Fake Courier Scam: Must the Bank Reimburse? (CA Paris, 15 April 2026, No. 24/16467 and 7 May 2026, No. 25/08993)

Legal framework: Articles L. 133-18, L. 133-19 (IV and V), L. 133-23 and L. 133-24 of the Monetary and Financial Code, illustrated by CA Paris, 15 April 2026, No. 24/16467 and CA Paris, 7 May 2026, No. 25/08993 (gross negligence found), and by several first-instance decisions ordering the bank to pay for lack of proof of authentication.

What exactly is the fake courier scam?

Banking fraud techniques evolve at the pace of the security measures put in place to counter them. For several years, fraud relied on phishing: an unsolicited email prompted the victim to disclose his or her banking details, which the fraudster then used remotely. Since the strong authentication requirement came into force on 14 September 2019, mere knowledge of the card details is no longer enough to divert funds. Fraudsters have therefore devised more elaborate scenarios: first spoofing (impersonation of the bank’s calling number), then this “physical” fraud, the fake courier.

What is distinctive about this fraud is that it does not rely only on capturing data: it ends with the physical handover of the payment instrument itself. That is what makes it formidable, and legally specific.

What are the steps of the scenario?

The fraud unfolds in a series of carefully orchestrated steps, each designed to reinforce the victim’s trust and neutralise his or her vigilance.

Why does the fake courier ask for the card to be cut in two?

This is the central psychological trick of the scenario. Cutting up one’s card is, in the public mind, the security gesture par excellence: the compromised instrument is “destroyed”. The victim therefore feels that he or she is protecting themselves. In reality, the fake courier makes sure that the cut does not damage the chip. As long as the chip remains intact and the fraudster has the number, the expiry date and the three-digit security code, the card remains usable. The reassuring gesture becomes the very instrument of the fraud.

What legal regime applies to the fraudulent transactions?

The decisive legal question is the characterisation of the transactions made by the fraudster. The entire applicable regime depends on that characterisation, and therefore so do the victim’s chances of reimbursement.

Are the transactions “authorised” or “unauthorised”?

Payment services law draws a radical distinction between two situations. Where a transaction is unauthorised, only the special, protective regime of Articles L. 133-18 et seq. of the Monetary and Financial Code applies. Where it is authorised by the payer (even under the effect of manipulation), that special regime is set aside: the victim can then rely only on ordinary law, in particular the bank’s duty of vigilance in the face of an apparent anomaly.

For the fake courier scam, the lower courts have held consistently so far that the transactions are unauthorised. The solution is legally sound: a transaction can be deemed authorised only if the payer consented to both the amount and the beneficiary. Yet the victim never consented to a fraudster emptying his or her account. The fact that the victim imprudently handed over the card does not turn the fraudster’s withdrawals into transactions that the victim would have validated.

What are the consequences for reimbursement?

The consequence is of the utmost importance. By characterising the transactions as unauthorised, the judges place the victim under the most protective regime: the one that in principle requires the bank to reimburse, unless it demonstrates gross negligence. This is exactly the opposite of the logic of ordinary law, where it would be for the victim to prove a fault on the part of the bank. The battle is therefore almost always fought on the ground of gross negligence.

In what cases must the bank reimburse?

The principle is set out in Article L. 133-18 of the Monetary and Financial Code: where an unauthorised transaction is reported by the user within the thirteen-month period (Article L. 133-24), the bank must immediately reimburse the amount debited and restore the account to the state it would have been in had the fraudulent transaction not taken place. Failing immediate reimbursement, additional compensation is due.

This principle is, however, subject to a major limit, provided for by Article L. 133-19, IV: the payer bears the losses where they result from fraudulent conduct on his or her part, or from a failure, intentional or through gross negligence, to comply with security obligations (to safeguard personalised security data, Article L. 133-16, and to report any unauthorised use without delay, Article L. 133-17).

What is “gross negligence” and who must prove it?

In the absence, to date, of any French Supreme Court ruling on the fake courier scam, it is the lower courts that are mapping out the ground. Two recent judgments of the Paris Court of Appeal deserve detailed analysis, because they illustrate the severity that some courts may show towards victims.

CA Paris, 15 April 2026, No. 24/16467: Gross Negligence Through an Accumulation of Imprudent Acts

The facts. A customer had received a fake “Chronopost” SMS containing a link, on which he clicked. He then entered his personal data (surname, first name, date of birth, address) on a fraudulent website, followed the instructions of an unknown person on the phone, uninstalled his banking app at that person’s request, and then handed a courier his bank card cut in two. The cut had left the chip intact; the fraudster also had the card number, its expiry date and the three-digit security code.

The outcome. The court finds gross negligence on the part of the customer. The notable point is that he had not disclosed his login credentials: it is therefore not the disclosure of a code that grounds the decision, but the accumulation of imprudent acts which, together, made the fraud possible. The bank is accordingly relieved of its obligation to reimburse.

The significance, and its critique. This judgment illustrates an “all or nothing” logic that is unfavourable to the victim: a succession of behaviours, none of which is in itself a characterised breach of security obligations, is aggregated to conclude that there was a “clearly marked” fault. Yet handing over a card cut in two stems precisely from the belief, induced by the fraudster, that this is a security gesture. One may therefore ask: can “gross negligence” be held against someone who believes, in good faith, that he is neutralising his card? The answer deserves to be discussed case by case, and cannot be systematically yes.

CA Paris, 7 May 2026, No. 25/08993: The Vigilance Expected of a Customer “in Full Possession of Her Faculties”

The facts. A customer had followed the instructions of a fake adviser concerning her means of payment, without questioning the unusual nature of the requests, or verifying the identity of her contact and then of the courier who came to collect her card.

The outcome. The court again finds gross negligence, considering that “the factual circumstances demonstrate in themselves the fraudulent nature of the approach and should have given rise [in her] to a minimum of suspicion”. It notes that she had taken “no minimal precaution” and had carried out none of “the basic checks” on the identity of her contact.

The significance, and its critique. The reasoning calls for a serious reservation: to characterise negligence, the court stresses that the customer, aged 64, was “in full possession of her intellectual faculties”. Making age and mental state a criterion for assessing fault is delicate: it amounts to modulating the legal protection according to the victim’s profile, whereas the standard of Article L. 133-19, IV, is meant to be assessed objectively, in light of the circumstances of the fraud, and not of the personal characteristics of the person suffering it. This reasoning, moreover, does not address the separate and cumulative question of proof of the strong authentication of the disputed transactions.

What do the other first-instance decisions say on the fake courier scam?

These two judgments are not isolated. Fake courier litigation multiplied before the lower courts in the first half of 2026, and a review of the available decisions reveals a worrying trend for victims: in cases involving the physical handover of the card, the judges almost systematically find gross negligence and refuse reimbursement. Here is an overview of five recent decisions.

Three cross-cutting lessons emerge from these decisions, and each deserves victims’ attention.

First lesson: handing over the card is treated as almost automatic gross negligence. The reasoning recurs, almost word for word, in each decision: “no bank asks you to hand over your bank card to a courier”. The judges infer that the victim could not have been unaware of the fraudulent nature of the process. This is precisely the slippage we criticise: elevating to a “clearly marked” fault a behaviour obtained through a professional staging, without always assessing in concreto the sophistication of the manipulation suffered.

Second lesson: the narrow distinction from the protective case law of the French Supreme Court. Several victims have relied on the judgment of the Commercial Chamber of 23 October 2024 (No. 23-16.267), which rules out gross negligence where the fraudster calls from the bank’s genuinely displayed number. The lower courts, however, consistently distinguish that judgment: where the calls came from mobile numbers (“06”) or from an entity with a similar name (“BNP Développement”), the building of trust is not held to be legitimate. The strategic lesson is clear: effective spoofing of the branch’s number is a decisive element to document.

Third lesson: the authentication ground remains the strongest. In these cases of a physically handed-over card, the judges consider that the transaction is authenticated by the chip and PIN, and reject the strong authentication argument (reserved for remote transactions). The lever of Article L. 133-19, V, on the other hand, retains its full scope for fraudulent remote transactions, and the evidential requirement of Article L. 133-23 remains a systematic checkpoint: the victim has an interest in requiring the bank to produce the complete technical records.

One finding emerges from all of this: on the fake courier scenario with physical handover of the card, the case law of the lower courts is, at this stage, mostly unfavourable to victims. Everything, or almost everything, depends on how the victim builds the case and contests, point by point, the allegations of negligence that the bank raises. This shows the importance of a rigorous and early defence.

Is the judges’ severity towards victims justified?

From the standpoint of the people our firm defends, the tendency of some courts to find gross negligence “rather easily” calls for several reservations.

First reservation: the slippage towards almost automatic negligence. One observes the idea, sometimes openly stated, that the communications of banks, the Banque de France and the French Banking Federation on fraud make gross negligence “almost automatic”: every citizen now “knows” that he or she must never hand over a card. This reasoning is legally debatable. Gross negligence must be assessed in concreto, in light of the precise circumstances of each case and the sophistication of the scenario suffered, and not by a general presumption drawn from prevention campaigns. Turning a standard of behaviour into a presumption of fault amounts to emptying of substance the protection intended by the European legislature.

Second reservation: the ignored asymmetry. The fake courier scam relies on social engineering that precisely exploits the levers of trust and urgency. Assessing a victim’s “particular negligence” without taking into account the state of shock caused by a professional scenario (impersonation of the bank’s name, fake fraud department, time pressure) amounts to making the individual bear the cost of a fraud that the banking industry is, structurally, better placed to detect and block.

Third reservation: an evidential condition too often forgotten. Even where the bank manages to demonstrate gross negligence, it is not thereby released from all obligation. Under well-established case law, it must also prove, on the basis of Article L. 133-23 of the Monetary and Financial Code, that the transaction was authenticated, duly recorded and accounted for, and that it was not affected by a technical or other deficiency. This second, cumulative requirement is regularly overlooked in the debates, even though it is often the decisive flaw in the bank’s case.

The decisive lever: was strong authentication required?

This is, in our view, the most promising and most under-exploited ground for victims. Since 14 September 2019, payment service providers must apply the strong authentication provided for by Article L. 133-4, f, of the Monetary and Financial Code. And Article L. 133-19, V, lays down a radical rule: unless he or she acted fraudulently, the payer bears no financial consequence if the unauthorised transaction was carried out without the bank having required this strong authentication.

Beyond the Monetary and Financial Code, the bank’s technical obligations under the RTS technical regulation (the European Banking Authority’s technical standards supplementing PSD2: strong authentication, transaction monitoring, detection of abnormal patterns) are an angle still little used in practice. Where they are disregarded, these standards can ground the institution’s liability. This lever deserves to be examined systematically.

On the other hand, and this is an important clarification, the bank’s alleged failure to comply with its anti-money laundering and counter-terrorist financing (AML/CFT) obligations is not a ground for compensation for the victim: the sole purpose of these obligations is the protection of public order, not of private interests. Likewise, filing a criminal complaint and a report to Tracfin are useful on a factual level (forwarding of the file, recovery), but do not in themselves ground a civil claim for damages.

How should you react if you are a victim?

The watchword in this scenario is silence and immediate action. A customer who is approached must disclose nothing to the person who contacts him or her or turns up at his or her home: on the one hand to prevent the diversion of funds, and on the other because any disclosure may later be held against the customer and jeopardise reimbursement.

What will the future PSD3 / PSR package change?

The framework is set to evolve. On 17 April 2026, the Council of the European Union made public the final version of the draft Payment Services Regulation (PSR), which accompanies the draft third Payment Services Directive (PSD3). Several measures stand out for the fight against fraud.

First, the period for reporting an authorised but incorrectly executed transaction would be extended from thirteen to eighteen months. Second, a special regime would be created for impersonation fraud (spoofing), where a consumer is manipulated by a third party posing as his or her provider and using the communication channels assigned to that provider. Finally, the verification of the match between the IBAN and the beneficiary’s name, for a time presented as a novelty, has already been in force since 9 October 2025 under the Instant Payments Regulation.

These developments do not yet expressly cover the fake courier case, which relies on a physical handover of the card. It is therefore likely that the French Supreme Court will soon be called upon to set a clear line for this emerging litigation, something victims have every interest in anticipating.

Conclusion

The fake courier scam illustrates a tension at the heart of payments law: a regime designed to protect the user (reimbursement in principle of unauthorised transactions) which in practice runs up against an assessment of the victim’s “gross negligence” that is sometimes too severe. The characterisation as an unauthorised transaction, consistent in the lower-court decisions, is good news for customers. But it is not enough: as long as some courts of appeal readily accept gross negligence, the fight is played out on proof.

On that ground, victims have strong arguments that are too rarely invoked: the burden of proof lying entirely on the bank, the cumulative requirement to prove authentication (Article L. 133-23), and above all the protective rule of Article L. 133-19, V, which neutralises any discussion of the customer’s behaviour where strong authentication was not required. Faced with a refusal to reimburse, it is essential not to let the customer’s mere imprudence be held against him or her, but to require the bank to produce all the evidence that the law places on it. The firm LE BOT Avocat assists victims of banking fraud in challenging these refusals and recovering the diverted funds.

FAQ: Frequently Asked Questions