Fraudulent Transfers and Trusted Beneficiaries: The Challenge to Strong Authentication Must Be Decided by the Court (Cass. com., 4 February 2026, No. 24-20.003)

French Supreme Court (Cour de cassation), Commercial, Financial and Economic Chamber, 4 February 2026, appeal No. 24-20.003 (F-D)

What is the context of the 4 February 2026 judgment?

Fraud by beneficiary addition remains, in 2026, one of the most effective ways of siphoning funds from business accounts. The method is well known: a third party, through phishing, takeover of a mobile device or a fake instruction sent to the manager, manages to insert into the account’s list of authorised beneficiaries a payee that the fraudster controls. Once this beneficiary is registered, subsequent transfers to that account no longer trigger, in most banking architectures, any additional request for strong authentication. Several orders can then be executed in succession, sometimes within minutes, before any detection.

On the legal front, the bank almost always raises the same argument against victims: since the addition of the beneficiary was validated by strong authentication on the account holder’s “trusted” mobile device, transfers to that beneficiary are authorised transactions within the meaning of the Monetary and Financial Code (code monétaire et financier). The debate on the bank’s liability is thus closed before it has even been opened.

The 4 February 2026 judgment of the Commercial Chamber reopens that debate, through an apparently procedural angle with significant practical consequences. Where the victim challenges, in its pleadings before the Court of Appeal, the strong authentication relied on by the bank, the court cannot state the opposite in order to dismiss the claim without altering the terms of the dispute and, in doing so, infringing Article 4 of the Code of Civil Procedure.

What were the facts before the Commercial Chamber?

A pharmacy company held an account with a major French bank. On 30 October 2021, an account domiciled in the United Kingdom was added to the list of beneficiaries for transfers that could be made from this account. According to the information gathered by the bank, this operation was carried out via the “trusted” mobile phone of the company’s manager, using his login and password.

Between 3 and 8 November 2021, four transfers were successively executed from the company’s account to this new beneficiary account. The company denies having initiated these transfers and sued the bank for payment of the amount corresponding to them.

The Versailles Court of Appeal, in a judgment of 21 May 2024, dismissed the company’s claim. Relying on Article 13 of Delegated Regulation (EU) 2018/389 and on the general terms of the contract, it held that the strong authentication required for the addition of the beneficiary had been carried out on the manager’s trusted device, which was supposedly not disputed. The subsequent transfers, made to a trusted beneficiary already registered, were thus exempt from additional strong authentication and constituted authorised transactions.

The company appealed on points of law, complaining that the judgment stated that strong authentication was not disputed, when it had been expressly disputed in its appeal pleadings.

What question was put to the Court?

The question put to the Commercial Chamber was as follows: may the Court of Appeal, in order to dismiss the company’s claim, hold that the strong authentication of the beneficiary’s addition is not disputed, when the company expressly argued the contrary in its pleadings?

Behind this procedural question lies a broader question of substance: what constitutes valid strong authentication for the addition of a transfer beneficiary? Is the mere fact that the operation was carried out from the trusted device and with the account holder’s credentials enough to establish that authentication, or is it an open area of debate in which the lower courts must, at the very least, examine the substance?

What exactly does the Commercial Chamber decide?

Citing Article 4 of the Code of Civil Procedure, the Commercial Chamber recalls that the subject matter of the dispute is determined by the parties’ respective claims. It then notes, on reading the pleadings filed before the Court of Appeal, that the company specifically challenged the application of strong authentication to validate the addition of the beneficiary of the disputed transfers. By nevertheless holding that this point was not disputed, in order to infer that the payments were authorised and to rule out the bank’s liability, the Court of Appeal altered the subject matter of the dispute and infringed the above-mentioned provision.

The judgment is quashed in its entirety. The case is referred back to the Versailles Court of Appeal, differently composed, which must this time rule on the challenge instead of asserting that it does not exist. The bank is ordered to pay the costs and a sum under Article 700 of the Code of Civil Procedure.

Why is Article 4 of the Code of Civil Procedure cited?

Article 4 of the Code of Civil Procedure provides that the subject matter of the dispute is determined by the parties’ respective claims, as set out in the originating process and in the defence pleadings. This rule, which enshrines the principle that the parties control the scope of the proceedings, is one of the pillars of civil procedure: it is for the parties to define the debate, and for the court to decide that debate as it is put before it.

Case law on the alteration of the subject matter of the dispute is extensive, and the Commercial Chamber does not break new ground, as a matter of principle, in penalising the Versailles Court of Appeal. What draws attention is the concrete application of this principle to fraudulent transfer disputes. The bank had every interest in presenting the strong authentication of the beneficiary’s addition as an established, undebated fact, in order to close the discussion from the outset. The Court of Appeal accepted this presentation. On this point, the Commercial Chamber restores the reality of the debate as the company had put it before the court.

How do trusted beneficiaries and strong authentication work?

To understand the scope of the judgment, one must return to the underlying technical mechanism, which shapes most disputes over fraudulent transfers since Directive (EU) 2015/2366 (PSD2) came into force.

What does Article 13 of Delegated Regulation (EU) 2018/389 say?

Delegated Regulation (EU) 2018/389 of 27 November 2017, which adopts the regulatory technical standards (RTS) supplementing PSD2, provides for several exemptions from the systematic application of strong authentication. Its Article 13 expressly allows the payment service provider not to apply strong authentication where the payer initiates a payment transaction to a payee included in a list of trusted beneficiaries previously created by the payer themselves.

The logic of this exemption is coherent: if the payer has declared in advance that a beneficiary may receive their payments without enhanced checks, it is legitimate not to impose strong authentication again on each transaction to that beneficiary. But this logic rests on an implicit and decisive condition: the initial registration of the beneficiary on the trusted list must itself have been covered by strong authentication compliant with the law. Otherwise, the exemption turns against the payer, since it dispenses with checking precisely what should be checked first.

Is a “trusted” mobile device enough to constitute strong authentication?

The 4 February 2026 judgment did not decide this question, since it quashes for infringement of Article 4 of the Code of Civil Procedure. But it is central, and the court to which the case is referred will have to confront it. The bank, in this case, argued that the beneficiary had been added “via the trusted mobile phone” of the manager, using his “login and password”. It inferred that strong authentication had been required and completed.

This presentation, which regularly appears in banks’ pleadings, is open to challenge. Strong authentication within the meaning of Delegated Regulation (EU) 2018/389 requires, as noted above, the combination of at least two independent elements, each belonging to a distinct category. In the usual mechanics of mobile banking applications, the “trusted” device is a possession element (something the account holder holds) and the password is a knowledge element (something the account holder knows). The apparent combination is, in theory, consistent with the RTS requirements.

But this compliance in principle can be called into question on several grounds in a fraud context. The “trusted” status of the device presupposes an initial personalisation procedure whose robustness may be disputed, in particular where the device has been compromised, shared or hijacked. The independence of the authentication elements presupposes that the compromise of one does not make it easier to compromise the other; yet, in several fraud schemes, the attacker who controls the device simultaneously controls the notifications, the text messages and, therefore, the elements supposed to constitute “possession”. Finally, European and national case law tends to require a genuine case-by-case analysis, as opposed to an automatic presumption drawn from the mere use of the account holder’s mobile device.

What is the practical impact of the decision for victims?

The 4 February 2026 judgment is not, strictly speaking, a ruling on the merits of the bank’s liability in cases of beneficiary-addition fraud. It is a procedural decision that restates a basic principle of civil procedure: the court rules on what is debated and cannot assert that a question has not been raised in order to avoid it. But precisely because it challenges a practice on the merits (the tendency to present the strong authentication of beneficiary additions as established), it is a useful practical lever for the defence of victims.

How should the challenge be framed before the lower courts?

The most immediate lesson of the judgment is that an effective challenge to strong authentication requires wording that is explicit, specific and documented in the pleadings. Three requirements follow.

The 4 February 2026 judgment illustrates this last requirement by implication: it is by referring to the pleadings filed before the Court of Appeal that the Commercial Chamber was able to find that the subject matter of the dispute had been altered. At this stage, the traceability of the challenge is the victim’s first tool.

What strategy should victims’ lawyers adopt?

Beyond the strictly procedural question, the judgment invites lawyers to build the defence of victims of beneficiary-addition fraud around three complementary lines of argument.

The first is challenging the strong authentication of the addition: was the registration of the disputed beneficiary on the trusted list actually validated by a procedure compliant with the requirements of Delegated Regulation (EU) 2018/389? The bank, which bears the burden of proof under Article L. 133-23 of the Monetary and Financial Code, must produce the technical evidence needed to judge this. A mere reference to a “trusted device” and a “login and password” is not enough: it is necessary to document the effective combination of at least two independent authentication elements, their independence in the specific technical context of the transaction, and the robustness of the prior personalisation of the device.

The second is challenging the application of the exemption in Article 13 of Delegated Regulation (EU) 2018/389: were the conditions for the exemption precisely met at the time of the disputed transfers? The bank must in particular show that the list of trusted beneficiaries had been constituted by the payer, in accordance with the general terms of the contract, and that the technical parameters of the transaction fell within the scope of the exemption.

The third is examining the technical standards imposed by Delegated Regulation (EU) 2018/389 as a whole: transaction monitoring, detection of pattern anomalies, protection of authentication elements, effective independence of the combined elements. A transfer to a foreign account opened a few days earlier, out of line with the habits of the business account concerned, is typically a pattern anomaly that the RTS obligations require the bank to detect and, where appropriate, block. This angle, still under-used in practice, deserves to be systematically explored.

What are the limits and nuances?

The scope of the judgment must nevertheless be assessed with measure. Three points deserve emphasis.

First nuance: the decision is an F-D decision, that is, not published in the Bulletin. Its formal standing is therefore that of a decision on its own facts, with limited case-law weight. It cannot be relied on with the same authority as an F-B or F-P+B+I decision. Nevertheless, it reflects the Commercial Chamber’s concrete attention to adversarial principles in bank fraud disputes, and its reasoning is useful beyond the case at hand.

Second nuance: the quashing is pronounced on procedural grounds, not on the merits. The court to which the case is referred may perfectly well, after examining the challenge raised by the company, reach the same conclusion as the first Court of Appeal and dismiss the victim’s claim, since it will this time have genuinely ruled on the question. The legal outcome on the merits therefore remains uncertain.

Third nuance: the judgment says nothing, as it stands, about the precise characterisation of the strong authentication required for the addition of a transfer beneficiary. It merely opens the debate, where the Court of Appeal had closed it prematurely. The questions of substance (the scope of the concept of “trusted device”, the requirement of independence of the authentication elements in the mobile context, the consequences to be drawn from a prior compromise of the device) remain to be decided, case by case. Beyond the specific lever of Article 4 of the Code of Civil Procedure, failure to comply with the technical standards imposed by Delegated Regulation (EU) 2018/389 remains a serious civil basis for the bank’s liability, still largely under-used. A criminal complaint and a report to the public prosecutor retain their value as evidence and for recovery, without being confused with a basis for civil compensation.

Conclusion: A Welcome Reminder of the Adversarial Principle

The 4 February 2026 judgment does not rewrite the substantive law on bank fraud by beneficiary addition. It restates, rigorously, a basic procedural principle: a court cannot assert that a point is undisputed when it is disputed. By applying it to the sensitive question of the strong authentication of a beneficiary’s addition, the Commercial Chamber prevents the banks’ practice (presenting this authentication as established and undisputed) from closing the door to an examination on the merits.

For victims of fraud involving transfers to a fraudulently added beneficiary, the message is twofold. First, the challenge must be explicit, specific and documented at every stage: first-instance pleadings, appeal pleadings, final pleadings. Second, the debate on the merits remains open: it is for victims’ lawyers to invoke the technical requirements of Delegated Regulation (EU) 2018/389, starting with the implicit condition of strong authentication when the beneficiary is registered on the trusted list, and to require the bank to produce the corresponding technical evidence under Article L. 133-23 of the Monetary and Financial Code.

At LE BOT Avocat, this type of decision directly informs the defence of businesses and individuals facing fraudulent transfers from business accounts. The firm’s pleadings now systematically include an explicit and specific challenge to the strong authentication of the beneficiary’s addition, together with a request for production of the corresponding technical evidence. The 4 February 2026 judgment provides useful support on this point.

FAQ: Frequently Asked Questions