Fraudulently Enrolled Trusted Device: Caisse d’Épargne Ordered to Refund €44,990 (Paris Court of Appeal, 28 October 2026, No. 25/17260)

CA Paris, pole 5, chamber 6, 28 October 2026, case no. RG 25/17260

What happened in this fraudulent transfer case?

How did the fraud unfold?

An account holder at Caisse d’Épargne et de Prévoyance Île-de-France used the “Direct Ecureuil” remote banking service and had downloaded the mobile application incorporating the Sécur’Pass strong authentication mechanism.

On 1 December 2022, a new “trusted device” was registered on his online banking space. A text message was sent the same day at 5:51 pm to the customer’s number, announcing that his Sécur’Pass would be active in 71 hours on a mobile phone. Then everything followed in quick succession, at night:

In total, €44,990 left the account in a little over 48 hours, to an account opened with another French bank in a third party’s name. By letter of 28 December 2022, the bank refused any refund, on the ground that the three transfers had been validated using the Sécur’Pass mechanism. After a formal notice (mise en demeure) sent by his counsel on 31 March 2023 went unanswered, the customer summoned the bank on 12 May 2023 before the Paris Judicial Court (tribunal judiciaire).

What had the first-instance judges decided?

By judgment of 8 July 2025, the Paris Judicial Court ordered the bank to pay the customer €44,990, with interest at the statutory rate from 3 April 2023, plus €2,500 under Article 700 of the Code of Civil Procedure, while rejecting the claim for damages for non-pecuniary loss.

It was the bank that appealed, asking the court to dismiss all of the customer’s claims. The customer sought confirmation of the judgment and, in addition, €25,000 for his non-pecuniary loss. The judgment of 28 October 2026 upholds the ruling in all respects and orders the bank to pay the costs of the appeal as well as a further €3,000 under Article 700.

What must the bank prove when a transfer is disputed?

The court recalls the statutory foundation, which stems from the transposition of the Payment Services Directive (PSD2, DSP2): a payment transaction is authorised only if the payer has given consent, in the form agreed with their bank (Articles L. 133-6 and L. 133-7 of the Monetary and Financial Code). Without such consent, the transaction is deemed unauthorised.

And where the user denies having authorised a transaction, Article L. 133-23 of the same Code places the burden of proof on the bank: it must prove that the transaction was authenticated, duly recorded and accounted for, and that it was not affected by a technical or other deficiency. The same provision specifies that the use of the payment instrument as recorded by the bank “is not necessarily sufficient in itself” to prove that the transaction was authorised by the payer or that the payer was grossly negligent. On this now well-established principle, see again our analysis of a Paris decision holding that the burden of proving an unauthorised transfer rests entirely on the bank.

What is strong customer authentication?

Article L. 133-44 of the Code requires the bank to apply this strong authentication when the payer accesses their online account, initiates an electronic payment transaction or carries out a remote transaction involving a risk of fraud. The general terms and conditions of the Direct Ecureuil service faithfully reproduced this three-factor architecture, which the court takes care to point out: the bank was therefore bound, both contractually and by law, to this standard for transfers and for adding beneficiaries.

In this case, the bank described a seemingly robust Sécur’Pass installation process: user ID and password, random digits from the bank card, a 6-digit code received by text message, then the choice of a 4-digit confidential code. The telematic records showed that the customer had activated this mechanism on his Android phone, which he did not dispute. But what followed makes all the difference.

Why did the bank’s evidence fail?

Does a sent text message prove a received text message?

No, and this is the central lesson of the judgment. The bank produced the history of text messages sent to the customer’s number: announcement of the Sécur’Pass activation on 1 December, notification of the addition of a beneficiary on 4 December. But the court notes that “no element of these extractions makes it possible to attest that these text messages were received by the phone” of the customer, receipt being the “first possession element required for the implementation of strong authentication”.

The nuance is decisive: sending a text message to a number proves transmission, not receipt by the legitimate device. Between the two, every scenario of line or device hijacking may intervene, of which SIM swapping is the best-known example. This is exactly the reasoning that led the Amiens Court of Appeal to order a bank to pay in a SIM swapping case where the bank had to refund the fraudulent transfers.

What did the “information device” in the extractions reveal?

Worse for the bank, its own IT extractions contradicted it. The court observes that, at the time of the disputed transactions, the “information device” field in the logs carried an identification number corresponding not to the customer’s device, but to the device fraudulently enrolled on 1 December 2022.

In other words, the documents produced to demonstrate the regularity of the transactions actually established that the validations came from a third-party device. The possession element, far from being merely unproven, was positively attributed to a device foreign to the customer. This is a constant in this type of litigation: the bank’s technical logs, read carefully, often turn against it, as in the case where the use of the codes and the token did not prove the customer’s consent.

The court’s conclusion is unequivocal: while the bank establishes that the transactions were carried out through its secure remote banking service, it does not follow that this use is sufficient to prove that the transactions were authorised. Having failed to prove that the three transfers were authenticated, duly recorded and accounted for without technical deficiency, the bank is bound to refund.

Why could the bank not invoke gross negligence?

The bank argued that the customer had been grossly negligent in allowing the fraudster to substitute his trusted device for the customer’s, by giving him his code, and pointed out that case law finds gross negligence where a user discloses their secret codes to the person they are speaking with.

The argument did not succeed, for a reason of method that the judgment expresses clearly: failing to prove that the transactions were properly authenticated, “the bank is not entitled to invoke gross negligence”. The order of proof under Article L. 133-23 is sequential: the bank must first clear the hurdle of technical proof (authentication, recording, accounting, absence of deficiency) before it can debate any fault on the customer’s part. Failing at the first stage closes the second.

This hierarchy protects victims against a shortcut that banks readily take: inferring gross negligence from the mere fact that “the codes were used”. Yet to assume that the customer disclosed his codes is precisely to assume what must be proved. The Paris Court of Appeal here follows the line of decisions rendered on the same mechanism, such as the one in which the bank had to refund despite the Sécur’Pass validation, and the case law of the Court of Cassation on the burden of this double proof.

Why was the non-pecuniary loss claim rejected?

In addition to the refund, the customer claimed €25,000 in damages for non-pecuniary loss, arguing that the bank’s conduct had deprived him of a substantial sum, forced him to go to court and exposed him to a great deal of stress.

The court upholds the rejection of this claim: the customer did not show any harm distinct from the financial loss that was refunded and from the irrecoverable costs (frais irrépétibles) compensated under Article 700. The outcome is a classic one that victims should know about: the stress and the steps involved in the refusal to refund are not, on their own, enough to constitute compensable non-pecuniary loss. To obtain additional compensation, a genuinely independent harm must be documented (cascading financial consequences, certified damage to health, a situation of deadlock that caused its own damage), the mere need to take legal action being offset by the irrecoverable costs.

What is the practical significance of this judgment for victims?

Three concrete lessons emerge from this decision:

First, the requirement of proof that the text messages were received by the customer’s legitimate device, and not merely that they were sent, offers a powerful angle of attack in all cases of fraudulent enrolment, SIM swapping or line theft: a bank that produces only transmission histories does not establish the possession element. In the same vein, the Douai Court of Appeal ordered a bank to pay in a case of SIM swapping for lack of proof of strong authentication.

Second, the “information device” field in the technical logs is an evidentiary goldmine: when it points to a device different from the customer’s, the bank’s demonstration collapses of its own accord. Victims and their counsel should systematically demand production of these complete extractions and examine them line by line.

Finally, on the ground of technical obligations, the regulatory technical standards (RTS) supplementing PSD2 impose on banks precise standards for strong authentication and transaction monitoring: a lever that is still under-used, which we presented in our analysis of the argument based on the RTS and PSD2 to obtain a refund. One may moreover be surprised that such a characteristic sequence (enrolment of a new device, addition of a beneficiary at 11:18 pm, first transfer three minutes later, raising of limits at 11:59 pm, a burst of night-time transfers) triggered no reaction from the bank’s system; the judgment did not have to decide this point, but it will usefully feed into cases where the question of anomaly detection is raised.

How to effectively dispute a fraudulent transfer?

The course of action illustrated by this case is the right one: report the transactions to the bank without delay and in writing as soon as they are discovered (here, on the very day of the last transfer), request the return of the funds, then send a detailed formal notice that will cause interest to run. The report must be made at the latest within thirteen months of the debit date (Article L. 133-24 of the Monetary and Financial Code).

Filing a criminal complaint is not a condition of a refund: the regime of Articles L. 133-18 et seq. of the Monetary and Financial Code applies independently of any criminal proceedings, and the bank cannot require a complaint in order to examine the dispute. If the victim chooses to file a complaint, as the customer did in this case, they should stick to the bare facts (dates, amounts, disputed transactions), without hypotheses about the method used or comments on their own conduct, which the bank could later exploit. We detail these precautions in our article Bank fraud: what to say and not to say to your bank and in your complaint.

What to take away from the judgment of 28 October 2026?

This judgment consolidates an analytical framework that is very protective of payment service users: a bank that records the use of its secure service still proves nothing; it must demonstrate, with extractions to support it, that each factor of strong authentication was brought together on the customer’s legitimate device, and that its systems suffered no deficiency. Sending text messages is not the same as receipt, the “information device” must match the customer’s device, and failure of this technical proof prevents the bank from falling back on gross negligence.

For victims of fraudulent enrolments and bursts of night-time transfers, who are often made to feel guilty by their bank, the message is clear: the burden of proof lies with the institution, and its own technical logs are frequently the best piece of evidence in the victim’s file.

The firm LE BOT Avocat, a banking law lawyer in Paris, assists individuals and businesses who are victims of fraudulent transfers in their dealings with banks, from the written dispute to court proceedings.

FAQ: Frequently asked questions