Vannes Court of First Instance, 12 March 2026, No. 25/00524
🔑 Key Takeaways
- The court held that the transaction validated by the account holder’s facial recognition was “authorised” within the meaning of Article L. 133-6 of the Monetary and Financial Code (code monétaire et financier), despite the customer having been manipulated by a fake adviser.
- Despite this characterisation as an authorised transaction, the court held the bank liable on the basis of its general duty of vigilance.
- The decisive ground is Article 5 quater of Regulation (EU) 2024/886 of 13 March 2024 (instant payments), which has required since 9 October 2025 a check that the beneficiary’s IBAN matches the name provided by the payer (the so-called VoP procedure, Verification of Payee).
- The bank was ordered to reimburse approximately €4,500 for the fraudulent transfer, plus €200 for non-material loss.
- This decision opens a new avenue for spoofing victims: the failure to check IBAN against name becomes an enforceable banking breach.
- The RTS lever (the EBA’s Regulatory Technical Standards supplementing PSD2) remains usable in parallel, in particular as regards strong authentication and anomaly detection.
Table of Contents ▼
- Why Does This Decision Matter to Spoofing Victims?
- What Exactly Happened?
- Why Is the Transaction Characterised as Authorised?
- The Decisive Role of Strong Authentication
- Consequence for Article L. 133-19 of the CMF
- What Is the IBAN/Name Check (VoP)?
- Regulation (EU) 2024/886 Explained Simply
- Application Timetable: Why This Decision Is Coming Now
- How Was the Bank Held Liable?
- The Interplay with the General Duty of Vigilance
- What Is the Practical Scope of This Decision?
- The Levers Open to Other Victims
- The Limits to Anticipate
- What to Do If You Are the Victim of a Fake Adviser?
- FAQ: Frequently Asked Questions
Why Does This Decision Matter to Spoofing Victims?
Since 2023, “fake bank adviser” fraud (technically spoofing, where the fraudster impersonates the bank’s telephone number to pass as a legitimate agent) has been exploding. The scenario is now industrialised: a call appears showing the adviser’s real number, a professional-sounding voice mentions an attempted fraud on the account, proposes a “temporary” transfer to a “secure account” to put the funds out of harm’s way, and gets the customer to validate the transaction himself from his mobile app. The sums involved are sometimes considerable: several tens of thousands of euros per case are not uncommon.
Until now, banks have systematically raised the same defence: since the customer personally validated the transaction through his strong authentication (fingerprint, facial recognition, SMS code), it was an authorised transaction. And an authorised transaction means no automatic reimbursement under Article L. 133-18 of the Monetary and Financial Code (code monétaire et financier). The customer was left having to prove the bank’s “gross negligence” (négligence grave), which often amounted to an obstacle course.
The decision handed down by the Vannes Court of First Instance on 12 March 2026 does not directly break with this line: the transaction remains characterised as authorised. But the court opens a second avenue of action, which changes the picture: a bank that failed to check that the beneficiary’s IBAN matched the name provided, a check now required by European Union law, breaches its duty of verification.
What Exactly Happened?
The facts are by now sadly familiar. A customer of a French bank receives a call which displays, on his screen, the official number of his bank’s fraud department. The caller, perfectly at ease with banking vocabulary, informs him of suspicious transactions under way on his account and proposes, in order to block them, a precautionary transfer to a “mirror account” reserved for securing funds.
The customer, put under psychological pressure by the urgency invoked and reassured by the number displayed, opens his banking app. He himself enters the IBAN dictated by the fraudster and validates the transaction by facial recognition, as he would for any legitimate transfer. The transfer, for approximately €4,500, is executed.
The next day, alarmed by the lack of any word back from his adviser and by a debit that no longer appears as “temporary”, he contacts his real bank. Too late: the funds have been withdrawn from the receiving account, which belongs to a “mule”, that is, an intermediary accomplice whose only role is to act as a relay. The bank refuses reimbursement on the ground that the customer himself validated the transaction by facial recognition.
The customer brings the matter before the Vannes Court of First Instance, claiming principally reimbursement of the unauthorised transaction and, in the alternative, damages for the bank’s breach of its obligations.
Why Is the Transaction Characterised as Authorised?
The court begins by settling the central question: is the transaction authorised or unauthorised within the meaning of the Payment Services Directive (PSD2), transposed in Articles L. 133-6 et seq. of the Monetary and Financial Code?
Under Article L. 133-6 of the Monetary and Financial Code, a payment transaction is said to be “authorised” where the payer has given consent to its execution. That consent may take the form of a signature, a code, a biometric fingerprint or any other device agreed with the bank. Without consent, the transaction is “unauthorised”, which gives rise to the automatic right to reimbursement provided for in Article L. 133-18 of the same Code.
The Decisive Role of Strong Authentication
The court here applies the now well-established case law of the French Supreme Court (Cour de cassation), in particular the much-discussed judgment of 30 August 2023 (Cass. com., No. 22-11.707): consent to the payment transaction is established by the use of strong authentication devices. Biometric fingerprint, facial recognition, SMS code combined with a password: once these elements have been activated by the account holder himself, the transaction is legally consented to, even where that consent rests on a mistaken understanding of the facts induced by a third party.
In plain terms, deception does not remove consent: it vitiates it. But Article L. 133-6 does not reason in terms of defective consent: it reasons in terms of technical validation. The customer placed his face in front of the device. For the Directive, that is enough.
Consequence for Article L. 133-19 of the CMF
The consequence is implacable: Article L. 133-18, which requires the bank to reimburse unauthorised transactions immediately, does not apply. Neither does Article L. 133-19, which allocates the risk between customer and bank only in the case of an unauthorised transaction. The customer is therefore, at this stage, at an impasse.
Legal scholars have long pointed out that this strict reading of Article L. 133-6 confuses consent with instrumentalisation. The PSD2 Directive was designed for the risk of the payment instrument being hacked, not for the risk of social engineering. Several courts of appeal (Versailles, Aix, Douai) have already accepted the characterisation of an unauthorised transaction where the manipulation undermines free and informed consent. The Vannes court’s position follows the strict line, but the debate remains open.
What Is the IBAN/Name Check (VoP)?
This is where the decision takes on its full significance. The court refuses to stop at the characterisation of an authorised transaction. It observes that, since 9 October 2025, European law has imposed a new obligation on the issuing bank: to check, before executing the transfer, whether the beneficiary name announced by the customer actually matches the holder of the account associated with the IBAN entered.
VoP, or beneficiary verification, is a mandatory technical service imposed by Regulation (EU) 2024/886. Before any transfer, the issuing bank must query the receiving bank to compare the beneficiary name announced by the payer with the name of the actual account holder. The result is returned to the payer under three statuses: “match”, “close match” (in the case of approximate spelling) or “no match”. In the event of a no match, the payer must be warned before validation.
Regulation (EU) 2024/886 Explained Simply
Regulation (EU) 2024/886 of the European Parliament and of the Council of 13 March 2024, known as the “Instant Payments Regulation”, has profoundly reformed the transfer ecosystem in the SEPA area. Its Article 5 quater, which became mandatory on 9 October 2025, requires every issuing payment service provider to offer its customers, free of charge, a service checking that the beneficiary’s IBAN matches the name provided.
The mechanism is simple:
↓
② The issuing bank queries the receiving bank (in real time)
↓
③ The receiving bank compares the name announced with the actual account holder
↓
④ The issuing bank returns the result to the customer: match / close match / no match
↓
⑤ The customer confirms or cancels with full knowledge of the facts
The aim is clear: to protect the payer against IBAN fraud, which covers classic phishing, e-mail impersonation in business-to-business relationships and, precisely, fake adviser spoofing. The Regulation makes no distinction: whenever a transfer is issued, the check must have taken place.
Application Timetable: Why This Decision Is Coming Now
The European timetable is phased but is now largely rolled out:
- 9 January 2025: obligation for all euro area banks to be able to receive instant transfers.
- 9 October 2025: obligation for all euro area banks to be able to send instant transfers, and entry into application of VoP for instant transfers AND standard SEPA transfers issued electronically.
- 9 July 2027: planned extension to certain derived services (mandates, recurring instructions).
At the time of the facts judged by the Vannes court (early 2026), the obligation had therefore been fully in force for five months. The bank could not, and could no longer, ignore the mechanism. The court was not mistaken in this.
How Was the Bank Held Liable?
On the technical level, the issuing bank in this case had failed to carry out the IBAN/name match check at the moment the customer entered the transaction. It is very likely that this absence is linked to a partial or defective roll-out of the mechanism at the provider, a situation still widely observed today in the French market.
The court held that this failure to check, which would in all likelihood have returned a “no match” status since the beneficiary’s account was that of a mule, constituted a shortcoming attributable to the bank. That shortcoming deprived the customer of decisive information: he would have known, before validating, that the recipient’s name did not match the one announced by the fake adviser.
The Interplay with the General Duty of Vigilance
The court reasons in two stages:
1. The bank owes a statutory obligation
Article 5 quater of Regulation (EU) 2024/886 requires the match check. This obligation is precise, technical and immediate. Failure to comply with it is in itself a breach.
2. That breach feeds into the general duty of vigilance
In terms of civil liability (Article 1231-1 of the Civil Code (code civil) and the banker’s professional obligations), the failure to check results in a failure to protect the customer. The loss, the transfer lost, is directly linked to this failure: had VoP been activated, the customer would have been warned and the transfer would not have been issued.
The sum of approximately €4,500 represents the amount of the fraudulent transfer, plus €200 for non-material loss linked to anxiety and the time spent resolving the matter. The court did not apply any apportionment of liability: it held that the bank’s shortcoming had directly caused the loss, without the customer’s vigilance being enough to reduce the award.
What Is the Practical Scope of This Decision?
The scope is considerable, and it goes far beyond the particular case decided. Here is why.
The Levers Open to Other Victims
For any victim of a fake bank adviser after 9 October 2025, a new line of defence opens up: did the bank actually implement VoP? Did it return the result to the customer before final validation? Did it alert the customer in the event of a no match? These three questions must now appear in every letter of complaint and, failing a satisfactory answer, in every writ of summons.
Several configurations are possible:
- The bank did not carry out VoP: a direct breach of Regulation 2024/886. The strongest lever. This is precisely the situation in Vannes.
- The bank carried out VoP but did not pass the alert on to the customer: a breach of the duty of transparency. Several cases are emerging where the “no match” information is buried in a hard-to-read interface. A solid lever.
- The bank alerted the customer but let him validate without friction: a more delicate configuration, but the duty of vigilance can still draw on the RTS (see below) if there were signs of an anomaly in the payment pattern.
Beyond VoP, let us not forget a lever that is still largely under-used: the bank’s obligations under the RTS technical regulation (Regulatory Technical Standards) which supplements the PSD2 Directive. These technical standards require the bank not only to apply strong authentication, but also to carry out permanent monitoring of transactions aimed at detecting behavioural anomalies and suspicious patterns (unusual amount, new beneficiary, inconsistent geography). A bank that does not deploy such monitoring, or deploys it defectively, incurs liability.
The Limits to Anticipate
Three precautions must be taken:
First, the decision was handed down at first instance. It may be appealed, and the Commercial Chamber of the French Supreme Court (Cour de cassation) might be tempted to align its case law with a reading less favourable to victims, as it did for “first-generation” spoofing before 2023.
Second, the banks’ defence will be organised around two arguments: the ineffectiveness of VoP against a customer who deliberately validates the transaction despite an alert (the “informed consent after alert” argument); and the technical compliance of their mechanism with the EBA specifications, which are sometimes more permissive than the Regulation suggests.
Finally, the amount awarded remains modest compared with other spoofing cases, some of which reach €80,000 or €100,000. The Vannes court ruled on a relatively simple case involving a limited amount. On larger sums, the debate over apportionment of liability (the customer’s negligence when faced with obvious signs of a scam) will probably be more heated.
What to Do If You Are the Victim of a Fake Adviser?
The steps to follow to preserve your rights are now well marked out. Four essential steps:
- Within 24 hours: contact the bank by telephone and then by registered letter to report a fraudulent transaction. Expressly request immediate reimbursement under Article L. 133-18 of the CMF. Attach any screenshots of the call received and of the banking app.
- Within 7 days: file a complaint with the police station or gendarmerie. This complaint is not a civil basis for compensation, but it is essential for later steps (insurance, recovery, the bank’s report to Tracfin).
- Within 30 days: ask the bank, in writing, to provide the technical details of the transaction, in particular proof that the VoP check was carried out and the result returned to the customer. This request relies on Article L. 133-23 of the CMF (burden of proving authentication and recording of the transaction) and on the GDPR for technical data.
- Beyond that: in the event of persistent refusal, consult a specialist lawyer to prepare the writ of summons. Cases after October 2025 now have a solid foundation: Regulation 2024/886 and the VoP obligation.
Conclusion
The Vannes Court of First Instance’s decision of 12 March 2026 is not a revolution: it does not overturn the strict reading of the authorised transaction that the French Supreme Court has established since 2023. But it opens a door that victims of fake adviser fraud have long been waiting for. European Regulation 2024/886 and its IBAN/name verification obligation finally give victims a precise, immediate and enforceable textual basis for demanding redress where the bank has not done its job.
For the firm, which defends dozens of spoofing victims every month, this decision confirms an intuition: the battle is no longer won only on the ground of the unauthorised transaction, but on that of the new technical obligations weighing on banks. VoP, PSD2 RTS, anomaly monitoring: so many cumulative levers that we systematically use in our cases. If you have been the victim of a fake bank adviser after 9 October 2025 and your bank refuses to reimburse you, do not wait: time limits are running and technical evidence is being erased.
