Fraudulent Transfers: Banque Populaire du Sud Ordered to Pay for Lack of Logs (TJ Montpellier, 18 June 2026, No. RG 23/03161)

Court of First Instance of Montpellier, civil division, section 2, 18 June 2026, No. RG 23/03161

What Happened in This Fraudulent Transfer Case?

The case decided on 18 June 2026 by the civil division of the Court of First Instance of Montpellier presents a scenario that has sadly become classic: transfers made without the account holder’s knowledge, a bank that relies on its security system, and a victim forced to go to court to obtain what the law has long guaranteed her.

How Did the Fraud Unfold?

The customer, born in 1959, held two long-standing accounts with Banque Populaire du Sud: a current account opened in January 1992 and a savings book opened in January 2009. Between 10 and 11 June 2022, a series of transfers was made on her accounts following a pattern well known to fraudsters: first internal transfers intended to “bring back” the savings to the current account, then external transfers to third-party accounts.

Specifically, on 10 June 2022, a transfer of €4,000 was made from the savings book to the current account, immediately followed by a transfer of €5,500 from the current account to a third-party account. On 11 June 2022, two further internal transfers of €8,000 and €5,200 emptied the savings book into the current account, before two external transfers of €1,500 and €5,000 to two different beneficiaries. In total, three external transfers for €12,000, to accounts held with an institution in another European country, an Italian bank, as the subsequent proceedings would specify.

On the morning of 11 June 2022, the customer received on her phone an email alerting her to a “notice of non-execution of the instant transfer” for an amount of €2,995, inviting her to contact her bank if she was not the originator of the transaction. The judgment does not detail the fraudsters’ exact modus operandi: it says neither how the credentials were captured, nor who operated the online space. It is precisely this technical grey area that was to turn against the bank, which failed to produce any element of traceability.

How Did the Customer React?

The victim’s responsiveness is an element that the court takes care to stress. On 11 June 2022 itself, she informed her adviser at Banque Populaire du Sud that she was not the originator of the transfer reported by the email. The same day, after consulting her accounts online and noting the disputed transactions, she filed a complaint with the gendarmerie for fraud. On 13 June 2022, she formally reported to her adviser the three transfers made to the third-party accounts for a total amount of €12,000.

The court expressly notes that the customer “reacted, despite her age, within a very short time”. This prompt report fully satisfies the obligation laid down in Article L. 133-24 of the Monetary and Financial Code, which requires an unauthorised transaction to be reported “without delay”, and at the latest within thirteen months of the date of debit.

Why Did the Bank Refuse to Reimburse?

On 13 June 2022, Banque Populaire du Sud initiated a request for cancellation of a euro transfer, known as a “Recall” procedure, for the three disputed transfers. By email of 30 June 2022, it informed its customer that the Italian bank holding the recipient accounts had not acted on this request.

Asked the same day for reimbursement of €12,000, the bank refused on 19 July 2022, on the ground that the transfers had been made from the customer’s “Cyberplus” space with the strong authentication system. In other words, the bank considered that the transactions had been validly authorised or, at the very least, that the customer had committed gross negligence in safeguarding her security data. Having been served with formal notice by letter of 21 July 2022, the bank maintained its position. The customer then summoned it before the Court of First Instance of Montpellier by writ of 7 July 2023, on the basis of Articles L. 133-4, L. 133-6, L. 133-15, L. 133-17, L. 133-19, L. 133-23 and L. 133-24 of the Monetary and Financial Code.

What Does the Law Say About Unauthorised Payment Transactions?

The dispute revolves around a body of provisions resulting from the transposition of the European directives on payment services, now codified in Articles L. 133-1 et seq. of the Monetary and Financial Code. This regime is remarkably effective for victims, provided one knows how it works.

Who Must Prove What? The Mechanism of Article L. 133-23

This is the heart of the judgment. Article L. 133-23 of the Monetary and Financial Code provides that where a payment service user denies having authorised a transaction that has been executed, “it is for their payment service provider to prove that the transaction in question was authenticated, duly recorded and accounted for and that it was not affected by a technical or other deficiency”.

The text adds a crucial clarification, which banks often prefer to forget: “the use of the payment instrument as recorded by the payment service provider is not necessarily sufficient in itself to prove that the transaction was authorised by the payer or that the payer failed, intentionally or through gross negligence, to fulfil their obligations in this regard”.

When Must the Bank Reimburse?

Article L. 133-18 of the Monetary and Financial Code requires the payment service provider to reimburse the payer the amount of the unauthorised transaction “immediately after becoming aware of the transaction or after being informed of it, and in any event no later than the end of the following business day”. The only escape: “good reasons to suspect fraud by the user”, communicated in writing to the Banque de France. The reimbursement must restore the account “to the state in which it would have been had the unauthorised payment transaction not taken place”.

This provision is remarkably clear, and one can measure the gap between the legal requirement (reimbursement within one business day) and the reality experienced by the victim in this case: four years of proceedings to obtain what the law required to be returned within twenty-four hours.

What Is Gross Negligence and Who Must Prove It?

Article L. 133-19, IV of the Monetary and Financial Code allows the bank to escape reimbursement if the losses result from “fraudulent conduct” by the payer or if the payer failed, “intentionally or through gross negligence” (négligence grave), to fulfil their obligations to safeguard the security of their personalised data (Articles L. 133-16 and L. 133-17). Paragraph II of the same article provides, conversely, that the payer’s liability is not engaged if the transaction “was carried out by misappropriating, without the payer’s knowledge, the payment instrument or the data linked to it”.

In this case, Banque Populaire du Sud precisely argued that its customer had committed “gross negligence”. It still had to demonstrate it, and this is where the bank’s defence collapsed.

How Did the Montpellier Court Reason?

The court sets out a multi-step line of reasoning, highly orthodox from a legal standpoint, which deserves to be detailed as it amounts to a user manual for victims and their counsel.

Why Was Invoking Secur’Pass and PSD2 Not Enough?

The bank argued that the transfers had been made from the customer’s personal “Cyberplus” space, secured by an authentication system called “Secur’Pass”, presented as compliant with the second European Payment Services Directive (PSD2). The court responds with a statement that will become a landmark in the firm’s files:

“The mere assertion by Banque Populaire du Sud that it has equipped itself with an IT tool called SECUR PASS compliant with the second European directive on payment services (PSD2), including authentication by an identifier and the entry of a password, is insufficient to demonstrate that Mrs [Z] gave her consent to the disputed transactions.”

In other words: describing one’s security architecture is not proving how it worked in the case at hand. What the law requires of the bank is not an abstract demonstration that it has a strong authentication system, but concrete proof that those particular transactions were authenticated, duly recorded and accounted for, and that they were not affected by any technical deficiency. The distinction is fundamental, and it is too often lost sight of in the refusal letters sent to victims.

Why Was the Absence of Logs Decisive?

The most instructive passage of the judgment fits in one sentence: “as regards the process, the bank does not provide the logs or any other element or technical trace showing how the transactions were made”. The bank claimed that the transfers had been validated by a one-time code sent by SMS to the customer’s phone number; the court notes that it does not establish this, observing that it “asserts it peremptorily”.

The practical scope of this finding must be appreciated. Banks alone hold this technical evidence; the victim never has access to it. If the production of mere assertions were enough, the reversal of the burden of proof intended by the European legislator would be emptied of its substance. By requiring the logs, or any other equivalent technical element, the Montpellier court gives the text its full practical effect: a bank that wants to keep €12,000 must open its black box.

Does Use of the Personal Online Space Prove Consent?

It was established, from the account statements, that the disputed transfers had been issued from the customer’s personal space, and she conceded in her complaint that she accessed her accounts through this space. The court infers that the transfers made from this space “are therefore the payment instruments”, but refuses to go any further.

Taking up the now well-established principle, it recalls that proof of authorisation or of gross negligence “cannot be inferred from the mere fact that the payment instrument or the personal data linked to it were actually used”. And it adds: “the actual use of the payment instrument and of the personal data linked to it is not sufficient by itself to establish gross negligence on the part of Mrs [Z], Banque Populaire du Sud providing no element capable of establishing it”.

The bank therefore fails on both counts: it proves neither that the customer consented to the transactions, nor that she committed gross negligence in safeguarding her credentials. The file contained, at bottom, nothing other than the undisputed finding that the online space had served as the channel for the fraud. Yet this finding is neutral: it is characteristic of credential-hijacking frauds that they use legitimate channels.

What Should Be Made of the Absence of the Account Agreements From the File?

The judgment contains a piquant procedural observation: “it is regrettable that neither party produces the agreements for the accounts opened by Mrs [Z]”. The bank asserted that its customer had signed a subscription contract for the “Cyberplus” service, but produced only the specific terms of the account and service agreements, “without establishing that Mrs [Z] had subscribed to them or that she was aware of them and therefore that they were enforceable against her”.

The lesson is valuable for practitioners: even the contractual foundation of the relationship, namely the existence and enforceability of the subscription to the online banking service, must be proved by the bank relying on it. In this case, the customer did not dispute this point, which allowed the court to disregard it; but the observation serves as a warning to institutions that plead strong authentication without producing the contract that stipulates it.

Does the Failure of the “Recall” Change Anything?

The bank had initiated, as soon as the fraud was reported, a procedure to request the return of the funds. The court holds this circumstance to be “irrelevant”: the Recall procedure depends “on the agreement of the beneficiary of the transfers and of their bank, an agreement which, moreover, was not obtained”.

This clarification is important because banks readily present the Recall as proof of their diligence, even as a full and final settlement: “we did what was necessary, the foreign bank did not respond”. The court puts things back in their place: attempting to recover the funds is one thing, the obligation to reimburse the unauthorised transaction is another, and the former does not extinguish the latter.

What Should Victims of Fraudulent Transfers Take Away From This?

What Practical Lessons Can Be Drawn From This Judgment?

This judgment forms part of an increasingly firm line of case law, which the firm observes before the lower courts as well as before the French Supreme Court (Cour de cassation): judges no longer accept banks taking refuge behind the theoretical existence of their security systems. Three practical lessons emerge.

First lesson: disputing the transactions triggers the evidentiary mechanism. Once the account holder denies having authorised the transactions, the bank bears the entire burden of proof. The victim does not have to explain how their credentials may have been captured; it is for the bank to technically reconstruct the path of the transactions. It is still necessary to dispute quickly, in writing, and without being trapped by the bank’s leading questions: on this point, we refer to our practical guide Bank Fraud: What to Say and Not to Say to Your Bank and in Your Complaint.

Second lesson: demand the logs. In any dispute over a contested transfer, the production of the technical records (connection logs, authentication traces, proof that SMS messages or notifications were sent) must be at the centre of the debate. A bank that does not produce them is exposed to an almost automatic order against it, as in this case. The victim’s responsiveness, who reported the facts and filed a complaint within forty-eight hours, also neutralised any debate on the time bar of Article L. 133-24.

Third lesson: the technical standards work in the victim’s favour. The regulatory technical standards (RTS) that supplement PSD2 impose on banks precise obligations regarding strong authentication and transaction monitoring. Far from being a shield for banks, these standards are a lever for victims: a bank that claims to comply with them must be able to justify it transaction by transaction, and failure to comply may engage its liability. This ground remains under-exploited in transfer fraud disputes.

Why Was Abusive Resistance Not Upheld?

The customer sought €10,000 in damages for abusive resistance in the reimbursement. The court dismisses this claim by recalling the classic test: “defending legal proceedings is a right and degenerates into a fault capable of giving rise to damages only in cases of malice, bad faith or gross error tantamount to fraud”. In this case, the bank’s bad faith was not demonstrated, and the customer did not show any loss distinct from that compensated by default interest.

The severity of this assessment may be questioned. Article L. 133-18 requires reimbursement at the latest by the end of the first business day following the report; the bank resisted for four years, without ever producing any technical element in support of its refusal. Is refusing to reimburse by invoking strong authentication of which proof will never be provided not precisely a resistance whose abusive nature could be argued? Some lower courts moreover accept, in similar configurations, to compensate the loss resulting from the delay in reimbursement. The point deserves to be systematically pleaded, because as long as resistance costs only interest at the statutory rate, banks have little incentive to comply with the statutory reimbursement deadline.

The victim nevertheless obtains, in addition to the principal of €12,000 with interest at the statutory rate from the formal notice of 21 July 2022, the sum of €3,000 under Article 700 of the Code of Civil Procedure, as well as an order that the bank bear all costs, all accompanied by provisional enforcement by operation of law.

What Should Be Remembered From This Judgment?

The judgment of the Court of First Instance of Montpellier of 18 June 2026 is a rigorous and welcome application of the regime for unauthorised payment transactions. It reminds banks that Article L. 133-23 of the Monetary and Financial Code is not a formality: proof of authentication is provided by concrete technical elements (logs, traces, proof of the sending of validation codes) and never by the mere invocation of a security system, even one named “Secur’Pass” and presented as compliant with PSD2.

For victims of fraudulent transfers, this judgment confirms a proven strategy: deny consent, report without delay, and place the bank before its evidentiary burden. For banks, it sounds a warning: failing traceability produced in court, reimbursement is unavoidable. The firm LE BOT Avocat, which exclusively defends customers against banks, supports victims of transfer fraud at every stage of this process, from the initial dispute through to the hearing.

FAQ: Frequently Asked Questions