Paris Court of First Instance, 11th chamber, 2nd section (professional liability in the legal field), 25 March 2026, No. RG 23/11725, Portalis No. 352J-W-B7H-C2T4R
🔑 Key Takeaways
- A notary sent bank details by unsecured email: the Paris Court of First Instance holds the notary liable for 70% of the loss, i.e. €48,025.17 out of a total loss of €68,607.38.
- The victim is attributed 30% of the loss for overlooking a visible anomaly in the fraudster’s email address, one that a reasonably vigilant person would have detected.
- The remitting bank is entirely cleared: it executed the order in accordance with the IBAN supplied by its customer, which is sufficient under Article L. 133-21 of the Monetary and Financial Code (code monétaire et financier).
- The bank receiving the funds is also cleared: under the law applicable to the facts, it had no obligation to check that the payee’s name matched the account holder.
- Since 9 October 2025, European Regulation No. 2024/886 of 13 March 2024 requires banks to verify the match between name and IBAN for euro transfers within the SEPA area: the law has changed profoundly since the facts of this case.
- Anti-money laundering vigilance obligations (Articles L. 561-5 et seq. of the Monetary and Financial Code) cannot be relied on by a private victim in the context of a fraud: only the competent authorities may invoke them.
- The chamber of notaries had issued a warning as early as 11 March 2022 about the risks of sending bank details by email, proof that the profession was aware of the risks before the events.
Table of Contents ▼
- What happened? The facts of the case in detail
- A surgically constructed fraud
- What did the victim claim, and against whom?
- Why is the notary held liable for 70%?
- Sending bank details by unsecured email: a clear case of recklessness
- The victim’s share of liability: 30% for negligence
- Why is the remitting bank not liable?
- The unique identifier principle: the cardinal rule of bank transfers
- Does the general law of contractual liability apply?
- Why is the receiving bank also cleared?
- Can anti-money laundering rules be invoked against the bank?
- What about fault when the fraudulent account was opened?
- Warning: this law has changed, as the 2024 European regulation upends everything
- The name/IBAN match verification service: a revolution for victims
- What practical significance for future fraud victims?
- Conclusion
- FAQ: Frequently Asked Questions
What happened? The facts of the case in detail
A surgically constructed fraud
To understand what is at stake in this decision, we first need to retrace the mechanics of the fraud precisely, because it perfectly illustrates the sophistication of fake bank details scams in the property sector.
A property dealer company (société marchande de biens) wishes to acquire a property for €320,000. The financing is mixed: a bank loan of €250,000 and a personal contribution of €96,400. The completion of the sale is entrusted to a notary’s office. The deed of sale (acte authentique) is scheduled for 4 November 2022.
On 27 October 2022, the notary in charge of the file sends the purchasing company an email containing the buyer’s statement of account and the bank details of the office’s account, held with the Caisse des dépôts et consignations. This is where everything goes wrong: the email is intercepted by a hacker.
The next day, 28 October 2022, the company receives a new email. It looks identical to the previous one: same file references, same amounts, same Caisse des dépôts et consignations logo, same name and address of the notary’s office. But the bank details attached as a PDF have been forged: the IBAN no longer corresponds to the notary’s account, but to an account opened with a third-party bank in the name of an individual.
🔍 Timeline of the Fraud
On 7 November 2022 (a Monday, when the notary’s office and the bank branch were closed), the company makes the transfer of €96,400 from its online banking area, without verifying the authenticity of the bank details received. The same day, it informs the notary by letter that it has made the transfer. The office does not react immediately. It is only on 16 November 2022 that the notary, seeing no funds arrive, alerts the company, which then discovers that it has been duped.
The remitting bank initiates recovery of the funds as soon as the fraud is reported. It manages to recover part of the sum: €27,792.62 is credited back to the victim’s account on 30 November 2022. The residual loss therefore stands at €68,607.38.
What did the victim claim, and against whom?
The victim company summoned three defendants before the Paris Court of First Instance on 13 September 2023, seeking their joint and several liability: the notary’s office, the remitting bank (the victim’s own bank) and the receiving bank (the bank with which the fraudulent account had been opened).
The financial claims were as follows: €68,607.38 in principal (the loss suffered), interest at the increased rate provided for in Article L. 133-18 of the Monetary and Financial Code from 17 November 2022 against the remitting bank, €5,000 in damages for non-material loss, a further €5,000 for breach of personal data, and €7,500 in respect of legal costs.
Fake bank details fraud (also called a “man-in-the-middle” or interception attack) is a scam in which a cybercriminal intercepts communications between two parties (here, between a notary and their client) in order to replace a legitimate IBAN with a fraudulent IBAN that the criminal controls. The victim, believing they are paying their genuine creditor, transfers the funds directly to the fraudster. This type of fraud causes hundreds of millions of euros in losses every year in France.
Why is the notary held liable for 70%?
Sending bank details by unsecured email: a clear case of recklessness
The court bases the notary’s liability on Articles 1240 and 1241 of the Civil Code (code civil), which govern tort liability (responsabilité civile délictuelle). The reasoning is clear and deserves to be set out in detail.
The notary is a ministerial officer (officier ministériel) with a monopoly over the completion of property sales. As such, the notary must show particularly rigorous diligence and a particularly rigorous duty of advice. Yet the chamber of notaries had published, as early as 11 March 2022 (more than seven months before the events), a warning notice addressed to the clients of notaries’ offices with explicit recommendations: “Never send your bank details by email / Prefer sending by post or hand delivery to the office / Telephone your notary for checks / Remember to check the domiciliation of the purported bank details of the notary’s office.”
The notary’s office argued that these recommendations were addressed to clients and not to notaries themselves, and that sending bank details electronically, in a context of widespread dematerialisation, could not constitute a fault. The court rejects this argument unequivocally: a ministerial officer with a monopoly cannot claim that precautions applicable to its clients are not also binding on it.
The court notes a particularly revealing element: after the fraud was discovered, the letter sent by the notary to the client on 18 November 2022 contained an explicit warning about the BIC code of the office’s account (“that the BIC code for your transfers is exclusively the following: CDCGFRPPXXX”). This post-fraud conduct shows, by contrast, that the notary could and should have provided this verification information from the very first sending of the bank details in October 2022.
In summary, the notary’s fault is twofold: the notary sent the bank details by email with no means of securing them and no warning about the risks of forgery, although aware of the threat since the beginning of 2022. This recklessness is the direct cause of the fraud.
Tort liability (responsabilité délictuelle) arises when a person causes damage to another through their fault, negligence or recklessness, outside any direct contractual relationship. For it to be established, three conditions must be met: a fault, a loss and a causal link between the two. In matters of a notary’s professional liability, fault is assessed in abstracto, that is, by reference to the conduct that a reasonably prudent and diligent notary would have shown in the same circumstances.
The victim’s share of liability: 30% for negligence
The court does not stop at holding the notary liable: it also finds fault on the part of the victim itself, assessing its share at 30% of the total loss. This point is crucial because it reduces the final compensation to €48,025.17 (€68,607.38 × 70%).
The victim’s argument was as follows: the fraudster’s email address was almost identical to the notary’s, to the point that it could not have detected the difference. It produced a bailiff’s report (procès-verbal d’huissier) drawn up on 2 December 2022 for this purpose.
But the court carefully analyses the documents placed before it and concludes that this demonstration is insufficient. On the one hand, the bailiff’s report records the apparent identity of the addresses only in the list of emails, not in the body of the email of 28 October 2022 itself. On the other hand, and this is the decisive argument, exhibit No. 3 in the victim’s file, entitled “email from the hacker of 28 October 2022”, itself shows a fraudulent email address that is distinct from the notary’s. The false address was therefore visible to a reasonably vigilant person.
⚖️ Apportionment of the Loss According to the Court
Moreover, the court notes several aggravating factors on the victim’s side: on 4 November 2022 it had received an email from the notary informing it that the buyer’s statement of account would shortly be sent to it, and it had asked the office to provide all the information needed to make the transfer; despite this, it made the transfer on 7 November without waiting for that information, at a time when both the office and the bank branch were closed. Finally, the BIC code shown on the forged bank details did not match that of the Caisse des dépôts et consignations, an anomaly that could be detected by careful reading.
Why is the remitting bank not liable?
The unique identifier principle: the cardinal rule of bank transfers
This is where the decision becomes particularly instructive for understanding the limits of the current banking system, and the need for the reform that has since taken place. The victim company raised two main complaints against its own bank: the absence of any control over high-value transfers, and a lack of vigilance in the face of apparent anomalies (notably a BIC code incompatible with the Caisse des dépôts et consignations).
On the first complaint, the court rules out any fault on the bank’s part, noting that the company had itself subscribed, as early as November 2016, to a remote banking service with strong authentication allowing it to make its external transfers on its own, without any involvement of its bank. Having chosen this service in full knowledge of the facts, it cannot blame its bank for allowing it to make transfers with no counter-check.
The unique identifier is the data supplied by the customer to their bank to designate the payee of a transfer. In practice, this is the IBAN (International Bank Account Number). Article L. 133-21 of the Monetary and Financial Code, which transposes the European Payment Services Directive, provides that a payment order executed in accordance with the unique identifier is deemed to have been duly executed, even if the payee name given is inaccurate. A bank that executes the order according to the IBAN supplied by its customer is therefore relieved of any liability for the correct designation of the payee.
On the second complaint, the court reasons in two stages. It first recalls a judgment of the Commercial Chamber of the French Supreme Court (Cour de cassation) of 15 January 2025 (No. 23-15437), according to which, where the liability of a payment service provider is sought on account of a payment transaction that was incorrectly executed, only the special liability regime defined in Articles L. 133-18 to L. 133-24 of the Monetary and Financial Code applies, to the exclusion of any alternative national-law liability regime. In other words, the victim cannot circumvent this regime by invoking general-law contractual liability.
It then applies Article L. 133-21 of the Monetary and Financial Code: since the transfer order was executed in accordance with the IBAN supplied by the company itself (even though that IBAN was fraudulent, having been substituted without its knowledge), the bank is deemed to have executed the order correctly. The anomalies accompanying the transfer order, notably the BIC code not matching the Caisse des dépôts et consignations, cannot be held against it, because it was under no obligation to go beyond the unique identifier in order to detect possible inconsistencies.
Does the general law of contractual liability apply?
The victim company attempted to circumvent the special regime of the Monetary and Financial Code by arguing that the bank had also incurred general-law contractual liability for breach of its duty of vigilance. The court rejects this argument very firmly.
The reasoning is as follows: one cannot at the same time blame a bank for having poorly monitored the execution of a transfer and claim that this poor monitoring falls outside the regime for incorrectly executed payment transactions within the meaning of the Monetary and Financial Code. The victim cannot choose the regime most favourable to it by recharacterising the same fault sometimes as a monitoring fault, sometimes as a contractual fault. In this respect, the court cites a judgment of the French Supreme Court of 23 May 2024 (No. 22-18098) stressing that the incorrect execution results from the payer’s failure to verify the identity of the account holder.
Under the regime applicable to the facts of this case (prior to 9 October 2025), the rule was simple and harsh for victims: it is the customer who supplies the IBAN, so it is the customer who bears the risk of an incorrect IBAN, even where that IBAN was forged without their knowledge. The bank had no obligation to cross-check the payee’s name against the IBAN. This rule, which derives from the 2007 European Payment Services Directive, was based on an objective of smooth, automated payments, but it proved particularly unfavourable to victims of fake bank details fraud.
Why is the receiving bank also cleared?
The victim company also blamed the bank that had hosted the fraudulent account for several failings: no verification of the match between the payee’s name and the IBAN, a vigilance obligation not complied with when the account was opened, and failure to comply with anti-money laundering obligations.
Can anti-money laundering rules be invoked against the bank?
On the first point, the verification of the name/IBAN match, the court applies the same reasoning as for the remitting bank, this time relying on Article L. 133-23 of the Monetary and Financial Code. This article extends the exemption from liability based on the unique identifier to the payee’s payment service provider (that is, the receiving bank). Accordingly, it was not for this bank to check for any contradiction between the name given by the payer and the name of the holder of the account to be credited.
On the second point, the anti-money laundering obligations of Articles L. 561-5 et seq. of the Monetary and Financial Code, the court recalls a fundamental procedural rule, confirmed by a judgment of the French Supreme Court of 21 September 2022 (No. 21-12335): these vigilance obligations are established solely for the purpose of combating money laundering and terrorist financing. Only Tracfin (the financial intelligence unit established by Article L. 562-4 of the Monetary and Financial Code, whose full name is “Traitement du renseignement et action contre les circuits financiers clandestins”) and the prudential supervisory authority may rely on them in the event of non-compliance. A private victim of an ordinary-law fraud therefore has no standing to invoke these provisions for its own benefit in an action for damages.
Invoking anti-money laundering obligations against the receiving bank is a litigation strategy often attempted by fraud victims. It is regularly rejected by the courts for a simple reason: these provisions do not create individual rights for the benefit of individual victims; they set out public obligations whose observance only the competent authorities, foremost among them Tracfin, may monitor. Asking a court to find a bank liable on this basis is therefore legally ineffective.
What about fault when the fraudulent account was opened?
The victim company also argued that the receiving bank had committed a fault when opening the account used by the fraudster, considering it likely that this account had been opened on the basis of identity theft.
The court rejects this complaint for several reasons. First, the victim provides no proof that the account was opened with false documents. Second, the causal link between this alleged fault and the loss suffered is not demonstrated: even if the bank had committed a fault when opening the account, this would not have prevented the fraud, since the bank in any event had no obligation to verify the name/IBAN match when the transfer was executed.
Finally, the court points out that the victim could have lifted the receiving bank’s banking secrecy by seeking an investigative measure under Article 145 of the Code of Civil Procedure (code de procédure civile), or in the context of the ongoing criminal investigation, in order to obtain the necessary evidence. Having failed to do so, it cannot criticise the court for not finding a fault that it has not demonstrated.
🏦 Summary of the Parties’ Liability (Under the Former Regime)
| Party | Main Complaint | Decision | Legal Basis |
|---|---|---|---|
| Notary | Sending bank details by unsecured email | ✅ Held liable for 70% → €48,025.17 | Arts. 1240 and 1241 Civil Code |
| Remitting bank | No control or vigilance over the transfer order | ❌ Cleared | Art. L. 133-21 Monetary and Financial Code |
| Receiving bank | No verification of name/IBAN match, fault when the account was opened | ❌ Cleared | Art. L. 133-23 Monetary and Financial Code |
Warning: This Law Has Changed, as the 2024 European Regulation Upends Everything
This is where reading this decision takes on a new and particularly important dimension for anyone who might today fall victim to a fake bank details fraud. This case was judged on the basis of facts dating from November 2022, under a legal regime that has since evolved profoundly.
The name/IBAN match verification service: a revolution for victims
European Regulation No. 2024/886 of the European Parliament and of the Council of 13 March 2024, amending the SEPA Regulation (No. 260/2012), introduced a radically new obligation: a service verifying the match between the payee’s name and their IBAN (known as “Verification of Payee” or VOP). This regulation entered into application on 9 October 2025 for payment service providers in the euro area.
This regulation, adopted as part of the modernisation of instant euro transfers, requires all payment service providers established in the euro area to offer their customers, before the execution of any euro transfer, an automatic service verifying the match between the payee’s name given by the payer and the actual holder of the account associated with the IBAN supplied. If a discrepancy is detected, the bank must inform its customer before the transfer is executed, allowing them to cancel the transaction or to confirm it with full knowledge of the facts.
This change is fundamental for victims of fake bank details fraud. Under the former regime, the one applicable to this case, the bank had no obligation to cross-check the payee’s name against the IBAN, and therefore bore no liability when it executed a transfer to an account belonging to a person other than the one indicated. With the 2024 regulation, the situation is different.
In concrete terms, had the facts of this case occurred after 9 October 2025, the remitting bank would have been required to verify, before executing the €96,400 transfer, that the name appearing on the transfer order (the notary or the Caisse des dépôts) did indeed match the holder of the account associated with the IBAN supplied. A discrepancy should have been flagged to the client company before execution.
📊 Before / After the Reform: What Changes for Victims
⛔ Before 9 October 2025 (facts of this case)
- No obligation to verify name/IBAN
- Bank cleared if it executes according to the IBAN supplied
- Sole liability of the payer in the event of an incorrect IBAN
- Only remedy: against the notary or another party at fault
✅ Since 9 October 2025 (Regulation No. 2024/886)
- Obligation to verify name/IBAN before any euro transfer
- Mandatory alert in the event of a discrepancy
- Potential liability of the bank if it fails to alert
- Enhanced protection for victims of fake bank details fraud
The scope of this reform should nevertheless be qualified. The European regulation lays down the principle of verification and alert, but it does not automatically create a mechanism of direct liability for the benefit of victims in every case. The exact extent of the compensation consequences of a breach of this obligation, and in particular whether or not the payment service provider’s liability is excluded, will continue to develop through case law. The regulation nonetheless introduces a radically different logic: the bank is no longer a mere mechanical executor of the IBAN, it becomes an active security player in the transfer chain.
What practical significance for future fraud victims?
For facts prior to 9 October 2025 (as in this case), the applicable law remains that described in this decision: principal liability of the notary or of the third party at fault who facilitated the fraud, and exoneration of the banks unless a fault is proven that is separable from the special regime of the Monetary and Financial Code.
For facts after 9 October 2025, new prospects open up for victims. If the remitting bank did not offer the VOP verification service, or if it offered the service but did not implement it properly (by failing to alert the client to an obvious discrepancy), its liability may be sought on this new basis. This is a major development in the balance of liability between the victim, the third party at fault and the banks.
The VOP reform does not relieve customers and professionals of all vigilance. Even with a name/IBAN verification system, fraudsters can find ways around it (accounts opened under false identities, money mules, etc.). Good practices remain fundamental: check the sender’s email address, call the notary or service provider back on a known number to confirm the bank details, and never make a large transfer in a rush or outside working hours without prior cross-checking.
Conclusion
This decision of the Paris Court of First Instance of 25 March 2026 offers a striking illustration of how liability is apportioned in a fake bank details fraud during a property transaction. It confirms several important lines of case law: the tort liability of a notary who neglects the recommendations of their own professional body, the primacy of the special liability regime of the Monetary and Financial Code over the general law in matters of bank transfers, and the impossibility for a victim to invoke anti-money laundering obligations in a personal capacity.
But this decision must be read with a critical and forward-looking eye. It was rendered for facts that fell within a legal framework that is now outdated. Since 9 October 2025, banks have been required to verify the match between the payee’s name and the IBAN before any euro transfer, pursuant to European Regulation No. 2024/886. This reform, which the victim in this case could not invoke, fundamentally changes the rules of the game for any fake bank details fraud occurring after that date.
If you have been the victim of a fake bank details fraud, whether in a property transaction or in any other context, it is essential not to resign yourself to the idea that the banks are necessarily beyond reproach. Depending on the date of the facts, the available legal arguments are not the same. A lawyer specialising in banking law can analyse your specific situation, identify the faults committed by each of the parties involved, and guide you towards the litigation strategy best suited to maximise your chances of compensation.
