Paris Court of Appeal (cour d’appel), Pôle 5, Chamber 6, 1 April 2026, No. RG 24/15478 (reversing Paris Court of First Instance (tribunal judiciaire), 9th chamber, 2nd section, 3 July 2024, No. RG 23/08046)
🔑 Key Takeaways
- A transfer of €5,500 was debited on 16 March 2021 at 10.48 pm from an individual’s account without his consent: the Paris Court of Appeal classified it as an unauthorised transaction.
- The bank must prove, in accordance with Article L. 133-23 of the Monetary and Financial Code (code monétaire et financier), that the transaction was authenticated, properly recorded and not affected by a technical deficiency: producing an incomplete extract of computer logs is not enough.
- The fact that the transaction was made from a phone different from the account holder’s, registered only minutes earlier, is a decisive indication of external fraud accepted by the Court.
- Where the bank fails to prove strong authentication, the customer does not have to show that he was not grossly negligent: reimbursement is automatically due (Article L. 133-18 of the Monetary and Financial Code).
- A bank’s contractual terms cannot derogate from the protective rules of the Monetary and Financial Code where the customer is an individual acting for non-professional purposes.
- Only the special regime of Articles L. 133-18 to L. 133-24 of the Monetary and Financial Code applies: the customer cannot additionally obtain damages for non-material loss on the basis of the general law of civil liability.
- BRED was ordered to reimburse €5,500 with interest at the statutory rate from the date of the summons (6 June 2023), and to pay €2,000 under Article 700 of the Code of Civil Procedure (code de procédure civile) together with the costs.
Contents ▼
- The facts: a €5,500 transfer made without the customer’s knowledge
- A night-time fraud and an immediate challenge
- First instance: the customer wrongly dismissed
- What is the legal framework protecting victims of fraudulent transfers?
- What is an unauthorised payment transaction?
- The principle of immediate reimbursement (Article L. 133-18 of the Monetary and Financial Code)
- The burden of proof: a rule that favours the customer (Article L. 133-23 of the Monetary and Financial Code)
- How did the Court of Appeal reason in ordering BRED to pay?
- A near-admission by the bank in its own pleadings
- A computer log extract insufficient to prove strong authentication
- The customer’s gross negligence: an argument rejected for lack of proof
- Can the bank’s contractual terms stand in the way of reimbursement?
- The unenforceability of general terms and conditions against individuals
- What are the limits of this court victory?
- No compensation for non-material loss: an exclusive regime
- Increased interest inapplicable to facts prior to 18 August 2022
- What should you do if you are the victim of a fraudulent transfer?
- Conclusion
- FAQ: Frequently Asked Questions
The facts: a €5,500 transfer made without the customer’s knowledge
A night-time fraud and an immediate challenge
It all begins on the evening of 16 March 2021. At 10.48 pm, a transfer of €5,500 is executed from the online banking area of an individual, a customer of BRED Banque Populaire, in favour of a third party whom he says he does not know. The transaction takes place in the middle of the night, at an unusual hour for this type of operation, and forms part of a particularly troubling sequence: the computer log extract produced by the bank shows that four separate transactions were carried out in less than a minute, of which this transfer was apparently the first, at 10.48 pm and 28 seconds.
On 18 March 2021, two days after the events, the customer reacts. He goes to the police station in his area of residence to file a complaint for fraudulent use of a bank account number. He formally denies having authorised the transfer and states that he does not know the beneficiary. At the same time, he asks his bank to reimburse the sums debited without his knowledge.
But BRED Banque Populaire refuses. Its position is firm: the transaction was supposedly carried out after strong authentication from the customer’s online area, protected by two personal identification codes. For the bank, if someone was able to log in, it was necessarily because the customer had disclosed his credentials, which would amount to gross negligence barring him from obtaining reimbursement.
Strong authentication is a process for verifying the payer’s identity based on the use of at least two elements belonging to different categories: something the user knows (a PIN, a password), something the user has (a mobile phone, a card), or something the user is (biometric data). In practice, for online transfers, it often takes the form of entering the account password and then validating a code sent by SMS to the customer’s registered phone.
First instance: the customer wrongly dismissed
Getting no satisfaction from his bank, the customer sued BRED Banque Populaire before the Paris Court of First Instance (tribunal judiciaire) in June 2023. By judgment of 3 July 2024, the court dismissed all his claims and, on top of that, ordered him to pay the bank €1,500 in respect of legal costs. For the victim, it was a double penalty.
The customer appealed against that decision on 24 August 2024. In his submissions, he criticised the court in particular for relying on matters that had not been put to adversarial debate, notably the claim that the BRED Secure service had not previously been activated on his phone and that his number was not registered there, which he moreover formally denies. He also argues that the judgment proceeds by assertion and extrapolation, without the bank having genuinely proved the strong authentication of the transaction.
What is the legal framework protecting victims of fraudulent transfers?
What is an unauthorised payment transaction?
The Monetary and Financial Code sets out a simple but fundamental definition in Article L. 133-6: a payment transaction is authorised only if the payer has given consent to its execution. In the absence of consent, the transaction is deemed unauthorised, whatever technique was used to carry it out.
A payment transaction is said to be unauthorised where the account holder has not given consent to its execution, within the meaning of Article L. 133-6 of the Monetary and Financial Code. This covers both transfers made entirely without the holder’s knowledge and those initiated by a third party who has fraudulently obtained his credentials. Consent cannot be presumed: it must be real and effective.
This concept is central because it determines the whole regime protecting the customer: if the transaction is unauthorised, the bank bears the financial risk, subject to exceptions strictly defined by law.
The principle of immediate reimbursement (Article L. 133-18 of the Monetary and Financial Code)
Article L. 133-18, paragraph 1, of the Monetary and Financial Code is one of the most protective provisions for consumers in banking matters. It requires the bank to reimburse the payer the amount of any unauthorised transaction immediately after becoming aware of the transaction, and at the latest by the end of the first business day following its notification. The bank can avoid this obligation only if it has good reason to suspect fraud by the user himself, and in that case it must inform the Banque de France in writing.
The reimbursement provided for by Article L. 133-18 of the Monetary and Financial Code is not optional for the bank: it is a legal obligation. The bank can escape it only by demonstrating either fraud by the customer or gross negligence (négligence grave) on his part. It is not for the customer to prove his innocence; it is for the bank to prove fault.
The burden of proof: a rule that favours the customer (Article L. 133-23 of the Monetary and Financial Code)
Article L. 133-23 of the Monetary and Financial Code is the other pillar of consumer protection against bank fraud. It states clearly that where a customer denies having authorised a transaction, it is for his payment service provider to prove that the transaction in question was authenticated, duly recorded and accounted for, and not affected by a technical or other deficiency.
The provision goes further still, expressly stating that the mere use of the payment instrument as recorded by the bank is not, in itself, sufficient to prove that the transaction was authorised by the payer or that he was not grossly negligent. This is a common-sense rule: the fact that a connection technically took place does not prove that the account holder is the one behind it.
⚖️ How the burden of proof is allocated in the case of a fraudulent transfer
- That the transaction was authenticated (in accordance with the rules on strong authentication)
- That it was duly recorded and accounted for
- That it was not affected by a technical deficiency
It may then inquire whether the customer committed fraud or gross negligence
Reimbursement is mandatory, with no need to look for fault on the customer’s part
Finally, Article L. 133-19, IV, of the same Code provides that the customer bears losses only if he has himself acted fraudulently, or has intentionally or through gross negligence failed to meet his security obligations. And Article L. 133-19, V, adds that, where the bank has not required strong authentication, the payer bears no financial consequences of the unauthorised transaction, unless he has acted fraudulently himself.
How did the Court of Appeal reason in ordering BRED to pay?
A near-admission by the bank in its own pleadings
One of the most striking aspects of this judgment is the way the Court used BRED’s own arguments against it. The bank had itself written in its submissions that “the fraudster was unable to access Mr [P]’s personal area”. By expressly using the word “fraudster”, the bank implicitly acknowledged that the transaction had not been initiated by the account holder himself. The Court of Appeal duly noted this near-admission: if it was indeed a fraudster who acted, then the customer himself did not authorise the transactions made from his personal area.
That point, combined with the undisputed fact that the transaction had been made from a phone other than the customer’s, registered on the account in the minutes preceding the transfer, enabled the Court to conclude unambiguously that the €5,500 transfer was an unauthorised transaction within the meaning of the statutory provisions.
A computer log extract insufficient to prove strong authentication
BRED had produced an extract of computer logs supposed to show that the transfer order had been placed in compliance with the strong authentication procedure. The Court of Appeal subjected this document to rigorous scrutiny, and it did not withstand it.
The extract shows that the disputed transfer order was placed on 16 March 2021 at 10.48 pm from the customer’s online area*. However, although the bank asserted that this order had been placed under the strong authentication procedure combining the payer’s identifier and password, the extract had several decisive gaps identified by the judges:
🔍 What BRED’s computer log extract did not show
The IMEI is a unique 15-digit identifier assigned to each mobile phone, making it possible to identify the phone with certainty on telecommunications networks. In the context of bank strong authentication, the IMEI number of the registered device can be used to verify that it was indeed the account holder’s usual device that was used to validate a transaction.
The Court therefore concluded that the bank had not proved that the disputed transfer was a transaction that was authenticated, duly recorded and accounted for, and unaffected by a technical or other deficiency. The consequence is direct and unavoidable: by application of Article L. 133-18 of the Monetary and Financial Code, BRED was bound to reimburse the €5,500.
And the Court adds a crucial point: this reimbursement is due without any need to inquire into fraud or negligence on the customer’s part. In other words, once the bank has failed to discharge its burden of proof on authentication, the question of the customer’s fault does not even arise. That is the preliminary step to be cleared, and BRED had failed it.
The customer’s gross negligence: an argument rejected for lack of proof
BRED had also tried to escape liability by invoking the customer’s gross negligence (négligence grave), arguing that he must have disclosed his confidential data to a third party, which would have allowed the fraudulent transfer to be executed. This argument, frequently used by banks in this type of dispute, did not convince the Court either.
Gross negligence, within the meaning of Articles L. 133-16, L. 133-17 and L. 133-19, IV, of the Monetary and Financial Code, refers to conduct by the account holder consisting in failing to take reasonable steps to preserve the security of his personalised security features (codes, passwords, etc.) or in failing to notify his bank without delay of the loss, theft or fraudulent use of his payment instrument. The mere disclosure of banking data to a third party, in particular as a result of phishing or manipulation, may constitute gross negligence, but the bank must still prove it.
The Court here recalls the logical hierarchy imposed by the legislation: it is for the bank to provide evidence to prove the fraud or gross negligence committed by the user (Article L. 133-23, paragraph 3, of the Monetary and Financial Code). Peremptorily asserting that the customer must have disclosed his codes is not proof. BRED had produced no concrete evidence showing that the customer had, for example, replied to a phishing message, disclosed his credentials during a fraudulent telephone call, or yielded to blackmail. A mere assertion not amounting to proof, the argument was dismissed.
Can the bank’s contractual terms stand in the way of reimbursement?
The unenforceability of general terms and conditions against individuals
BRED had also fallen back on its general contract terms, which stipulated that the computer records generated and kept by the bank constituted proof that the transactions had been carried out by the subscriber and were attributable to him. On that basis, it argued that proof of the customer’s consent was established by the records of its own servers alone.
The Court of Appeal dismissed this argument clearly and firmly, relying on Article L. 133-2 of the Monetary and Financial Code. That provision states that where the payment services user is an individual acting for non-professional purposes, that is, an ordinary consumer, the protective provisions of the Monetary and Financial Code cannot be circumvented by contract. Articles L. 133-23 and L. 133-18 in particular are mandatory as regards consumers (d’ordre public).
💡 What the bank cannot do
A bank cannot insert in its general terms and conditions a clause that would reverse the burden of proof to the detriment of an individual customer, or that would allow it to escape its obligation to reimburse in the event of an unauthorised transaction. These statutory protections are mandatory and cannot be set aside by contract as regards consumers acting for non-professional purposes.
In other words, a bank cannot unilaterally manufacture evidence enforceable against the customer by inserting in its general terms and conditions a clause under which its own computer records are conclusive. Such a clause, however attractive from the bank’s point of view, runs up against an impassable statutory ceiling where the counterparty is a consumer.
What are the limits of this court victory?
No compensation for non-material loss: an exclusive regime
Although the Court of Appeal ordered reimbursement of the €5,500 fraudulently debited, it rejected the customer’s claim for compensation for non-material loss (préjudice moral), valued at €4,000. This rejection may come as a surprise, but it rests on case law now well established by the French Supreme Court (Cour de cassation).
Where the liability of a payment service provider is engaged on account of an unauthorised or incorrectly executed transaction, the applicable regime is exclusively the one set out in Articles L. 133-18 to L. 133-24 of the Monetary and Financial Code, which transpose European Directive 2007/64/EC, to the exclusion of any general-law liability regime. In this respect the Court of Appeal cites several recent judgments of the Commercial Chamber of the French Supreme Court: 27 March 2024 (No. 22-21.200), 2 May 2024 (No. 22-18.074), 15 January 2025 (No. 23-13.579 and No. 23-15.437).
The message is clear: one cannot obtain damages for non-material loss on top, on the basis of the general law of civil liability. The special regime of the Monetary and Financial Code absorbs everything. The only exception would be where the parties had expressly provided for additional compensation in their contract, which was not the case here.
Increased interest inapplicable to facts prior to 18 August 2022
The customer had also sought the application of the increased interest provided for in Article L. 133-18, paragraph 3, of the Monetary and Financial Code, in the wording resulting from a recent reform. The Court also rejected this claim, for a purely chronological reason: the provisions on increased interest came into force only on 18 August 2022, after the disputed events of 16 March 2021. Penal law, or in this instance a law more favourable to the consumer, does not apply retroactively to transactions predating its entry into force.
The customer therefore obtains interest at the statutory rate, but only from the date of the summons of 6 June 2023, and not from the date of the fraudulent transfer. Something to bear in mind for anyone considering action against their bank: acting quickly means interest starts running earlier.
📊 The judgment in figures
What should you do if you are the victim of a fraudulent transfer?
This case clearly illustrates the steps to follow to maximise your chances of obtaining reimbursement. The favourable outcome owes a great deal to the customer’s promptness and the strength of his file. Here are the reflexes to adopt without delay.
🗺️ Your roadmap in the event of a fraudulent transfer
The case discussed also shows the importance of perseverance: having lost at first instance, the customer was right to appeal. The Court of Appeal corrected the court’s insufficient analysis by rigorously applying the protective provisions. Not being discouraged by an initial rejection is sometimes the condition of success.
Conclusion
The judgment of the Paris Court of Appeal of 1 April 2026 forms part of a protective line of case law that steadily strengthens the rights of victims of bank fraud. Its significance is twofold. On the one hand, it clearly restates that proof of strong authentication is not a mere formality: it must be complete, precise and genuine. An incomplete log extract, which mentions neither the phone used, nor the IP address, nor any procedure for enrolling a new device, does not meet the statutory requirements. On the other hand, it confirms that contractual clauses by which banks try to place the burden of proof on the customer are unenforceable against consumers.
For victims of fraudulent transfers, the message is encouraging: the law is on their side, provided they dispute the transaction quickly, build a solid file and do not hesitate to go to court if the bank wrongfully maintains its refusal to reimburse. For banks, the judgment is a clear warning: merely pointing to a successful login to a customer’s online area is no longer enough to escape all liability. The standard of proof is high, and it rests entirely on the banking institution.
If you find yourself in a similar situation (an unauthorised transfer, a refusal of reimbursement by your bank, or an unsatisfactory reply), the lebot-avocat.com team, who specialise in banking law, are at your disposal to review your case and support you in the steps best suited to your situation.
