Fraudulent Transfers: How to Obtain the Beneficiary’s Identity from Your Bank? (TJ Mulhouse, 23 February 2026, No. 24/00323)

Mulhouse Court of First Instance, Civil Protection, Enforcement and Proximity Division, 23 February 2026, No. 24/00323

In what context must a bank disclose information about beneficiaries?

Banking frauds are multiplying and taking increasingly sophisticated forms. Among the most widespread techniques is “phishing” by telephone: a fraudster poses as a bank adviser and persuades the victim to hand over confidential information or to make transfers.

When a customer realises they have been tricked, their first reaction is naturally to contact their bank to try to cancel the fraudulent transactions and recover their funds. But what happens when attempts to recall the transfers fail? Can the bank simply state that the funds cannot be recovered, or must it provide additional information enabling the customer to take other steps?

The facts: a telephone fraud victim facing her bank

The case decided by the Mulhouse Court of First Instance on 23 February 2026 perfectly illustrates this issue. A customer of La Banque Postale was the victim of a telephone fraud at the end of October 2023.

Fraudsters, posing as bank advisers, convinced her to make several transfers to a fraudulent account. Between 27 and 31 October 2023, several transactions were thus made from her account to an account with the bank details FR7817598000010000778792652, held with the institution Lydia Solutions (BIC code: LYDIFRP2XXX).

As soon as she became aware of the scam, the victim filed a complaint on 4 November 2023. She then sent a formal notice to La Banque Postale on 20 December 2023, claiming reimbursement of €5,000 corresponding to the misappropriated sums.

Faced with the bank’s refusal, she brought the matter before the Mulhouse Court of First Instance on 1 February 2024, seeking not only reimbursement of the sums but also, as a preliminary step, disclosure by the bank of all the information in its possession concerning the beneficiaries of the fraudulent transfers. The case was set down for the hearing of 20 February 2024, then, after several adjournments at the request of at least one of the parties, it was called again at the hearing of 25 November 2025.

What did the victim ask of her bank?

The claimant made several distinct claims before the court:

• As a preliminary matter (avant-dire-droit): she asked the court to order La Banque Postale to disclose to her all the information held on the beneficiaries of the disputed transfers, the bank having first to request this information from the company Lydia Solutions. She asked for this injunction to be backed by a penalty of €200 per day of delay.
• On the merits: she sought an order that the bank pay her €3,460.98 with interest increased by 15 points from 3 November 2023, or alternatively €5,000 with statutory interest from the date of the summons.
• Incidentally: she also sought €1,555.20 in respect of irrecoverable costs (Article 700 of the Code of Civil Procedure) together with all costs.

The victim’s argument was based on Article L. 133-21 of the Monetary and Financial Code, which requires the issuing bank, when it fails to recover the funds, to make available to the customer the information it holds in order to document a legal action.

What is the legal basis of the disclosure obligation?

The court’s decision relies on several fundamental provisions that govern the relations between banks and customers, particularly in respect of incorrectly executed or fraudulent payment transactions.

Article L. 133-21 of the Monetary and Financial Code: the cornerstone of the scheme

Article L. 133-21 of the Monetary and Financial Code forms the legal foundation of the obligation to disclose information. This provision establishes several essential principles concerning the execution of payment orders and the obligations of payment service providers.

The first paragraph of Article L. 133-21 lays down a presumption of correct execution: a payment order executed in accordance with the unique identifier provided by the customer is deemed to have been duly executed as regards the designated beneficiary. In other words, if the bank has correctly followed the instructions (RIB, IBAN) given by the customer, it has formally accomplished its task.

The second paragraph specifies that if the unique identifier provided by the customer is incorrect, the bank is not liable for the incorrect execution or non-execution of the transaction. This provision protects the bank where it is the customer who supplied the wrong details.

But it is the third paragraph that is of capital importance in the context of banking fraud. It places two successive obligations on the issuing bank:

• It must endeavour to recover the funds committed in the incorrectly executed payment transaction.
• The receiving bank must pass on to the issuing bank all useful information to recover the funds.

Finally, and this is the central aspect of the case, the text provides that if the issuing bank fails to recover the funds, it must, at the customer’s request, make available to them the information it holds that may document their legal action to recover the funds.

The obligations to recover funds and pass on information

An analysis of Article L. 133-21 reveals a cascading logic, where each obligation flows from the failure of the previous one:

This disclosure obligation is not optional: it derives from a clear legislative provision and applies to all banking institutions. Its aim is to ensure that the victim customer does not find themselves in a dead end, deprived of any means of action to recover their funds.

The Code of Civil Procedure reinforces this scheme by allowing the judge to order a party or a third party to produce documents they hold, if necessary under penalty payment (Articles 11, 442 and 446-3). The judge thus has the procedural tools necessary to compel a recalcitrant banking institution to comply.

What is the scope of this obligation for banks?

The decision of the Mulhouse Court of First Instance provides important clarifications on the concrete extent of the obligation borne by banks. The court does not merely state a general principle: it draws practical and binding consequences from it.

The requirement to take active steps with the receiving institution

The most remarkable point of this decision lies in the court’s analysis of La Banque Postale’s conduct. The bank had produced in the proceedings a document entitled “consultation of activity traces” showing the bank details of the beneficiary account (RIB and BIC code).

The bank claimed to have disclosed all the information in its possession and asserted that it held no information on the beneficiary’s identity. It considered that it had fulfilled its legal obligation.

The court rejects this argument. It notes a decisive element: La Banque Postale did not show that it had taken any steps with the institution Lydia Solutions to request all useful information for the recovery of the funds, in particular the identity of the beneficiaries of the transfers.

This requirement profoundly changes the scope of the bank’s obligation. It is not enough for the bank to pass on to the customer the information it already has in its IT system. It must actively request from the receiving bank the disclosure of further information enabling the fraudulent beneficiary to be identified.

This dynamic interpretation of Article L. 133-21 is in keeping with a consumer-protective logic. The customer who is the victim of a fraud finds themselves in a situation of information asymmetry: only banks have access to the information enabling the perpetrators of the fraud to be identified. Requiring the issuing bank to take an active step with the receiving institution aims to offset this imbalance.

The extent of the information to be disclosed to the customer

The court does not merely state a general principle: it specifies exactly what information must be passed on to the victim customer. The operative part of the decision orders La Banque Postale to disclose “all information in its possession concerning the precise identity, the address or any identifying element” of the beneficiary or beneficiaries of the fraudulent transfers.

This broad wording deserves attention. It encompasses:

• The precise identity: surname, first name, company name if a legal entity, any element enabling the beneficiary to be identified in terms of civil status.
• The address: home address declared when the account was opened, registered office, any address known to the banking institution.
• Any other identifying element: this open-ended wording allows additional data to be included, such as a telephone number, an email address, identification documents provided when the account was opened, etc.

The objective is clear: to provide the victim customer with all the elements necessary to bring legal proceedings effectively. Without this information, the customer is in a practical impossibility of suing the person truly responsible for their loss.

The court expressly justifies its decision by the purpose of this disclosure: “knowing the identity of the beneficiary of the disputed transfers may enable Ms [R] [V] to hold them liable and recover her funds”.

This purposive approach is consistent with the spirit of Article L. 133-21, which aims precisely to enable the customer to “document [their] legal action”. The information disclosed must be sufficiently precise and complete to make this action effective, and not merely theoretical.

What are the practical consequences for fraud victims?

This decision opens up important prospects for all victims of banking fraud. It gives them concrete levers of action to try to recover the misappropriated sums.

The means of action available to victims

Once in possession of the information provided by their bank, the victim customer has several options for action:

1. Direct action against the fraudulent beneficiary

If the beneficiary’s identity and address are known, the victim can sue them in civil liability before the Court of First Instance. This action seeks an order that the fraudster reimburse the misappropriated sums, together with damages for non-pecuniary loss.

A criminal complaint for fraud (Article 313-1 of the Criminal Code (Code pénal)) can support this civil action. The victim can join the criminal proceedings as a civil party, or bring an independent civil action in parallel.

2. Holding the receiving bank liable

The court expressly notes this possibility in its decision. Banking institutions are subject to strict due diligence obligations when opening accounts, arising from anti-money laundering and counter-terrorist financing regulations.

If the receiving bank opened an account without carrying out the checks required by Article L. 561-5 of the Monetary and Financial Code, it may be held liable for having facilitated the commission of the fraud. This negligence in fulfilling KYC obligations constitutes a fault that may give rise to compensation.

3. Passing the evidence on to the authorities

The information obtained can also be added to the criminal file. It allows investigators to direct their enquiries and increases the chances of identifying and arresting the perpetrators of the fraud.

In some cases, these elements may reveal the existence of an organised fraud network, justifying the opening of a judicial investigation entrusted to an investigating judge.

Liabilities that may potentially be engaged

The Mulhouse decision rules only on the request for disclosure of information, treated as a preliminary matter. The court expressly referred the examination of the claims on the merits (in particular reimbursement of the sums and analysis of La Banque Postale’s liability) to a later hearing.

Nevertheless, the account of the dispute makes it possible to identify the various grounds of liability that may be invoked:

Liability of the issuing bank

The customer relied on several failings by La Banque Postale:

• No proof that the transactions were authorised: under Articles L. 133-18 and L. 133-19 of the Monetary and Financial Code, when a customer denies having authorised a transaction, it is for the bank to prove that the transaction was authenticated, duly recorded and accounted for, and not affected by a technical or other deficiency. The customer asserted that she had never activated the online transfer services.
• Breach of the duty of vigilance: the customer criticised the bank for not alerting her to the scam under way, although the abnormal nature of the transfers made should have prompted its vigilance. This argument raises the delicate question of the extent of the bank’s duty of vigilance and its limits, in particular in light of the principle of non-interference in the customer’s affairs.
• No proof of gross negligence by the customer: even if the transaction were regarded as unauthorised, the bank could escape liability by demonstrating that the customer showed gross negligence that contributed to the fraud (Article L. 133-19 of the Monetary and Financial Code).

The bank, for its part, argued that the customer had “crudely” disclosed all of her confidential information to a fake bank adviser, thereby committing gross negligence such as to release it from all liability. It argued that the transactions were “authorised transactions” within the meaning of Article L. 133-6 of the Monetary and Financial Code.

This controversy will have to be resolved at a later hearing, but it illustrates the complexity of banking fraud disputes, where conflicting logics clash: consumer protection versus holding the user accountable in the face of digital risks.

Liability of the fraudulent beneficiary

The perpetrator of the scam obviously incurs civil and criminal liability. In civil terms, they are bound to make good the entire loss caused, including the amount of the misappropriated sums and the non-pecuniary loss suffered by the victim.

In criminal terms, fraud is punishable by five years’ imprisonment and a fine of €375,000 (Article 313-1 of the Criminal Code). These penalties are increased to seven years’ imprisonment and a fine of €750,000 where the fraud is committed by a person holding public authority or entrusted with a public service mission, by an organised gang, to the detriment of a vulnerable person, or by means of electronic communications.

Liability of the receiving bank

As mentioned above, if the bank that opened the fraudster’s account failed in its due diligence obligations, its liability can be sought. This scenario requires showing that the account was opened without serious verification of the holder’s identity or of the reality of their address.

The due diligence obligations laid down by the Monetary and Financial Code aim precisely to prevent accounts from being used for fraudulent purposes. Their breach may constitute a civil fault giving rise to liability towards victims.

How to obtain this information in practice?

The decision under review offers a valuable procedural guide for anyone wishing to obtain from their bank the information relating to a fraudulent beneficiary.

The prior formal notice

Before any court action, it is essential to send the bank a formal notice (mise en demeure). This step serves several functions:

• It documents the customer’s request and starts the clock running on the bank’s time to respond.
• It fixes the starting point of the loss and of any default interest.
• It conditions, in some cases, the admissibility of the court action.
• It offers a last opportunity for an amicable resolution before costly legal proceedings are started.

The formal notice must be sent by registered letter with acknowledgment of receipt. It must state clearly:

• The nature of the fraud suffered and the date it was discovered.
• The disputed transactions (dates, amounts, bank details of the beneficiary account).
• The steps already taken (filing of a complaint, report to the bank, any attempt to recall the funds).
• The express request for disclosure of all the information held or obtainable from the receiving bank concerning the beneficiary’s identity, address and any identifying element.
• The legal basis of this request (Article L. 133-21 of the Monetary and Financial Code).
• The period allowed to the bank to respond (generally 8 to 15 days).
• The consequences of no response or of a refusal (court action, claim for damages).

In the case decided at Mulhouse, the customer had sent a formal notice on 20 December 2023, about six weeks after filing her complaint. This period appears reasonable: it allows time for the police investigations to begin and for the bank to attempt a recall of the funds, while preserving the chances of recovery.

Bringing the matter before the court in the event of refusal

If the bank refuses to disclose the information or does not respond to the formal notice, the customer can bring the matter before the competent Court of First Instance. The choice of court follows the usual rules of territorial jurisdiction: the court of the defendant’s domicile (the bank’s or the branch’s registered office) or the court of the place where the contract is performed.

Nature of the procedure

The action can be brought in accordance with the ordinary procedure before the Court of First Instance. Representation by a lawyer is mandatory, except before the proximity courts for low-value disputes.

In the Mulhouse case, the customer had sued La Banque Postale by an instrument served by a court commissioner (commissaire de justice, formerly a bailiff) on 1 February 2024. The summons set out all of her claims, both the preliminary request for disclosure of information and the merits of the dispute (reimbursement of the sums).

Procedural strategy: the preliminary (avant-dire-droit) request

The approach adopted by the customer deserves to be highlighted. Rather than limiting herself to a claim for reimbursement, she made a preliminary “avant-dire-droit” request, asking the court first to order disclosure of the information.

This strategy has several advantages:

• It makes it possible to obtain quickly the information needed to complete the file and, where appropriate, to bring in other parties (the fraudulent beneficiary, the receiving bank).
• It eases the judge’s task, as the judge can examine the claim on the merits with all the relevant elements to hand.
• It puts pressure on the defendant bank, which is compelled to provide the information before its liability has even been examined.

The court received this approach favourably by ordering disclosure of the information while reserving examination of the other claims to a later hearing. This “step-by-step” method appears particularly well suited to banking fraud disputes, where the identification of the protagonists often determines the outcome of the dispute.

The question of the penalty payment

The claimant had asked for the disclosure injunction to be backed by a penalty payment of €200 per day of delay. This request aimed to guarantee the effectiveness of the decision and to prevent the bank from showing inertia.

The court nevertheless refused to impose a penalty payment, considering that “nothing justifies imposing a penalty payment at this stage”. This position may be explained by several considerations:

• The bank had not yet had the opportunity to comply with a court injunction. A penalty payment generally sanctions persistent resistance, which had not been established at this stage.
• The court may have considered that the injunction itself would be sufficiently binding to secure compliance.
• The bank itself had to request the information from a third party (Lydia Solutions), which introduced a variable partly outside its control.

However, the refusal of the penalty payment does not deprive the decision of enforceable force. If the bank does not comply within the period allowed, the customer will be able to apply to the court again to request, this time, a penalty payment or an order against the bank for failure to comply with a court decision.

What are the limits of this obligation?

While the Mulhouse decision strongly asserts the disclosure obligation borne by banks, it does not resolve all practical difficulties. Several limits must be stressed.

Dependence on the receiving bank

The issuing bank’s obligation is to request the information from the receiving institution and to pass on what it obtains. But it cannot guarantee that the receiving bank will provide complete and accurate information.

In some cases, the beneficiary account may have been opened with false documents or false information. The receiving bank will then provide data that will not make it possible to identify the true perpetrator of the fraud.

Moreover, if the account has been closed in the meantime or if the receiving bank relies on banking secrecy or personal data protection provisions, obtaining the information may run into legal obstacles.

Transmission delays and the risk of evidence disappearing

The process of disclosing the information takes time: formal notice, possible court action, time for judgment, the issuing bank’s request to the receiving bank, transmission of the information to the customer. During this time, the perpetrators of the fraud may have arranged their insolvency or disappeared.

Fraudulently obtained funds are generally transferred quickly to other accounts, sometimes abroad, making them extremely difficult to trace and recover.

Cost and complexity of the court procedure

Obtaining a court decision ordering disclosure of information requires the assistance of a lawyer and the payment of legal costs. For frauds involving modest amounts, the cost of the procedure may discourage victims.

In the case decided at Mulhouse, the customer was claiming about €3,500 to €5,000. Even though she succeeded on the disclosure request, she will have to continue the proceedings to obtain reimbursement, with the costs and uncertainties that this entails.

The question of territorial jurisdiction where the bank is foreign

Where the receiving bank is located in another European Union country or outside the EU, the request for disclosure of information may run into difficulties of jurisdiction and application of the law.

The applicable rules may vary between Member States and cooperation between national banking authorities is not always smooth.

Limits arising from personal data protection

The General Data Protection Regulation (GDPR) strictly governs the collection, processing and disclosure of personal data. Banks may invoke these provisions to limit the information passed on.

However, the GDPR provides for exceptions allowing the processing of personal data where it is necessary for the establishment, exercise or defence of legal claims. The legal obligation laid down by Article L. 133-21 of the Monetary and Financial Code is a sufficient basis for setting aside these restrictions in the context of court proceedings.

Conclusion

The decision of the Mulhouse Court of First Instance of 23 February 2026 is a welcome and rigorous application of Article L. 133-21 of the Monetary and Financial Code. By requiring La Banque Postale to actively request from the receiving institution the information enabling the beneficiary of the fraudulent transfers to be identified, the court gives full effect to the statutory disclosure obligation.

This dynamic interpretation protects fraud victims by giving them the concrete means to recover their funds. It recalls that the role of banks is not limited to mechanically executing payment orders, but extends to an obligation of active cooperation when their customers are the victims of fraudulent schemes.

For victims of banking fraud, this case law offers a valuable guide: a detailed formal notice, a preliminary (avant-dire-droit) request, explicit reference to Article L. 133-21, and emphasis on the obligation to take active steps with the receiving bank. All of these are elements likely to persuade judges to order disclosure of the information needed for the effective exercise of a legal remedy.

FAQ: Frequently Asked Questions