Court of Appeal of Versailles, Commercial Chamber 3-2, 19 May 2026, General Docket No. 25/03537
🔑 Key Takeaways
- The Court of Appeal of Versailles overturns the sharing of liability adopted at first instance and orders the payment institution to reimburse the entire amount, namely €97,728.80.
- Eleven virtual bank cards had been created and used on 5 November 2023 for a total debit of €90,700, following a fake adviser scam involving telephone spoofing.
- The transactions had been approved from a “Chrome” device located in Canada, which had remained in the application with “pending” status and had never been accepted: the bank therefore never verified that the customer possessed this device.
- Without a verified “possession” factor, there was no strong authentication, even assuming that a password (the “knowledge” factor) had been disclosed to the fraudsters.
- Approval from a device not validly linked to the account also constitutes a technical deficiency attributable to the provider’s IT system.
- Where strong authentication was not required although it was necessary, the court does not have to examine whether the customer was grossly negligent (Art. L. 133-19, V): no sharing of liability is possible.
- The sum bears interest at the statutory rate increased by 5, then 10, then 15 points (Art. L. 133-18) from 7 November 2023.
Contents ▼
- What Happened in This Case?
- Why Are These Transactions “Unauthorised”?
- Who Must Prove What When a Transaction Is Disputed?
- What Is Valid Strong Authentication?
- Why Does a “Pending” Device Destroy Strong Authentication?
- Why Is Approval by This Device a Technical Deficiency?
- Can the Bank Invoke the Customer’s Gross Negligence?
- What Financial Penalties Weigh on the Bank?
- What to Take Away from This Judgment If You Are a Victim?
- What Practical Levers Exist to Obtain a Refund?
- FAQ: Frequently Asked Questions
What Happened in This Case?
A trading company holding a business account with a payment institution fell victim, in the autumn of 2023, to a perfectly honed fraud scenario. On 28 September 2023, the company’s manager was contacted by telephone by a person presenting himself as an adviser from her bank. The call came from a number that was actually that of the institution’s customer service: the fraudsters use the technique of spoofing, which makes it possible to display on the victim’s telephone a number that is not their own. In these circumstances, it is hard to doubt one’s caller.
Telephone spoofing is a fraud technique by which the scammer falsifies the caller number displayed on the victim’s telephone, so as to make the official number of the victim’s bank appear. The victim believes he or she is speaking to a legitimate adviser: this is one of the essential mainsprings of the fake bank adviser scam.
That day, a “Chrome” computer device located in Canada was linked to the company’s account. Alerted by a notification, the manager immediately changed her access code, which, according to her, explains a second call from the fraudsters that same evening. Then, for more than five weeks, nothing: no suspicious transaction appeared on the account. In these circumstances, it was impossible to suspect a persistent compromise.
The blow fell on 5 November 2023. From the company’s account, eleven virtual bank cards were created and immediately used, resulting in a total debit of €90,700, in addition to €28.80 in fees. The company was notified of the fraud by its bank on 6 November 2023 and disputed these transactions, which it states it never initiated.
Sued for payment, the bank refused any reimbursement: it argued that the transactions had indeed been approved by strong authentication from the device registered on 28 September, that there was no technical failure, and that the customer had committed three acts of gross negligence (authorising a third-party device, failing to react to the notification, disclosing her details to the fraudster). At first instance, the court reached a compromise: it found a sharing of liability and ordered the bank to pay half of the sums, namely €45,350. Both parties appealed. The Court of Appeal of Versailles swept aside the logic of sharing and ruled entirely in favour of the victim.
Why Are These Transactions “Unauthorised”?
The whole reasoning rests on a prior characterisation: that of an unauthorised payment transaction. The court first recalls, unsurprisingly, that the creation of a virtual bank card of a certain amount does constitute a payment transaction (a solution already established by the French Supreme Court (Cour de cassation), Com., 18 January 2017, No. 15-26.058).
A payment transaction is “authorised” when the payer has given consent to its execution, in the form agreed with his or her bank (Art. L. 133-6 of the Monetary and Financial Code (code monétaire et financier)). In the absence of consent, it is deemed unauthorised. Where the customer disputes being the author of a transaction, it must be treated as unauthorised, which triggers a specific liability regime.
Now, a decisive point: the parties themselves agreed that the disputed transactions, which the company denied having initiated, were not authorised. The characterisation was therefore not in dispute. And this characterisation has a heavy consequence: where a transaction is unauthorised, the provider’s liability may be sought only under the special regime of Articles L. 133-18 to L. 133-24 of the Monetary and Financial Code, “to the exclusion of any alternative liability regime arising from national law” (the court here cites Com., 27 March 2024, No. 22-21.200, published). In other words: no return to the ordinary law of contractual liability is possible. The dispute is played out entirely on the ground of payment services law, stemming from the European directives PSD 1 (2007/64/EC) and PSD 2 (2015/2366).
Who Must Prove What When a Transaction Is Disputed?
This is the heart of the protection offered by payment law, and it is what many victims do not know: the burden of proof lies with the bank, not with the customer. Article L. 133-23 of the Monetary and Financial Code is unambiguous. Where a user denies having authorised a transaction, it is for his or her provider to prove that the transaction “was authenticated, duly recorded and accounted for and was not affected by a technical or other deficiency”.
And the text goes further. It specifies that the use of the payment instrument as recorded by the provider (the famous computer “log” that banks systematically brandish) “is not necessarily sufficient in itself to prove that the transaction was authorised by the payer”. It is for the provider to supply evidence establishing the fraud or gross negligence of the user.
For a disputed transaction, the law reverses the intuitive logic: it is not for the customer to prove that he or she authorised nothing, it is for the bank to prove that the transaction was authenticated, properly recorded and free of technical deficiency. A simple internal authentication record is not enough: the bank must demonstrate the reality and reliability of the security system.
The method of analysis imposed by the court is a sequence of questions, in a precise order. For each transaction, it must be asked: (1) was it subject to strong authentication? (2) is there a technical deficiency? And only if these first two questions are answered in the bank’s favour, (3) did the customer commit gross negligence? As we shall see, the bank fails at the very first step.
🔎 The Three-Step Test for an Unauthorised Transaction
↓ if NO → full reimbursement, the analysis stops there
② Technical deficiency? Did the system function correctly?
↓ if deficiency → full reimbursement
③ Gross negligence by the customer? Can be examined only if ① and ② are established in the bank’s favour
→ Here: failure at steps ① and ② → no sharing possible
What Is Valid Strong Authentication?
Strong authentication has been the keystone of online payment security since PSD 2. Article L. 133-4, f), of the Monetary and Financial Code gives a definition that is technical but essential to understand.
Authentication based on at least two elements belonging to three categories: knowledge (something only the user knows, such as a password), possession (something only the user possesses, such as his or her telephone or a registered device) and inherence (something the user is, such as a fingerprint). These elements must also be independent: the compromise of one must not call into question the reliability of the others.
This word, independent, is crucial. Two factors that fall together, in the same compromise, do not amount to strong authentication. That is precisely what was missing here. The bank claimed to rely on two factors: a password (knowledge) and the “Chrome” device linked to the account (possession). But the possession factor still had to genuinely exist.
Why Does a “Pending” Device Destroy Strong Authentication?
This is where the judgment becomes particularly instructive, and where the attention paid by the judges to the technical detail makes the difference. The transactions of 5 November 2023 had been approved from the “Chrome” device linked to the account on 28 September. The bank therefore considered that the “possession” factor was satisfied.
Except that the bailiff’s reports produced by the bank itself betray it. According to a report drawn up at its request, more than six months after the disputed transactions, this device located in Canada still appeared in the list of devices connected to the account not with the status of an “accepted” device, but with the status of a “pending” device. Better still: at the end of the line relating to this device, an “Review the request” button invited the bank’s staff to manually approve this link, an approval that had never taken place. A second report, almost a year after the events, confirmed that the device was still classified as “pending”.
The court’s conclusion is implacable: on the day of the disputed transactions, the bank had not verified that the Chrome device was actually in its customer’s possession. It follows that the transactions were not preceded by authentication through the alleged “possession” element. No element of the “inherence” category (fingerprint, biometrics) was moreover invoked. Accordingly, even assuming that a password (knowledge) had been provided by the fraudsters, the transactions could not be regarded as preceded by strong authentication: quite simply, a valid second factor was missing.
A device that appears in the bank’s back office is not necessarily an “authenticated” device. As long as it remains “pending” approval, it proves nothing as to the customer’s possession. A bank that lets a transaction proceed from such a device cannot rely on strong authentication.
Why Is Approval by This Device a Technical Deficiency?
The court adds a second ground, superabundant but illuminating. The approval of these transactions from a device that was not yet considered validly linked to the account constitutes, in itself, a technical deficiency attributable to the provider’s IT system.
Within the meaning of Article L. 133-23, a technical deficiency means any malfunction of the bank’s security system affecting the reliability of the transaction. Where a transaction is approved although the system should have blocked it (for example because it comes from an unapproved device), the deficiency is established and weighs on the provider, which must prove that it does not exist.
This point is strategically valuable. It shows that a bank cannot take refuge behind the idea that “the system worked”: if the system let through a transaction that it should have held back, that is precisely the sign of a deficiency. The security flaw is not neutralised by the customer’s behaviour; it binds the institution.
Can the Bank Invoke the Customer’s Gross Negligence?
This is the institutions’ favourite argument: “whatever the technical mechanics, the customer was grossly negligent, so he or she bears the loss”. Article L. 133-19, IV, of the Monetary and Financial Code does indeed provide that the payer bears the losses if he or she acted fraudulently or failed, intentionally or through gross negligence, to meet security obligations. But this argument runs up against a decisive obstacle here.
Article L. 133-19, V, provides that, save where the payer has acted fraudulently, the payer bears no financial consequences if the unauthorised transaction was carried out without the provider requiring strong authentication. The French Supreme Court draws a clear procedural consequence from this: where strong authentication was not required by the provider although it was necessary, the court does not have to examine whether the customer committed gross negligence (the court cites Com., 30 August 2023, No. 22-11.707, published). The examination of gross negligence becomes moot.
Gross negligence is a clear failure by the customer to meet the obligation to preserve the security of his or her personalised data (code, passwords, security devices). It alone, or the customer’s fraud, allows the bank to refuse reimbursement. But the bank must first have required strong authentication: failing that, gross negligence cannot even be examined.
The sharing of liability adopted at first instance was therefore legally doomed from the outset. The French Supreme Court has indeed held that, where a transaction is not authorised and the payer has committed gross negligence, the payer is deprived of the right to reimbursement, so that the court cannot share liability with the provider on the ground that the latter failed in its duties of vigilance (Com., 15 January 2025, No. 23-13.579, published). The regime is binary: either the customer bears everything (gross negligence, and provided that strong authentication was required), or the bank reimburses everything. There is no room for a 50/50 compromise. By overturning the judgment “in all its provisions”, the Court of Appeal of Versailles applies this logic to the end, this time in favour of the victim.
What Financial Penalties Weigh on the Bank?
Reimbursement of an unauthorised transaction is not a discretionary favour: it is a legal obligation subject to a strict timetable. Article L. 133-18 requires the bank to reimburse immediately, and at the latest by the end of the first business day following notice of the transaction, unless the bank suspects customer fraud and has notified the Banque de France in writing.
Above all, delay is costly. In the event of a breach of this reimbursement obligation, Article L. 133-18 provides for a scale of penalties that is added automatically:
📈 The Scale of Increased Interest (Art. L. 133-18)
🟠 Beyond 7 days of delay → statutory rate increased by 10 points
🔴 Beyond 30 days of delay → statutory rate increased by 15 points
In our case, the court ordered the payment institution to pay the company the sum of €97,728.80, with interest calculated on these terms from 7 November 2023, that is, the first business day following the date on which the bank had been notified of the fraud. To this is added an award of €2,000 in respect of procedural costs. The message is clear: a bank that drags its feet in reimbursing a fraudulent, unauthenticated transaction sees its debt swell month after month.
What to Take Away from This Judgment If You Are a Victim?
This decision of the Court of Appeal of Versailles invents no new rule, but it applies one rigorously and instructively, and every victim of the fake bank adviser scam can draw inspiration from it. It confirms, in line with now-abundant case law (Com., 12 November 2020, No. 19-12.112; Com., 20 November 2024, No. 23-15.099; Com., 30 April 2025, No. 24-10.149, all published), that a bank wishing to escape reimbursement must clear two cumulative hurdles: prove genuine strong authentication and the absence of technical deficiency, before it can even argue the customer’s negligence.
The main practical lesson fits in one sentence: a log is not proof, and a “pending” device is not an authenticated device. Faced with a bank that displays a table of transactions “approved by strong authentication”, you must systematically ask for a demonstration of the two factors, of their independence, and of the exact status of the devices used. The reports produced by the bank itself sometimes contain, as here, the proof of its own failure.
What Practical Levers Exist to Obtain a Refund?
For a victim of fake adviser fraud, spoofing, phishing or the fraudulent creation of virtual cards, several avenues emerge from this judgment:
1. Dispute promptly and in writing. Reporting the unauthorised transaction triggers the bank’s obligation to reimburse immediately and starts the increased interest running. On how to word this dispute without trapping yourself, we detail the steps to follow in our article: Bank Fraud: What to Say and Not to Say to Your Bank and in Your Complaint.
2. Place the debate on the ground of proof. Do not try to prove that you did nothing: demand that the bank prove strong authentication and the absence of technical deficiency (Art. L. 133-23). It is the bank that bears the burden.
3. Dissect the security system. Were the two factors really independent? Was the device that approved the transaction “accepted” or only “pending”? Was the cards’ limit respected? So many possible breaches.
4. Do not accept a sharing of liability. The “half and half” compromise is legally fragile: either the bank must reimburse everything, or nothing. A split proposed by the bank is often an admission of weakness on the proof of strong authentication.
Finally, there is a lever that is still underused: the obligations on the bank under the RTS technical regulation (the Regulatory Technical Standards supplementing PSD 2 on strong authentication and transaction monitoring). A breach of these technical standards can support the demonstration of the provider’s failure, beyond the sole debate on authentication. Each case deserves a case-by-case analysis.
Conclusion
The judgment of the Court of Appeal of Versailles of 19 May 2026 is good news for all victims of the fake bank adviser scam, individuals and businesses alike. It recalls forcefully that the protection established by European payment law is not theoretical: as soon as the bank fails to establish genuine strong authentication (two independent factors, actually verified), full reimbursement is required, without any “gross negligence” of the customer being capable of being raised against it, and without sharing of liability. The detail that decided everything here, a device left “pending” approval, illustrates how far a careful examination of the technical documents produced by the bank can overturn a case. If you are faced with a refusal to reimburse after a fraud, never regard it as final: the burden of proof works in your favour, and it is often in the bank’s own documents that the key is found.
