Fraudulent Transfers: Without Proof of Strong Authentication, the Bank Must Reimburse (CA Paris, 24 September 2025, No. 23/12487)

Paris Court of Appeal, Pôle 5, chamber 6, 24 September 2025, RG No. 23/12487

What happened in this case?

A customer of BRED Banque Populaire disputes nine transfers debited from her account between 30 November and 7 December 2020, for a total amount of €13,210, in favour of four new payees who were unknown to her.

The fraud originated in a fraudulent email received on 30 November 2020, claiming to come from the bank and inviting her to “BREDSecure activation”. The customer clicks on the link, believing it really is her bank, and enters her credentials to access her area. She is then told that an “important letter” is waiting for her in her personal area (which turns out to be false), and she logs out. In the following days, when she tries to log in again with her credentials, access no longer works. She is not immediately worried, thinking it is a new system introduced by the bank.

She files a criminal complaint on 8 December 2020 and alerts her adviser. BRED reimburses her €2,500 (corresponding to the last transfer) on 21 December 2020, but refuses the balance. After unsuccessful approaches, the customer sues the bank. The Paris Court of First Instance (tribunal judiciaire de Paris) dismisses her claim on 6 June 2023, finding that she had committed “culpable negligence” by clicking on the link, entering her credentials, and then failing to react when her attempts to log in became impossible. The customer appeals. The Paris Court of Appeal overturns that judgment in full.

How can it be proved that the transfers were not authorised?

The bank argued that the transfers were authorised, relying in particular on Article 9 of its general terms and conditions. The court dismisses this argument: the legal definitions of an authorised transaction cannot be derogated from by agreement. The question is therefore not what the general terms and conditions provide, but what the facts prove.

And the facts, here, speak in the customer’s favour. The court relies on two converging sources: the customer’s detailed criminal complaint, which clearly describes how the fraud unfolded, and, remarkably, the computer records produced by the bank itself.

Why are login sessions decisive?

The connection records filed by BRED reveal that the disputed transfers, to payees unknown to the customer, were ordered from login sessions (Session-ID) that do not match the customer’s. In other words, the bank itself provided the evidence that the orders did not come from its customer’s area.

The court adds a detail that turns against the bank: BRED does not dispute that the customer was unable to access her online account during the period, since it precisely criticises her for not having worried about it. By making this criticism, the bank implicitly admits that the customer no longer had control of her account. The unauthorised nature of the transfers is therefore “sufficiently established”.

Why does the absence of strong authentication make the victim win?

Once the unauthorised nature of the transactions is established, the bank is in principle required to reimburse (Article L. 133-18). To escape this, it must prove fraud or gross negligence on the part of the customer. But the judgment deploys here an additional argument, which is particularly powerful.

The customer complained precisely that she had not been alerted to the addition of the beneficiaries or to the transfers. Yet, the court notes, “BRED neither alleges nor demonstrates that it implemented a means of strong authentication within the meaning of Article L. 133-4 f) of the Monetary and Financial Code”. This is a severe finding: the bank does not even claim to have applied strong authentication.

The consequences are radical. Article L. 133-19, V, of the Monetary and Financial Code provides that, unless the payer has acted fraudulently, the payer bears no financial consequences if the unauthorised transaction was carried out without the bank requiring strong authentication. Where the bank has not put strong authentication in place, the very question of the customer’s gross negligence becomes moot: the bank must reimburse, full stop.

What do the European regulations (RTS / PSD2) say?

The judgment takes care to anchor this requirement in European law. Since 14 September 2019 (eighteen months after the entry into force of Delegated Regulation (EU) 2018/389 of 27 November 2017, which supplements the PSD2 Directive (EU) 2015/2366 with regulatory technical standards on strong authentication), the obligation has weighed fully on banks.

This point is strategically essential. The court does not merely note the absence of proof of authorisation: it notes the failure to implement a technical obligation weighing on the bank. For victims, this is a lever that is still under-used. Requiring the bank to demonstrate that it has actually deployed the strong authentication and monitoring mechanisms provided for by the RTS, rather than settling for general assertions, shifts the debate onto ground where the bank is often in difficulty.

Is clicking on a fake link gross negligence?

The court of first instance had held that clicking on the link in the fake email, and then entering her credentials, amounted to culpable negligence. The court of appeal reverses this analysis very clearly. Receiving an email that prompts the recipient only to log in using their credentials, without handing them to anyone, does not constitute gross negligence.

The distinction is crucial: “such a login from a link to one’s banking interface does not equate to voluntarily disclosing them to a third party”. The customer never gave her codes to a fraudster: she herself logged in to an interface she believed to be legitimate. Logging in is not disclosing. This is a nuance that banks often try to blur, and that the court restores with clarity.

Is a reaction time of one week a fault?

The bank also criticised the customer for not having worried about being unable to log in during the following days. The court dismisses this complaint: the momentary finding that she could not log in, followed by a report of the fraudulent transfers on 8 December 2020, that is, after one week, does not amount to gross negligence. The reaction time, assessed in its context, remains reasonable, especially as the customer could legitimately have thought it was a change of banking system.

Does a partial reimbursement amount to an admission of liability?

The question arose, because BRED had reimbursed €2,500 before refusing the balance. The bank argued that such an amicable payment did not amount to an admission of its liability. The court does not decide by drawing a presumption from this reimbursement, but bases its decision on the objective elements of the file (login sessions, absence of strong authentication). In practice, the partial reimbursement did not harm the bank in evidential terms, but nor was it enough to extinguish the dispute. The lesson for victims: a partial reimbursement offered by the bank should never be taken as the limit of your rights. The balance remains fully claimable.

What should you take away if you are a victim of fraudulent transfers?

This judgment forms part of an increasingly protective body of case law and offers several concrete lessons.

First, require your bank to prove that it implemented strong authentication. This is often its weak point. If it does not demonstrate that it actually deployed this mechanism for the disputed transactions (in particular for the addition of new beneficiaries), Article L. 133-19, V, works in your favour: you bear no loss. Do not let its general terms and conditions be set against you: the legal definitions cannot be derogated from there.

Next, request the technical connection records. In this case, it was the bank’s own data (the Session-IDs) that proved that the transfers did not come from the customer. These objective elements are worth far more than lengthy arguments.

Insist on the distinction between logging in and disclosing. Clicking on a link and entering one’s credentials on an interface one believes to be legitimate is not handing one’s codes to a third party. This nuance is enough, on its own, to rule out gross negligence in many phishing cases.

Finally, bear in mind that the technical obligations arising from the RTS Regulation (effective strong authentication, transaction monitoring, detection of abnormal patterns such as the sudden addition of four unknown beneficiaries) are a powerful and still under-used angle of attack. Filing a criminal complaint remains useful to document the fraud, but remember that the criminal complaint is not, in itself, a civil basis for reimbursement: reimbursement is won on the ground of payment law.

By overturning an unfavourable judgment and ordering the bank to reimburse almost all of the sums, this judgment confirms that the burden of proof weighs heavily on institutions, and that the failure to demonstrate strong authentication can, on its own, seal their liability.

FAQ: Frequently Asked Questions