate, reporting the institution remain useful on a factual level, but do not constitute a civil basis for compensation either.

What should you do if your bank refuses to reimburse you?

The Nice case illustrates a familiar obstacle course: the victim first runs into a refusal from the adviser, then a mediator who, here, took a position that was “categorical, to say the least” against the customer, ultimately forcing him to go to court to obtain justice. A few reflexes help preserve your rights.

React immediately: report the transaction to your bank as soon as you discover it, in writing, and block your card or access. File a criminal complaint without delay, even though the statutory period for disputing a transaction is thirteen months. Keep everything: the text message received, call history, screenshots, the bank’s refusal letters and the mediator’s opinion. Ask the bank, in writing, for the technical evidence of the transactions (authentication logs, how the beneficiaries were added, limits applied): if it cannot produce them convincingly, its position collapses, as this judgment illustrates. Above all, do not let a refusal from the adviser or the mediator disarm you: these stages are not the end of the road, and the courts regularly find in favour of victims where the bank fails to prove consent or gross negligence.

Conclusion

The judgment of the Court of First Instance of Nice of 9 June 2026 is good news for individuals who fall victim to fake bank adviser fraud. It reminds us, with a clarity that does credit to the court, that the burden of proof lies with the bank: the existence of strong authentication is not enough, “manipulations” obtained by trickery do not amount to consent, and gross negligence is never presumed. The inconsistencies in the bank’s defence (eleven transactions out of fifteen reimbursed, beneficiaries credited within minutes, an account agreement never produced) did the rest.

If your bank refuses to reimburse you after a fraud, remember the essential point: it is not for you to prove that you did not authorise the transaction, it is for the bank to prove the opposite. Our firm, dedicated to banking law, assists fraud victims in analysing their case, demanding the institution’s technical evidence and, if necessary, bringing the dispute before the court.

FAQ: Frequently Asked Questions