Fraudulent Transfer: A Bank That Fails to Prove Strong Authentication Must Reimburse (Pau Court of Appeal, 17 September 2026, No. 25/00267)

Pau Court of Appeal (cour d’appel), 2nd chamber, section 1, 17 September 2026, No. RG 25/00267

What are the facts of the case?

On 13 January 2023, at 12:27, Ms W. received an SMS from her bank. The message informed her that a new beneficiary for transfers to France had been created, then that an instant transfer of €5,950 had been executed at 12:28 to a third party’s account. A second transfer, of €2,900, to the same beneficiary, was rejected by the bank at 12:32.

The customer immediately contacted her branch to dispute these transactions. In the meantime, at 13:18, an adviser left her a voicemail asking her to call back about “the addition of an IBAN that looks suspicious to us”. The recall procedure, which aims to recover the funds from the beneficiary’s bank, was unsuccessful for the €5,950 transfer. The customer filed a criminal complaint for fraud (escroquerie) and requested reimbursement of the sum, which she said she had never authorised.

The bank refused. It argued that the transactions had been subject to strong authentication, which, in its view, relieved it of all liability and placed the burden of the losses on the customer.

The proceedings unfolded in three stages. Summoned on 19 March 2024 before the Court of First Instance of Pau (tribunal judiciaire), the bank was ordered by a judgment of 9 January 2025 to refund €5,950, together with statutory interest increased by 15 points from 14 February 2023, and to pay €1,500 under Article 700 of the Code of Civil Procedure. The first judge held that the bank had not proved gross negligence or fraud on the part of the customer. The bank appealed on 31 January 2025. After the close of the investigation, the hearing took place on 21 May 2026 and the judgment was delivered on 17 September 2026.

What question did the court have to decide?

The dispute concerns two levels of liability, which follow one another in the regime governing unauthorised payment transactions.

The first level concerns the bank. Before attributing a loss to the customer, the payment service provider must show that the transaction was authenticated, duly recorded and accounted for, and that it was not affected by a technical or other deficiency. Only once that proof has been provided does the question of the customer’s fault arise.

The second level concerns the customer. The payer bears all losses if they result from fraudulent conduct on their part, or if they intentionally or through gross negligence failed to meet their obligations to keep their personalised security credentials safe (Article L. 133-19 IV of the Monetary and Financial Code (code monétaire et financier)).

The bank had built its argument in the opposite order. According to the bank, the fraudsters had logged in to the account on 10 January 2023 at 12:22 using strong authentication. They could therefore only have had the customer’s username and password. It noted that the customer had been informed of the enrolment of a new device by an email sent on 10 January 2023 at 13:03, to which she did not react. It inferred that the customer, “apparently a victim of phishing or smishing”, had necessarily disclosed her secret codes to third parties, and that she should bear the entire loss alone.

Why does the bank fail to prove strong authentication?

The court begins by recalling the applicable text. Article L. 133-23, paragraph 1, of the Monetary and Financial Code provides that, where a user denies having authorised a payment transaction that has been executed, “it is for the payment service provider to prove that the transaction in question was authenticated, duly recorded and accounted for and that it was not affected by a technical or other deficiency”.

Paragraph 2 of the same article adds that the use of the payment instrument, as recorded by the bank, “is not necessarily sufficient in itself to prove that the transaction was authorised by the payer”, nor that the payer was grossly negligent. Recording that a login took place therefore does not prove that the customer allowed it.

The court draws a clear sequence from this: in order to make the customer bear the losses from an unauthorised transaction, the bank must “first” prove that the transaction was authenticated, duly recorded and accounted for. It refers to its own settled case law, citing the French Supreme Court (Cour de cassation) (Com., 30 April 2025, appeal No. 24-10.149, as cited in the judgment).

Applying this framework, the court finds that the bank proves neither the strong authentication of the disputed login, nor that of the transfer itself. The reasoning proceeds in two distinct steps:

Article L. 133-44 of the Monetary and Financial Code, which the court cites, requires the provider to apply strong authentication when the payer accesses their payment account online, initiates an electronic payment transaction, or carries out a remote transaction that may involve a risk of fraud. It is precisely this requirement that the bank had to establish for the login as well as for the transfer.

Can an internal technical statement be enough?

The most instructive point of the judgment lies in the exhibits. To demonstrate the authentication of the fraudulent login, the bank relied on a document called DIOS, relating to the customer’s logins, produced as exhibit 8. According to the bank, this file showed that the login of 10 January 2023 at 12:22 had been authenticated.

The court examines the exhibit and finds that it “consists of a technical nomenclature relating to the names of banking interventions and transactions and their coded abbreviations for internal use”. In other words, it is a key to the codes used by the bank, not a log recording a specific event. It documents neither the time, nor the method of authentication, nor the transaction concerned.

The lesson is important in practice. A bank that relies on strong authentication must produce evidence that demonstrates it for the disputed transaction itself: a time-stamped authentication log, a trace of the validation, a record of logins with their validation method and, where relevant, evidence of the enrolment of a new device. A leaflet, a nomenclature or a general statement that the system works in a “secure” manner is not enough to meet this requirement.

The Pau Court of Appeal’s judgment thus joins a line of case law that is now well established in fraud litigation: the bank cannot content itself with general traces of the use of the payment instrument. It must establish the precise fact of authentication. On this point, the decisions handed down in 2026 by several courts of appeal point the same way, as shown by our analysis of a Besançon Court of Appeal judgment on refusals based on mere presumptions.

The court also notes that the evidence was lacking for the €5,950 transfer itself. The bank could therefore not rely on the fraudulent login to establish the authentication of the disputed payment order: each transaction must be proved in its own right.

Why does the court not examine gross negligence?

The first judge had held that the bank did not prove intentional breach or gross negligence on the part of the customer. The Court of Appeal does not take up that reasoning. It states that, “without it even being necessary to examine the gross negligence attributed to Ms [W]”, the judgment must be upheld as to the order that the bank refund €5,950, with the increased interest.

The wording is precise and deserves careful reading. The operative part upholds the judgment “in all its provisions, disregarding the one holding that the bank did not prove the intentional breach or gross negligence of Ms [W]”. The court thus expressly sets aside the first judge’s reasoning on this point, without ruling on the question itself.

In practical terms, this means that the judgment does not decide that the customer committed no fault. It decides that the bank, which had to prove authentication, did not do so, which makes any examination of the customer’s fault unnecessary. The bank’s arguments on phishing or smishing, on the 13:03 email that went unanswered, or on the customer’s supposed “negligence”, are neither accepted nor rejected. They are moot in the reasoning adopted.

This economy of reasoning has a practical consequence. If, in another case, a bank succeeds in proving strong authentication and the recording of the transaction, the question of gross negligence will have to be examined on the merits, with all its components. This decision therefore does not set a threshold for gross negligence, and it does not relieve the customer of the need to answer allegations of fault where they are properly supported.

What does this mean for fraud victims?

This decision should be read with caution. At the date of its publication it is unreported, which means that it does not appear in the Bulletin of the French Supreme Court (Cour de cassation) and is not intended to lay down a new principle. On the contrary, it applies rules established by Articles L. 133-19 and L. 133-23 of the Monetary and Financial Code. Its practical value therefore lies in illustrating, on concrete exhibits, how those rules apply.

Three lessons emerge.

First, proof of authentication is a precondition. Before any debate on the victim’s negligence, the bank must prove that the transaction was authenticated, duly recorded and accounted for. If it fails to do so, the victim does not have to demonstrate their good faith in order to be reimbursed.

Second, the form of the evidence matters. An internal nomenclature, an operating leaflet or a general record of logins is not enough to establish a specific event. The judge expects evidence that dates, identifies and characterises the disputed transaction. This is a requirement that victims’ lawyers should systematically check in the exhibits produced by the bank.

Third, the question of fault remains open. The judgment says nothing about gross negligence, and the customer’s failure to respond to the 13:03 email is not characterised in it. A victim who succeeds on the question of proof should therefore bear in mind that, in other cases, the bank may find a line of defence again if it establishes its technical evidence.

The case forms part of a body of litigation in which the question of proof has become central. Similar solutions can be found in the decisions that distinguish strong authentication from authorisation of the transaction, as well as in the judgments that require the bank to prove authentication rather than merely the use of the codes.

Finally, it should be remembered that the bank, having lost on appeal, can still bring an appeal on points of law (pourvoi en cassation). The time limit is two months. Until it has expired or the appeal has been decided, the decision should not be regarded as final.

What should you do if the bank refuses to reimburse you?

The situation described in the judgment is that of a victim who was caught in a fraud, disputed the transactions as soon as she became aware of them, and filed a criminal complaint. These reflexes are useful because they fix the facts in time. The details of what should be stated, and what is better left unsaid, in dealings with the bank and in the complaint are covered in our article on bank fraud and the criminal complaint.

In practice, it pays to follow four steps:

• Dispute in writing with the bank, specifying the transactions, their date and their amount, and expressly asking for proof of strong authentication of each transaction.
• Request the technical evidence: authentication logs, traces of the enrolment of a new device, history of logins with their validation method. This is the ground on which the bank must convince.
• Take legal action if the refusal persists. The time limit for reporting the transaction to the bank is in principle thirteen months, and the time limit for bringing proceedings is five years, under Article L. 133-24 of the Monetary and Financial Code. These time limits are assessed case by case.

A well-advised victim therefore prepares their case around the question of proof, rather than around their own supposed fault, which the customer does not have to disprove.

What should be taken from this decision?

The Pau Court of Appeal’s judgment of 17 September 2026 is a useful reminder. In a fraudulent transfer dispute, the question is not first of all whether the victim was careless. It is whether the bank can prove that the transaction was authenticated, recorded and accounted for, without technical deficiency. As long as it does not demonstrate this, it cannot place the losses on its customer.

For the litigant, the decision has a twofold significance. It protects the victim against a refusal based on presumptions or generic documents. It does not, however, dispense with a precise analysis of the facts, because the question of gross negligence remains open if the bank one day manages to establish its technical evidence. The right strategy is therefore to demand that evidence from the outset, to document the fraud chronologically, and not to be drawn into a debate about fault.

FAQ: Fraudulent Transfers and Strong Authentication