Fraudulent Transfer: The Bank Must Prove Strong Authentication, Not Use of the Phone (TJ Lyon, 30 June 2026, No. 23/02144)

Court of First Instance (tribunal judiciaire) of Lyon, Local Justice and Protection Division (long procedure S1), 30 June 2026, No. RG 23/02144

What happened in this fake TransferWise transfers case?

How did the fraud unfold?

In August 2020, a customer of CIC Lyonnaise de Banque, whose account was managed by the Culoz branch (Ain), received two emails purporting to come from “Transferwise” (now Wise, an international money transfer service). These messages, dated 9 August 2020, informed him that two payments had supposedly been made in his favour, for €2,209.65 and €2,282.95.

The customer had ordered nothing, validated nothing, requested nothing. He reacted immediately: he forwarded the emails to his bank advisers, asked them to check that this was not a fraud and that no money transfer had been made, alerted his bank and had his bank card blocked. The branch manager told him that, in the event of a debit, he would have to put together a dispute file in order to obtain reimbursement of the sums fraudulently taken.

On 21 August 2020, he filed a complaint with the gendarmerie, which redirected him to the “Perceval” platform, where he registered his report on 22 August 2020. On 19 September 2020, he wrote to his branch to recall the facts and ask for the matter to be taken in hand. His account having been debited by €4,492.60 in total, he had a formal notice to reimburse served through his counsel on 6 October 2020, with the acknowledgement of receipt signed on 16 November 2020.

The bank refused. Its argument: the debit transactions had supposedly been “validated via the mobile application installed on the phone” of the customer, and the strong authentication rules had supposedly been complied with. In other words, in the bank’s view, the customer had himself consented to the transactions, or had at the very least committed a negligence depriving him of any right to reimbursement.

Why was the case heard in Lyon rather than in Bourg-en-Bresse?

By a bailiff’s writ (acte de commissaire de justice) of 2 November 2022, the customer summoned the bank before the Court of First Instance of Bourg-en-Bresse. But by a judgment of 27 April 2023, that court noted that the claimant was a judge at the Commercial Court of Bourg-en-Bresse and, pursuant to Article 47 of the Code of Civil Procedure (code de procédure civile), which allows disputes involving a judge or a court officer to be moved out of the jurisdiction where they sit, referred the case to the Court of First Instance of Lyon.

This procedural detail explains the unusual length of the proceedings: summons in November 2022, referral in April 2023, oral hearing on 22 May 2025 after several adjournments, and judgment delivered on 30 June 2026 after the deliberation was extended. Almost four years between the summons and the judgment, almost six years between the fraud and the reimbursement: a delay that victims of banking fraud must unfortunately factor into their litigation strategy, and which is here partly offset by interest at the statutory rate running from the 2020 formal notice.

What does the law say about reimbursement of unauthorised transactions?

The dispute turns on Articles L. 133-18 et seq. of the Monetary and Financial Code, which transposed the Payment Services Directive (PSD2). This body of rules sets up a regime of strict liability of the payment service provider, derogating from ordinary law and particularly protective of the payer.

Article L. 133-18 of the Monetary and Financial Code lays down the principle: in the event of an unauthorised payment transaction reported by the user under the conditions provided for in Article L. 133-24 (no later than thirteen months after the debit), the payment service provider must reimburse the payer the amount of the transaction immediately after becoming aware of it or being informed of it, and in any event no later than the end of the following business day. The account must be restored to the state it would have been in had the transaction not taken place.

Article L. 133-19 sets out the exceptions and tempering rules. Its paragraph IV provides that the payer bears all losses if they result from fraudulent conduct on their part or if they failed, intentionally or through gross negligence, to meet their security obligations (Articles L. 133-16 and L. 133-17). But its paragraph V adds a decisive rule for contemporary fraud: save fraudulent conduct on their part, the payer bears no financial consequences if the transaction was carried out without the bank requiring the strong authentication provided for in Article L. 133-44.

This leaves the central question in any banking fraud dispute: who must prove what? The answer is given by Article L. 133-23: where a user denies having authorised a payment transaction, it is for their payment service provider to prove that the transaction was authenticated, duly recorded and accounted for, and that it was not affected by a technical or other deficiency. And the second paragraph specifies that the use of the payment instrument as recorded by the provider “is not necessarily sufficient in itself” to prove that the transaction was authorised by the payer or that the payer was grossly negligent.

The Lyon court draws a clear summary from this: a bank to which the unauthorised nature of a transaction has been duly reported by its customer within the prescribed period is bound, as of right, to reimburse the customer, unless it shows either that the transaction was authorised, or that the user acted intentionally or with gross negligence.

Why was the bank ordered to reimburse?

Had the customer reported the fraud in time?

First step of the reasoning: the court checks that the customer complied with his reporting obligation. The documents produced (the two “TransferWise” emails of 9 August 2020, the emails sent to the bank advisers, the online report receipt of 22 August 2020) establish that the customer told his bank, as early as 12 August 2020, that he was not the originator of the payments. Three days after the suspicious emails: the court notes a report made “within a particularly short period, ruling out any culpable inaction on his part”.

This point deserves emphasis: the customer’s responsiveness is the foundation of his case. The immediate report to the bank, the card block, the complaint via Perceval, the letter of claim, then the formal notice by a lawyer form a chain of diligent steps that the court expressly valued.

Who bears the burden of proving strong authentication?

Second step: does the bank prove that the transactions were authorised? To establish the customer’s consent, the bank produced a single document indicating that, on 9 August 2020, two banking transactions had been carried out online from the customer’s iPhone.

The court finds this document insufficient, “since it does not specify the authentication methods used”. And it lists what the bank should have put before the court and did not: “no proof that a one-time code was sent, that validation was given via the banking app, that a biometric device was used, or of any dual authentication mechanism complying with the requirements of Article L. 133-44 of the Monetary and Financial Code”.

The sanction follows: the bank “fails to show that the transactions were subject to strong authentication, a condition that is nevertheless decisive for their enforceability against the customer”. The wording is remarkable: strong authentication is not a mere technical formality, it is the condition on which the transaction can be enforced against the account holder. A transaction whose strong authentication is not demonstrated simply cannot be charged to the customer.

Is the fact that the transaction came from the customer’s iPhone enough to prove his negligence?

Third step: failing proof of authorisation, the bank could still try to establish gross negligence on the customer’s part. Here again it fails: the court holds that nothing in the file makes it possible to characterise fraudulent conduct or gross negligence, “the mere fact that the transactions were carried out from a device belonging to him being, in this respect, insufficient”.

This reasoning is in line with the settled case law of the French Supreme Court (Cour de cassation): proof of gross negligence cannot be inferred from the mere fact that the payment instrument or the personalised data were actually used. This is exactly what the second paragraph of Article L. 133-23 codifies: the technical recording of the transaction proves neither consent nor fault. The bank must provide positive, concrete and detailed evidence, and a statement mentioning a device is not such evidence.

The evidential scheme endorsed by the judgment can be summarised as follows:

Accordingly, the court orders SA Lyonnaise de Banque CIC to reimburse the total sum of €4,492.60 corresponding to the unauthorised transactions, plus interest at the statutory rate from 16 November 2020 (the date on which the acknowledgement of receipt of the formal notice was signed), pursuant to Articles 1231-6 and 1231-7 of the Civil Code (code civil). The bank is also ordered to pay all costs and €1,500 under Article 700 of the Code of Civil Procedure, all with provisional enforcement by operation of law.

Why was the claim for damages rejected?

In addition to reimbursement, the customer claimed €2,000 in damages for abusive resistance on the basis of Article 1240 of the Civil Code, criticising the bank for refusing to reimburse in breach of the provisions of the Monetary and Financial Code.

The court acknowledges that “the bank did indeed fail in its obligation to reimburse”, a clear finding. But it holds that this failure “is already remedied by the order to return the sums wrongly debited”. To obtain additional compensation, two things would have had to be shown: a loss distinct from the temporary deprivation of the funds (which is offset by interest at the statutory rate) and an independent fault on the part of the bank, characterised in particular by abusive or dilatory resistance: bad faith, delaying tactics or a manifestly unfounded refusal made in culpable circumstances.

In the absence of such elements, “the mere rejection of the reimbursement claim cannot suffice to characterise abusive resistance”. The claim for damages is rejected.

This part of the judgment calls for a critical remark. One may ask whether a refusal maintained for almost six years by a bank, on the strength of a single document that does not even specify the authentication methods, does not cross the line into a “manifestly unfounded refusal”. Article L. 133-18 requires immediate reimbursement, no later than the end of the first business day following the report; disregarding it without holding the proof required by Article L. 133-23 amounts to making the customer bear the weight of a dispute that the law was precisely meant to spare him. As long as abusive resistance continues to be assessed with such restraint, banks will keep an economic interest in refusing and then letting the proceedings run: at worst, they will reimburse what they already owed, with interest at the statutory rate. The trial courts nevertheless have, in Article 1240 of the Civil Code, the tool to penalise systematic refusals lacking any serious evidential justification.

What lessons for victims of banking fraud?

What should you do immediately in the event of a suspicious transaction?

The customer’s conduct in this case is a textbook example, and it is partly what made his case so solid. As soon as he received the suspicious emails: he checked with the bank, blocked his bank card, reported in writing to his advisers as early as 12 August, had a complaint registered on the Perceval platform, sent a letter of claim, then a formal notice through a lawyer. Each step was documented and produced in court.

Beware, however: what you write to your bank and in your complaint can be used against you to allege gross negligence. Clumsy wording (“I gave out my code”, “I validated the notification”) is regularly exploited by banks to refuse reimbursement. Before making any statement, read our practical guide: Banking Fraud: What to Say and Not to Say to Your Bank and in Your Complaint.

What time limits apply for reporting and for taking legal action?

The report to the bank must be made without delay and, in any event, within the thirteen-month period following the debit date provided for in Article L. 133-24 of the Monetary and Financial Code. The quicker the report, the more it neutralises the argument of culpable inaction: the Lyon court expressly noted the “particularly short period” of three days.

As for legal action, it is subject to the ordinary limitation period. In this case, the summons was served in November 2022 for events of August 2020, and the judgment was only delivered in June 2026. Interest at the statutory rate running from the 2020 formal notice partly compensates for this wait: hence the strategic importance of sending a formal notice by registered letter very early, which fixes the starting point of interest.

What legal levers can be used against a bank’s refusal?

This judgment is a reminder that the most effective ground is the statutory regime on unauthorised transactions: Articles L. 133-18, L. 133-19, L. 133-23 and L. 133-44 of the Monetary and Financial Code. The bank must prove strong authentication, not merely assert it. Demand the technical logs: proof that a one-time code was sent, a trace of validation in the app, biometric data. In the vast majority of cases, the bank does not produce them or produces incomplete documents, as here.

A complementary angle, still under-used, lies in the obligations arising from the technical standards (RTS) supplementing PSD2, which impose precise requirements on providers regarding strong authentication and transaction monitoring. These regulatory obligations strengthen the customer’s case when the bank claims that its system was compliant without concretely justifying it.

What should be taken from this judgment?

The judgment of the Court of First Instance of Lyon of 30 June 2026 invents nothing: it applies, with rigour and clarity, the rules of evidence intended by the European and French legislators. But that is precisely its strength. Faced with a bank that hid behind a supposed validation “via the mobile application”, the court demands concrete technical proof of strong authentication, refuses to infer consent or negligence from the mere fact that the transactions came from the customer’s iPhone, and orders the bank to reimburse in full with interest from the formal notice.

For victims of fraudulent transfers, the message is twofold. First, responsiveness and documentation of your steps are decisive: report immediately, in writing, and keep everything. Second, do not be intimidated by a refusal based on technical assertions that cannot be checked: before the judge, it is for the bank to produce the evidence, and it is often unable to. If your bank refuses to reimburse transactions you did not authorise, have your case reviewed by a banking law lawyer: the chances of success are decided from the very first statements.

FAQ: Your Questions on Reimbursement of Fraudulent Transactions