Fake IBAN and the Duty of Vigilance: The PSD2 Regime Is Exclusive and Article L. 133-5 Does Not Reopen the General Law (Cass. com., 20 May 2026, No. 25-14.005)

French Supreme Court (Cour de cassation), Commercial, Financial and Economic Chamber, 20 May 2026, appeal No. 25-14.005

What Happened in This Fake Financial Adviser Case?

On 24 and 26 November 2020, two joint holders of an account opened with BRED Banque populaire sent two transfer orders to an account supposedly opened in their name with the Spanish bank Banco Bilbao Vizcaya Argentaria (BBVA). The unique identifier, that is, the IBAN, had been provided to them by a person presenting themselves as a financial adviser of that bank.

It was a scam. The IBANs provided did not correspond to BBVA accounts: the first carried a BIC code pointing to Deutsche Bank, the second a BIC code pointing to a company called Nova Bank. The funds were diverted.

The victims sued their bank for compensation. Their basis was breach of the duty of vigilance: BRED should have detected the apparent anomalies affecting the transfer orders, since the BIC codes manifestly did not match the bank announced as the recipient.

How Had the Paris Court of Appeal Got Around Article L. 133-21?

By a judgment of 2 October 2024, the Paris Court of Appeal ordered BRED to compensate the victims. Its reasoning deserves to be set out in detail, because it is the reasoning that is quashed.

The bank relied on Article L. 133-21 of the Monetary and Financial Code: an order executed in accordance with the unique identifier provided by the user is deemed to have been correctly executed, and if that identifier is incorrect, the provider is not liable for the defective execution. The Court of Appeal set this provision aside through a twofold move. First, it noted that Article L. 133-21 appears in a section devoted to liability in the event of a defectively executed transaction, whereas the customers were complaining not of defective execution but of a breach of the general-law duty of oversight. Second, it relied on Article L. 133-5 of the same code, according to which the liability provided for by the special regime does not apply “where the payment service provider is bound by other legal obligations provided for by national or Community legislation”. It deduced that the bank, as account-holding institution, remained bound by a general-law duty of vigilance, and held that the IBANs contained apparent anomalies, the BIC codes not corresponding to BBVA, which should have alerted it.

This reading had the immense merit of giving concrete meaning to the apparent anomaly in the matter of transfers: where the IBAN provided contradicts, through its BIC, the payee announced, the bank has a warning signal on the order itself. This is the angle we had noted in connection with the Pau Court of Appeal and the RIB anomaly.

What Does the Supreme Court Decide on 20 May 2026?

The Commercial Chamber quashes the Paris judgment in its entirety, citing Articles 1231-1 of the Civil Code and L. 133-5 and L. 133-21 of the Monetary and Financial Code. Its reasoning proceeds in four steps.

Does the General Law Give Way to an Exclusive Regime?

First step, the principle: “General contractual liability arising from the first of these provisions does not apply where there is an exclusive liability regime.” The wording is general and applies beyond banking law.

What Does the Court of Justice of the European Union Say?

Second step, the European basis. The Court reproduces two paragraphs of the Beobank judgment of 16 March 2023 (C-351/21): the liability regime of payment service providers “has been the subject of full harmonisation”, which makes incompatible with the directive “both a parallel liability regime based on the same causal event and a competing liability regime that would allow the payment service user to engage that liability on the basis of other causal events”. The harmonised regime may be competed with by a national regime “based on the same facts and the same grounds only on condition that it does not prejudice the regime thus harmonised”.

What Do Articles L. 133-5 and L. 133-21 Say?

Third step, the reading of the provisions. Article L. 133-5 provides that the provider’s liability “does not apply in cases of force majeure, or where it is bound by other legal obligations provided for by national or Community legislation”. Article L. 133-21, which transposes Article 88 of Directive (EU) 2015/2366, deems an order that complies with the unique identifier provided to have been correctly executed and exonerates the provider if that identifier is incorrect.

Where Did the Court of Appeal Go Wrong?

Fourth step, the quashing: “In so ruling, when Article L. 133-21 of the Monetary and Financial Code excludes any application of the rules of the general law and Article L. 133-5 of the same code has neither the purpose nor the effect of making it possible to engage the liability of the payment service provider on the basis of national general law in the event of an unauthorised or defectively executed transaction, the Court of Appeal breached the aforementioned provisions.”

The case is remitted to the Paris Court of Appeal, differently composed. The victims are ordered to pay the costs and to pay €3,000 to the bank under Article 700 of the Code of Civil Procedure (code de procédure civile).

What Is Article L. 133-5 of the Monetary and Financial Code Really For?

This is the most technical contribution of the judgment, and it must be understood in order not to repeat the Paris Court of Appeal’s error.

The Paris Court of Appeal had read Article L. 133-5 as a bridge: since the bank is bound by “other legal obligations”, including its general-law duty of vigilance, the special regime gives way and the general law applies. The French Supreme Court replies that the provision works in one direction only. It allows the provider to escape liability under the special regime where another legal obligation constrained it; it does not allow the customer to impose on it a liability that the special regime excludes. The provision is a shield for the bank, not a sword for the customer.

This reading is consistent with the logic of Article 93 of the directive. It may nevertheless be noted that the wording “where the provider is bound by other legal obligations” is ambiguous enough for experienced judges to have seen something else in it, and that the French Supreme Court could, for a judgment so structuring, have considered publication in the Bulletin.

Why Is the PSD2 Regime “Exclusive”, and How Far Does It Go?

The exclusivity of the PSD2 regime has been established since the CRCAM (CJEU, 2 September 2021, C-337/20) and Beobank judgments. The French Supreme Court applies it consistently, for example in a judgment of 4 February 2026, and the lower courts comply. What is new in the 20 May 2026 judgment is the application of this exclusivity to a situation in which the customer was not relying on the defectively executed transaction, but on the duty of vigilance.

The Court reasons in two implicit steps. First, it characterises the facts: the victims ordered transfers to an account they believed was opened in their name at BBVA, and the funds went elsewhere; this is a case of an incorrect unique identifier, and therefore of a defectively executed transaction in the broad sense, governed by Article L. 133-21. Second, it draws the consequence: since the facts fall within the scope of the special regime, the customer cannot recharacterise them as a breach of the duty of vigilance in order to escape the exoneration in Article L. 133-21. The legal basis is not freely chosen; it is dictated by the facts.

Is This Solution Coherent and Satisfactory?

The firm defends victims of transfer fraud. The judgment is unfavourable to them, and its criticism must be precise.

The Paradox of the Victim Who Says Too Much

Let us compare this judgment with that of 1 July 2026 (No. 25-15.593), which we discussed under the title rejection, re-issue and foreign bank are not apparent anomalies. In that latter case, the Court held that Article L. 133-21 did not apply because the customer had “not disputed having authorised the transfers in question nor alleged that the beneficiary accounts of the transfers were not those shown on the unique identifiers”. The ground of the general-law duty of vigilance was therefore open to it.

In the 20 May 2026 case, the victims on the contrary explained that the IBANs did not correspond to the BBVA account they were targeting. Result: they fall within the scope of Article L. 133-21, and the general law is closed to them. In other words, the victim who demonstrates the inconsistency of the IBAN finds themselves in a legally less favourable position than the one who says nothing about the destination of the funds. This paradox is hard to justify. It leads to a counter-intuitive procedural strategy, in which one gains by not characterising the IBAN as incorrect, and it reveals that the boundary between “defectively executed transaction” and “authorised transfer poorly monitored” is drawn too mechanically.

Is the BIC/Payee Inconsistency Really Not an Apparent Anomaly?

The Paris Court of Appeal had identified an anomaly visible on the order itself: an IBAN presented as BBVA with a Deutsche Bank BIC. This is exactly the type of irregularity “easily detectable by a normally diligent professional” that the French Supreme Court requires elsewhere, and that the courts have sometimes accepted, such as the Vannes Court of First Instance (tribunal judiciaire) in a decision of 12 March 2026 on the failure to verify IBAN/name. The French Supreme Court does not say that this is not an anomaly; it says that the question does not arise, because the exclusive regime absorbs it. This is where the solution becomes open to challenge: the exclusivity of the harmonised regime, designed to prevent the accumulation of regimes on the same facts, here ends up neutralising a breach that the special regime itself does not penalise. There is no longer a competing regime; there is no longer any regime at all.

Does Full Harmonisation Really Require This Result?

The Beobank judgment expressly reserves the case of a national regime that would not “prejudice the regime thus harmonised” nor “undermine the objectives and effectiveness” of the directive. Yet the objective of the directive is a high level of user protection. Penalising a bank that let through an IBAN manifestly inconsistent with the announced payee does not undermine that objective; it serves it. It can therefore be argued that full harmonisation did not require the solution adopted, and that a request for a preliminary ruling on the interplay between Article 88 of the directive and a national duty of vigilance based on a visible anomaly would have been justified.

A Solution Already Overtaken by the Texts?

The facts date from November 2020. Since 9 October 2025, Regulation (EU) 2024/886 requires providers to offer a payee verification service: before executing a transfer, the bank must check the match between the payee’s name entered and the holder of the account designated by the IBAN, and warn the customer in the event of a discrepancy. An IBAN announced as BBVA but pointing to another bank would today trigger an alert. The solution in the 20 May 2026 judgment therefore concerns a world that is disappearing, and care must be taken not to transpose it to recent transfers. We presented this mechanism in our article on the obligation to verify the IBAN.

What Avenues Remain Open After This Judgment?

Choose the Right Ground From the Outset of the Claim

The judgment confirms that the characterisation of the facts determines the regime. Three questions must be asked before any claim: did the customer consent to the transaction? Did the funds arrive in the account designated by the IBAN provided? Who physically drafted the order? Depending on the answers, one is on the ground of an unauthorised transaction, a defectively executed transaction, the general-law duty of vigilance, or the drafting of the order by the bank. The first written communications sent to the bank and the criminal complaint often fix this ground irreversibly: our guide Bank Fraud: What to Say and Not to Say to Your Bank and in Your Complaint sets out the precautions to take.

Did the Bank Draft the Order?

The Commercial Chamber accepted, in a judgment published in the Bulletin on 4 March 2026, that the general law applies where the bank “does not merely execute the payment order but drafts it itself” (Cass. com., 4 March 2026, No. 25-11.959). This is the strongest exception to the exclusivity of Article L. 133-21. Any transfer made at the counter, by telephone or by email with input by an adviser must be examined from this angle.

Was the Transaction Really Authorised?

Where a fake adviser obtains validation of a transfer by manipulation, the question of consent arises. The French Supreme Court requires the bank to prove positively the consent to the amount and the payee, and refuses to infer it from the use of authentication devices (Cass. com., 1 July 2026, No. 25-13.134). If the transaction is unauthorised, one leaves the ground of Article L. 133-21 for that, far more favourable, of Article L. 133-18.

And the Receiving Bank?

The exclusivity of the PSD2 regime concerns the relationship between the payer and their own provider. The bank that opened the fraudster’s account and allowed it to operate abnormally may be pursued in tort, including abroad, as the First Civil Chamber accepted in its judgment of 6 May 2026 on the law applicable to the receiving bank. Caution: anti-money laundering obligations cannot serve as a basis, the French Supreme Court having held that their sole purpose is the fight against money laundering and terrorist financing; the useful ground is that of the RTS technical regulation supplementing PSD2 and the general law.

For Transfers After 9 October 2025

The payee verification service changes the picture. If the bank did not offer it, if it failed or if the alert was not displayed, its liability is engaged on the basis of Regulation 2024/886, which expressly provides for compensation of the customer. The BIC/payee inconsistency, which had no effect in the 20 May 2026 judgment, then becomes precisely the breach to be penalised.

Conclusion: The Legal Basis Determines Everything

The 20 May 2026 judgment is one of pure legal technique. It rules neither on the seriousness of the fraud nor on what the bank should have seen; it says only that, once the facts fall under Article L. 133-21, the general law cannot be invoked, and that Article L. 133-5 does not allow it to be reintroduced. Its coherence with European case law is real; its coherence with the objective of user protection is less so, and the paradox it creates with the 1 July 2026 judgment on authorised transfers deserves to be underlined.

For victims, the lesson is clear: the choice of legal basis is not a matter of presentation, it is the question. It must be settled before the first letter to the bank, on the basis of a precise analysis of consent, the destination of the funds and the manner in which the order was placed. And for recent transfers, the payee verification service opens up a ground that this judgment does not close.

FAQ: The Exclusive PSD2 Regime, Article L. 133-5 and Fake IBAN Fraud