French Supreme Court (Cour de cassation), Commercial, Financial and Economic Chamber, 1 July 2026, Appeal No. 25-16.014
🔑 Key Takeaways
- A transfer executed in accordance with the IBAN provided by the customer is “deemed duly executed”: the bank is not liable if that IBAN in fact designates a fraudster’s account (Article L. 133-21 of the Monetary and Financial Code).
- The fact that the beneficiary’s name entered on the transfer order does not match the actual account holder does not allow the transaction to be recharacterised as an “unauthorised transaction” within the meaning of Article L. 133-18.
- The French Supreme Court aligns itself with the CJEU’s Tecnoservice judgment (21 March 2019, C-245/18): only the unique identifier counts, not the name.
- The Toulouse Court of Appeal, which had ordered Crédit agricole to reimburse €10,500, is overturned; the case is referred to the Bordeaux Court of Appeal.
- This solution is harsh and open to challenge in light of the spirit of PSD2, but it is now settled: the victim of an IBAN substitution must look for other levers (the way the bank drew up the order, an apparent anomaly, the receiving bank, the payee verification service).
- Since 9 October 2025, banks must offer a service checking that the beneficiary’s name matches the IBAN: the question will arise differently for later transfers.
Table of Contents ▼
- What Happened in This Fake Seller Case?
- Why Had the Toulouse Court of Appeal Sided with the Victim?
- What Did the French Supreme Court Decide on 1 July 2026?
- What Exactly Does Article L. 133-21 of the Monetary and Financial Code Say?
- Why Is the Transaction Not “Unauthorised” When the Victim Did Not Want to Pay the Fraudster?
- Is This Solution Legally Satisfactory?
- What Remedies Remain Open to the Victim of an IBAN Substitution?
- What Has the Payee Verification Service Changed Since 9 October 2025?
- Conclusion: What to Do If You Have Sent Money to a Fake IBAN?
- FAQ: IBAN Fraud and Bank Liability
What Happened in This Fake Seller Case?
The facts are disarmingly commonplace, and that is precisely what makes the judgment important: thousands of individuals find themselves in the same situation every year.
On 16 December 2019, a Crédit agricole customer wished to buy a vehicle offered on a merchant website. The supposed sellers gave her an IBAN. She then sent her branch, by e-mail, a transfer order for €10,500 stating that IBAN as the beneficiary account. The bank executed the transfer. The destination account was opened with an online bank (Ma French Bank).
The vehicle was never delivered. The customer realised she had been the victim of a scam. On examining the payment order issued by her bank on her instructions, she noticed a troubling detail: the name of the sellers appearing on that order did not match that of the holder of the account designated by the IBAN. In other words, she had asked to pay “Mr or Mrs X”, but the money had gone to the account of a third party whose name had nothing to do with it.
She summoned her bank seeking reimbursement of the sum debited and damages. She also joined the receiving bank, but the claim against the latter was dismissed and that point is no longer in dispute before the French Supreme Court.
IBAN substitution fraud (or fake bank details fraud) consists in a fraudster sending the victim bank account details designating an account that he controls, while posing as a legitimate seller, tradesman, landlord, notary or supplier. The victim herself orders the transfer, in full confidence, to that account. The name she enters as beneficiary does not match the actual account holder, but the IBAN is technically valid.
Why Had the Toulouse Court of Appeal Sided with the Victim?
By a judgment of 1 April 2025, the Toulouse Court of Appeal ordered Crédit agricole to pay its customer the sum of €10,500 “in reimbursement of the unauthorised payment transaction”.
The reasoning of the Toulouse judges is intellectually appealing. They start from the observation that the transfer order issued by the bank stated, in addition to the IBAN, the identity of the beneficiaries as the customer had given it. Yet the statement of account produced by the receiving bank showed that the account had been opened in the name of an entirely different person. The Court of Appeal deduced that the mention of the beneficiary’s name on the order showed that the customer had not consented to the funds being paid to the actual account holder.
Then comes the decisive step: since consent to a payment transaction presupposes agreement on the amount and on the beneficiary, and the customer had not consented to that beneficiary, the payment order had to be regarded as unauthorised. And Article L. 133-18 of the Monetary and Financial Code requires the bank to reimburse any unauthorised transaction without delay.
This reading had an obvious merit: it took seriously the fact that the payer’s consent relates to a person, not merely to a string of digits. It joined a trend among some lower courts, more protective of victims, which we noted for example in connection with the Pau Court of Appeal and the bank details anomaly.
What Did the French Supreme Court Decide on 1 July 2026?
The Commercial Chamber quashes the Toulouse judgment, on the basis of Articles L. 133-18 and L. 133-21 of the Monetary and Financial Code.
It begins by dismissing a procedural objection: the customer argued that the bank’s ground of appeal was new before the French Supreme Court. The Court replies that this ground “does not refer to any consideration of fact that would not result from the findings of the lower courts” and that it is “a pure point of law”; it is therefore admissible. This point is worth noting: a bank that did not rely on Article L. 133-21 on appeal can still usefully do so before the French Supreme Court.
On the merits, the Court recalls the content of the two provisions. According to the first (L. 133-18), in the case of an unauthorised payment transaction, the provider reimburses the payer the amount of the transaction without delay. According to the second (L. 133-21), which transposes Article 88 of Directive (EU) 2015/2366 entitled “incorrect unique identifiers”, “a payment order executed in accordance with the unique identifier provided by the payment service user shall be deemed duly executed with regard to the payee specified by the unique identifier. If the unique identifier provided by the payment service user is incorrect, the payment service provider shall not be liable for the non-execution or defective execution of the payment transaction”.
It then relies explicitly on European case law: in the Tecnoservice judgment of 21 March 2019 (C-245/18), the Court of Justice of the European Union held that where a payment order is executed in accordance with the unique identifier provided by the user, “which does not correspond to the name of the payee indicated by that same user”, the limitation of the provider’s liability applies.
The conclusion then falls like a guillotine. By holding the transaction unauthorised on the ground that the customer had not consented to the actual beneficiary, “whereas it found that the payment transaction had been executed in accordance with the unique identifier provided by Mrs [A]”, the Court of Appeal “infringed the aforementioned provisions, by wrongly applying the first and refusing to apply the second”.
The judgment is quashed, except insofar as it dismisses the claim against the receiving bank, and the case is referred to the Bordeaux Court of Appeal. The victim is ordered to pay the costs.
What Exactly Does Article L. 133-21 of the Monetary and Financial Code Say?
To understand the scope of the judgment, one must return to the logic of this provision, which is one of the most bank-friendly in the whole of payment services law.
The unique identifier is the combination of letters, numbers or symbols specified by the payment service provider to the user to identify unambiguously a payment account. In practice, in the SEPA area, this is the IBAN (International Bank Account Number). It is this identifier, and it alone, that determines where the funds are routed: the beneficiary’s name entered by the payer is not processed by the payment systems.
The mechanism is as follows. The payment service provider undertakes to route the funds to the account designated by the unique identifier. If it does so, the transaction is “deemed duly executed with regard to the payee specified by the unique identifier”. The European legislature opted for a purely technical criterion: the bank does not have to check that the name entered by the customer matches the account holder. If the identifier provided is incorrect, that is, if it does not designate the account the payer believed he was targeting, the provider is exonerated.
This provision was originally designed for the case of a simple input error: a customer who gets a digit wrong and sends the funds to a stranger’s account cannot blame his bank for executing the order as given. Article L. 133-21 moreover provides that the provider must then “make reasonable efforts” to recover the funds, which corresponds to the recall procedure, with no obligation to achieve a result.
The problem is that this provision has been extended, by the CJEU and then by the French Supreme Court, to a very different case: one where the IBAN is not wrong through inadvertence, but was supplied by a fraudster. In that case, the identifier is not “incorrect” in the sense of a typing error; it is perfectly accurate with regard to the fraudster’s account. It is the beneficiary name announced that is false. And yet the solution is the same: the bank is discharged.
Why Is the Transaction Not “Unauthorised” When the Victim Did Not Want to Pay the Fraudster?
This is the central question of the judgment, and the one on which the French Supreme Court closes the door that the Toulouse Court of Appeal had left ajar.
Under Article L. 133-6 of the Monetary and Financial Code, a payment transaction is authorised if the payer has given his consent to its execution, in the form agreed with his provider. Without consent, the transaction is “unauthorised” and Article L. 133-18 requires the provider to reimburse it without delay, except in the case of fraud by the payer. This is the protective regime that applies in cases of hacking, card theft or identity credential misuse.
Payment services law distinguishes two families of incidents. On the one hand, unauthorised transactions: the payer did not consent to the transaction, or consented under the effect of a manipulation that vitiates his consent to the transaction itself (a fake adviser who gets a transfer validated, stolen codes, etc.). On the other hand, incorrectly executed transactions: the payer did order the transaction, but it did not arrive where it was supposed to, or not under the conditions provided for.
In the French Supreme Court’s analysis, IBAN substitution falls into the second category, or even into a still less favourable sub-category: the transaction was executed in accordance with the unique identifier provided, so it is “deemed duly executed”. There is neither an unauthorised transaction (the customer herself ordered the transfer, stating the amount and the IBAN), nor defective execution (the funds arrived in the account designated by the IBAN).
The Toulouse Court of Appeal had tried to escape this scheme by reasoning on consent to the beneficiary. The French Supreme Court answers, in substance, that the beneficiary, within the meaning of payment law, is the one “specified by the unique identifier”, and not the one whose name was written out in full. Since the customer provided the IBAN and the bank followed it, consent relates to that IBAN. The name is merely an ancillary mention, not processed by the systems.
This reading is consistent with what the Commercial Chamber had already held on 17 June 2026 on another side of the problem: the victim of an IBAN substitution is not released from her debt to her true creditor, because the fraudster is not an “apparent creditor” within the meaning of Article 1342-3 of the Civil Code (code civil). We commented on it here: paying a fake bank account is not a valid discharge. Taken together, these two judgments place the victim in an extremely unfavourable position: she must pay twice, and her bank owes her nothing.
Is This Solution Legally Satisfactory?
The firm defends victims of banking fraud. It would be easy to be content with noting the severity of the French Supreme Court. But the criticism must be constructed, because the judgment has genuine weaknesses.
Was the Tecnoservice Judgment Really Transposable?
The French Supreme Court shelters behind the CJEU. Yet the Tecnoservice judgment was delivered in a very particular factual context: a company had received a transfer to an account whose IBAN had been provided by the payer, and it was the actual beneficiary (not the payer) who invoked the liability of the receiving bank. The question put to the CJEU concerned the scope of the limitation of liability, both on the side of the payer’s provider and on that of the payee’s. The CJEU answered that the limitation applies to both. It never said that the fraud of a third party, who interposes himself to have the name and IBAN altered, had to be treated as a mere inaccuracy of the identifier. There is a slippage here: from input error to organised scam, without the reasoning being taken up afresh.
Does the Solution Respect PSD2’s Protective Objective?
Directive (EU) 2015/2366 has the stated objective of ensuring a high level of protection for payment service users. Reading Article 88 as an absolute exoneration, whatever the cause of the inaccuracy, amounts to placing on the consumer the whole risk of a fraud that the payment system, as designed in 2019, did not allow him to detect. The consumer cannot check for himself to whom an IBAN belongs; his bank, for its part, has cross-checking means, and above all the receiving bank knows the identity of its customer. The European legislature moreover acknowledged this by imposing, through Regulation 2024/886, the payee verification service: it is an admission that the earlier situation was not satisfactory.
Is Consent to the Beneficiary Really Worthless?
Article L. 133-6 provides that the transaction is authorised if the payer has consented “to its execution”. The case law requires consent as to the amount and the beneficiary. The French Supreme Court recalled this again recently for card payments (Cass. com., 10 December 2025, No. 24-20.778). Here, however, the payer consented to pay a specific seller. Reducing the “beneficiary” to the IBAN makes the human dimension of consent disappear, even though the transfer order issued by the bank bore the name of the intended beneficiary. The Toulouse Court of Appeal was not wrong to consider that this document proved a discrepancy between what the customer wanted and what the bank did.
How Does This Judgment Fit with the Judgment of 4 March 2026?
In a judgment published in the Bulletin on 4 March 2026, the Commercial Chamber held that the bank’s liability under ordinary law may be engaged where it “does not merely execute the payment order but drafts it itself” before carrying out the transaction with the customer’s approval (Cass. com., 4 March 2026, No. 25-11.959). In the 1 July 2026 case, the customer had sent her order “by e-mail” to her branch, and it was the bank that “issued” the payment order “on her instructions”. Factually, then, the case was very close to that of the 4 March 2026 judgment. But this point was not raised from that angle before the Court of Appeal, which preferred the route of the unauthorised transaction, and the French Supreme Court had no duty to look into it of its own motion. This is perhaps the most important strategic lesson of this judgment: the ground chosen determines the outcome.
What Remedies Remain Open to the Victim of an IBAN Substitution?
The judgment closes the route of the unauthorised transaction. It does not extinguish every action. Several levers remain conceivable, provided they are raised from the first instance and documented precisely.
🧭 Diagram: Possible Grounds After the Judgment of 1 July 2026
❌ Unauthorised transaction (L. 133-18) → ruled out if the IBAN provided was followed
↓
✅ Bank drafting the order itself (Cass. com., 4 March 2026, No. 25-11.959) → liability under ordinary law possible
↓
✅ Apparent anomaly on the order itself (IBAN whose country code or BIC does not match the beneficiary announced) → duty of vigilance, but a very strict standard
↓
✅ Receiving bank: account opening, KYC, abnormal operation → tort liability (Art. 1240 Civil Code)
↓
✅ Transfers after 9 October 2025: absence or failure of the payee verification service (Regulation 2024/886)
↓
✅ Immediate recall + complaint + request for disclosure of the account holder’s identity
Did the Bank Draft the Order in the Customer’s Place?
This is today the strongest lever. If the customer sent her instructions by e-mail, by telephone or at the counter, and it was an adviser who entered the transfer in the system, the bank did not merely execute an order: it drafted it. It then leaves the exclusive regime of Articles L. 133-18 to L. 133-24 and falls back under ordinary contractual liability law. All exchanges with the branch must therefore be kept.
Did the Order Show an Apparent Anomaly?
The banker’s duty of vigilance exists only in the presence of apparent anomalies, readily detectable by a normally diligent professional. The French Supreme Court applies this standard with great rigour, as its judgments of 4 February 2026 and 25 March 2026 show. But an IBAN whose BIC designates a foreign online bank when the beneficiary announced is a French car dealer, for example, may constitute an anomaly visible on the order itself.
Did the Receiving Bank Properly Identify Its Customer?
In the case commented on, the claim against the receiving bank was dismissed, but that does not mean this route is closed in general. A bank that opens an account for a fraudster, lets that account operate abnormally (funds received and then immediately withdrawn or transferred) or omits basic identity checks may incur tort liability towards the victim. Beware, however: anti-money-laundering obligations cannot serve as a basis, the French Supreme Court having held that their sole purpose is the fight against money laundering and terrorist financing. The useful ground is that of the obligations arising from the RTS technical regulation supplementing PSD2 (transaction monitoring, detection of unusual transactions) and ordinary law.
How to Obtain the Account Holder’s Identity?
To take action against the fraudster or the receiving bank, one must know who received the funds. The victim can ask the court for disclosure of the account holder’s identity, as we explained in connection with a decision of the Mulhouse Court of First Instance (TJ Mulhouse, 23 February 2026, No. 24/00323).
How to React in the First Few Hours?
As soon as the fraud is discovered, you must ask your bank to trigger a recall, challenge the transaction in writing and file a complaint. The words used matter: you must not give the impression that you “authorised” a transaction that you are disputing, nor acknowledge negligence. We have detailed these precautions in our guide Bank Fraud: What to Say and Not to Say to Your Bank and in Your Complaint.
What Has the Payee Verification Service Changed Since 9 October 2025?
The case commented on concerns a transfer of December 2019. For transfers ordered from 9 October 2025, the legal framework has changed profoundly.
A service required by Regulation (EU) 2024/886 of 13 March 2024, which inserted an Article 5 quater into Regulation 260/2012. Before executing a transfer in euros, the payer’s provider must verify, free of charge, that the beneficiary’s name entered by the customer matches the holder of the account designated by the IBAN, and warn him in the event of a discrepancy. The service applies to instant transfers as well as ordinary transfers.
This obligation reverses the logic of Article L. 133-21. The Regulation expressly provides that a provider that has not properly carried out this verification, and whose customer suffers loss as a result, must compensate him. In other words, the discrepancy between name and IBAN, which the French Supreme Court today holds to be without effect for older transfers, becomes precisely what the bank must detect. We presented this mechanism in our article on the obligation to verify the IBAN, and PSD3 and the Payment Services Regulation will further strengthen this approach.
Two practical consequences follow. For transfers after 9 October 2025, the victim of an IBAN substitution must check whether the verification service was offered, whether it worked and whether a discrepancy warning was displayed. If the bank did not put the service in place or if it failed, the ground of liability is quite different from that of the judgment commented on. If, on the other hand, the customer went ahead despite a clear discrepancy warning, her situation will be difficult.
In addition, Law No. 2025-1058 of 6 November 2025 aimed at strengthening the fight against bank fraud created a national file of accounts flagged for fraud risk, operational since 7 May 2026. The aim is that an IBAN used by a fraudster can no longer claim several successive victims. Here again, the listing of an account in this file before the disputed transfer may be a decisive factor.
Conclusion: What to Do If You Have Sent Money to a Fake IBAN?
The judgment of 1 July 2026 is not published in the Bulletin, but it is perfectly clear and forms part of a settled line of case law: for a transfer executed in accordance with the IBAN provided, the payer’s bank is not liable, and the argument of the “beneficiary to whom I had not consented” is not enough to turn the transaction into an unauthorised one. This solution is, in our view, too mechanical. It transposes to organised scams a provision designed for input errors, and it empties consent to the beneficiary of its substance.
But it does not mean the victim is without recourse. The choice of ground is decisive: drafting of the order by the bank, apparent anomaly on the order itself, liability of the receiving bank and, for recent transfers, the payee verification service. Each of these routes requires a precise analysis of the exchanges with the bank, the transfer order, the IBAN and the chronology of events.
If you have been the victim of fake bank details fraud, do not settle for your bank’s standard reply. Have your file analysed before writing anything that could be used against you, and act quickly: the recall has a chance of succeeding only in the first few hours.
