Fake Bank Adviser Scam: Strong Authentication Does Not Prove That the Payment Was Authorised (TJ Lille, 10th ch., 27 May 2026, No. 25/00111)

Court of First Instance of Lille, 10th chamber, 27 May 2026, Case No. RG 25/00111

What happened in this fake bank adviser case?

The facts are disarmingly ordinary, and that is precisely what makes this judgment useful to all victims of banking fraud. On 26 April 2024, in the late afternoon, a customer of Caisse d’Épargne et de Prévoyance Hauts de France receives a telephone call. The caller introduces himself as a bank adviser, calls from a number that she associates with her bank, and describes an emergency: she is supposedly the victim of a fraud, and he offers to remedy it immediately from her banking app. Put at ease (the caller had given her the last digits of her bank card number and her postcode), she follows the instructions. She states that she did not disclose any confidential code.

The outcome is familiar: two debits are made the same day, one of €2,659.54, the other of €1,162.35, a total of €3,821.89, in favour of online merchants, including an online booking platform. A third transaction on the same day, for an identical amount of €2,659.54, was immediately re-credited by the bank, a detail that, as we will see, works against the institution.

The customer’s reaction is immediate and exemplary. On the same day, between discovering the transactions and the evening, she sends an email to her bank adviser: “I have just been scammed by telephone and accepted payments of more than €4,000. I immediately blocked my card. What can I do now?” She blocks her bank card, then files an online report with the national gendarmerie on 29 April 2024. The bank refuses reimbursement by letter of 30 April 2024. A formal notice sent by her lawyer on 11 June 2024 is unsuccessful. The customer then brings the matter before the Court of First Instance of Lille by an application received by the court registry on 2 January 2025.

Before the court, the bank puts forward what is now a classic defence in payment fraud litigation: the disputed transactions were supposedly “authorised” because they were validated by the SECURPASS strong authentication device, installed on the customer’s personal telephone, and necessarily confirmed by the use of her device and her confidential code or biometric data. In the alternative, the bank argues that the customer committed gross negligence by validating payments whose beneficiaries were expressly named on the screen.

The court follows the bank on neither of these grounds.

Why does strong authentication not prove that the payment was authorised?

What is an “authorised” payment transaction?

The court’s reasoning starts from the founding provisions of payment services law, derived from the PSD2 Directive and codified in the Monetary and Financial Code. Article L. 133-6 lays down the principle: a payment transaction is authorised if the payer has given their consent to its execution. Article L. 133-7 specifies that this consent is given “in the form agreed between the payer and their payment service provider”.

The whole subtlety, and the whole practical stake, lies in the distinction between authentication and authorisation. Authentication is a technical process: it establishes that a payment instrument was used in accordance with the agreed procedure. Authorisation is a legal act: it presupposes the payer’s free and informed consent to the specific transaction being executed. A customer manipulated by a fraudster can perfectly well carry out all the technical validation steps without ever consenting to a payment, since they have been led to believe that they were cancelling a fraud or validating a refund.

What does the court hold regarding the SECURPASS device?

The bank proved, and the customer did not dispute, that a strong authentication device had indeed been put in place and that two transactions of 26 April 2024, time-stamped 17:54:14 and 18:00:43, had been subject to strong authentication via SECURPASS. For the institution, the demonstration ended there: strong authentication = authorised transaction = no obligation to reimburse.

The court flatly rejects this syllogism, in a ground worth quoting: “although these transactions were carried out following a strong authentication process, they were not, for that reason, authorised by the payer, within the meaning of the aforementioned provisions, as interpreted by case law”. The court notes that the customer has consistently stated, and demonstrates, that she acted on the very day of the transactions to obtain reimbursement: an immediate email to her adviser, blocking of the card, a report to the gendarmerie three days later, a formal notice. “In that sense, she cannot have consented to the amount of the fraudulent payments.”

The three transactions of 26 April 2024 therefore constitute unauthorised payment transactions. Yet only one of the three had been reimbursed by the bank. For the other two, the institution could escape its obligation to reimburse only by proving its customer’s gross negligence, and this is where the judgment shows its full evidentiary interest.

Who must prove the customer’s gross negligence?

Must the victim prove the spoofing in order to be reimbursed?

This is the most remarkable contribution of this judgment, and it must be emphasised because it runs against a stubborn preconception. In this case, the customer relied on telephone spoofing: a fraudster supposedly called her by usurping one of her bank’s numbers. Yet the court states bluntly that she does not prove it. She shows, by screenshot, that she was contacted from a mobile telephone number between 17:50 and 18:08 on 26 April 2024, but does not establish that this number belonged to her bank adviser or that it was “disturbingly similar” to it. Her online report was not detailed. Her first message to the bank referred to a “scam” without spontaneously mentioning a fake adviser. The court concludes: “no element submitted in the proceedings shows that Ms [X] was the victim of spoofing or of a relatively sophisticated scam”.

A quick reading might suggest that the victim, having failed to prove the manipulation, would lose her case. The opposite happens, and for a reason of pure evidentiary technique: “pursuant to the aforementioned provisions, it is for the banking institution to establish faulty conduct, assessed in concrete terms in light of the circumstances of the case, releasing it from its obligation to reimburse unauthorised payment transactions”.

In other words, the debate does not turn on what the victim proves, but on what the bank fails to prove. Article L. 133-23 of the Monetary and Financial Code places on the payment service provider the burden of demonstrating that the transaction was authenticated, duly recorded and accounted for, and that it was not affected by a technical or other deficiency. And the same provision specifies that the use of the payment instrument as recorded “is not necessarily sufficient in itself” to prove that the transaction was authorised or that the payer committed gross negligence, a principle long established by the Commercial Chamber (Cass. com., 18 January 2017, No. 15-18.102).

Why is the bank’s computer log insufficient?

Faced with this requirement, what did Caisse d’Épargne produce? A log: the computer history of the transactions, showing that two transactions of 26 April 2024 had been validated by SECURPASS strong authentication. The court carefully examines this exhibit and draws up an inventory of its gaps which constitutes, for practitioners, a genuine reading grid for fraud cases:

First, these computer entries show only the customer’s identifier, “without specifying the telephone number to which the validation message was sent”, whereas the customer denies having given her personal codes. Next, the log does not show that the customer transmitted her identifiers and passwords to the author of the fraudulent transactions: on this point, the court notes that the bank “proceeds by pure assertion”. The bank likewise does not prove that the mobile confirmation process displayed on screen that the transaction to be validated was a payment, and not, as the fraudster had presented it, a refund or the cancellation of a payment. Nor does it show that the customer validated the increase of her payment limit via strong authentication, as it nevertheless asserted in its pleadings.

Two further points complete the weakening of the institution’s position. First, the bank does not explain why the third transaction of the same day, for the same amount as the first, was itself reimbursed or blocked: an embarrassing inconsistency, since if the system made it possible to block or return one transaction, why not the other two? Second, the court notes that the bank does not prove it “alerted its customers to spoofing operations which, in 2024, were not yet necessarily known to the general public”. Fraud prevention thus enters the concrete assessment of the parties’ conduct: an institution that has not informed its customers of fashionable manipulation techniques is poorly placed to blame a customer for having fallen for them.

The conclusion follows: “the bank demonstrates neither that the transaction in question was unaffected by a technical deficiency nor the applicant’s gross negligence”. The bank is ordered to reimburse €3,821.89.

What penalties apply to a bank that is slow to reimburse?

How does the increase of 5, 10 and then 15 points work?

The second contribution of the judgment is financial, and it is considerable for victims. Article L. 133-18 of the Monetary and Financial Code requires the bank to reimburse the unauthorised transaction “immediately after becoming aware of the transaction or after having been informed of it, and in any event at the latest by the end of the following business day”. In the event of a breach of this obligation, the provision lays down automatic penalties: the sums due bear interest at the statutory rate increased by five points; beyond seven days of delay, the increase rises to ten points; beyond thirty days, to fifteen points.

The Lille court applies this with remarkable clarity: “it follows from these provisions, which establish a special regime of ordinary law excluding the ordinary law of liability, that the increase in default interest applies automatically, including where the unauthorised payment results from spoofing-type fraud, since the bank remains bound to reimburse”. And the starting point of the obligation to reimburse is set “from the day the fraud was reported”, namely 26 April 2024, the very day of the transactions, since the customer had alerted her bank without delay.

In practical terms, a bank that refuses to reimburse and lets the dispute drag on for two years until judgment is exposed to interest at the statutory rate increased by fifteen points over almost the entire period. On €3,821.89, the financial penalty quickly becomes substantial, and it is automatic: there is no need to prove a separate fault or any particular loss. It is a powerful negotiating lever, still too little known to victims, which we had already seen applied by other courts and which is now spreading through the courts of first instance (tribunaux judiciaires).

Why was the claim for abusive resistance dismissed?

The customer also claimed €1,000 in damages for abusive resistance, on the basis of Article 1240 of the Civil Code (code civil). The court dismisses this claim: it is shown “neither resistance by the bank that could be regarded as abusive or amounting to bad faith, nor the existence of a loss distinct from the mere delay in payment already compensated by the award of interest at the statutory rate”.

The solution is logical in its economy: the special regime of Article L. 133-18, precisely because it automatically penalises delay by increasing interest increments, absorbs the loss caused by delay. To obtain additional compensation, it would be necessary to demonstrate a truly distinct loss: established moral damage, knock-on consequences of the debit (rejected direct debits, blacklisting), associated costs. The practical lesson is clear: rather than claiming a symbolic abusive resistance, it is better to document the ancillary losses precisely or to rely on the relentless mechanism of increased interest.

Finally, the bank is ordered to pay €1,500 under Article 700 of the Code of Civil Procedure (code de procédure civile) and the costs, the judgment, delivered at last instance given the amount of the claim, being accompanied by provisional enforcement as of right.

What should you do if your bank refuses to reimburse you?

This judgment confirms a litigation strategy that we apply daily at the firm. Three practical lessons emerge for any victim of fake bank adviser fraud.

First lesson: responsiveness pays. In this case, the email sent to the adviser the same day, the immediate blocking of the card and the report to the gendarmerie three days later enabled the court to find that the customer had never consented to the transactions and that she had satisfied her reporting obligation under Article L. 133-24. Report the disputed transaction to your bank without delay, in writing, and keep proof of that report: it is the report that starts the clock for the increased interest.

Second lesson: be careful what you write in the first few days. The court noted that the report to the gendarmerie was “not detailed” and that the first message to the bank did not mention the fake adviser, which deprived the customer of the spoofing characterisation (without, fortunately, costing her the reimbursement). Precise and complete initial statements considerably strengthen a case; clumsy statements can weaken it. We have devoted a full guide to this question: Banking Fraud: What to Say and Not to Say to Your Bank and in Your Complaint.

Third lesson: do not be intimidated by the strong authentication argument. It is the banks’ standard defence, and it is legally fragile: authentication proves a technical process, not consent. Require the bank to produce concrete evidence, and remind it that the RTS regulatory technical standard supplementing PSD2 imposes precise standards on strong authentication and the monitoring of atypical transactions, the breach of which may engage its liability. Three unusual transactions totalling more than €6,000 within a few minutes should have alerted the institution’s detection systems.

What should we take away from this judgment?

The judgment of the Court of First Instance of Lille of 27 May 2026 forms part of a now well-established line of case law, in the wake of the Commercial Chamber’s decision of 23 October 2024: the validation of a transaction by strong authentication does not relieve the bank of proving, in concrete terms, its customer’s gross negligence. But it goes further on two points. First, it holds that the victim does not need to establish the spoofing in order to obtain reimbursement: even where the manipulation is not proved, the burden of proof remains entirely on the bank, which loses if it produces only a computer log. Second, it applies automatically the progressive increase in interest under Article L. 133-18, up to fifteen points above the statutory rate, from the day of the report, turning each month of the bank’s resistance into a growing financial cost.

For victims of fake adviser fraud, this judgment is one more piece in a body of case law that is becoming clearly favourable to them. For banks, it is a warning: refusing reimbursement on the basis of strong authentication alone is a losing strategy, and an increasingly costly one. The firm LE BOT Avocat assists victims of banking fraud at every stage, from the initial dispute through to trial, and puts this case law at the service of their cases.

FAQ: Frequently Asked Questions