Limited Banking Liability in the Face of CEO Fraud: Customer’s Negligence Penalised (CA Versailles, Com. Ch. 3-2, 3 February 2026, No. 25/00812)

Versailles Court of Appeal (Cour d’appel de Versailles), Commercial Chamber 3-2, 3 February 2026, No. 25/00812

What are the facts of this CEO fraud case?

CEO fraud is today one of the most formidable scams facing French companies. The fraudulent scheme rests on sophisticated identity theft: a fraudster poses as the head of a company or a trusted representative and instructs an employee in the accounting or finance department to make urgent and confidential transfers.

In the case brought before the Versailles Court of Appeal, SAS Groupe PSV, a company specialising in the manufacture of machines for butchers and delicatessens, had a long-standing banking relationship with Banque Populaire Val de France. This relationship, thirty years old, was characterised by regular exchanges on the company’s financial situation.

Between 16 and 22 February 2022, Ms I., administrative and financial manager of PSV, was the target of a particularly elaborate fraudulent operation. The fraudsters used two complementary channels of communication:

• Emails apparently from Mr P., the company’s president, but sent from a fraudulent email address
• Telephone conversations with a person claiming to be a lawyer from the firm Deloitte, whose identity had been stolen

The fraudulent messages referred to an alleged confidential acquisition of an Italian company, even invoking a “procedure imposed by the AMF” (Autorité des marchés financiers, the French financial markets authority), although PSV was not listed on any stock exchange.

Convinced of the authenticity of these communications, Ms I. placed six transfer orders between 16 and 22 February 2022, for a cumulative amount of €352,452, to a bank account opened in Italy in the name of a company called “Eurogrid Cycles”.

One technical point deserves emphasis: Ms I. had the strong authentication means provided by the bank under an “EBICS protocol connection pack” contract taken out on 10 December 2015. This system, intended to secure SEPA transfers and international payments, included access codes and a physical encryption key.

The transfers were therefore technically “authorised” within the meaning of the Monetary and Financial Code, since they were ordered by a person holding valid authentication means. This technical feature would have a major impact on the legal regime applicable to the dispute.

After discovering the fraud, PSV formally demanded that the bank reimburse it in full. Faced with the bank’s refusal, it brought the matter before the Versailles Commercial Court (tribunal de commerce) on 11 December 2023. By judgment of 4 December 2024, that court dismissed all of its claims and ordered it to pay the costs and to pay the bank €1,500 under Article 700 of the Code of Civil Procedure (code de procédure civile).

Why did the absence of strong authentication not suffice to engage the bank’s liability?

PSV had initially based a substantial part of its argument on an alleged breach by the bank of its “duty of strong authentication”. This ground, which may have seemed attractive at first sight, proved legally ineffective. Understanding why requires a clear distinction between two radically different regimes of banking liability.

The Monetary and Financial Code (code monétaire et financier) provides a special regime of banking liability for unauthorised payment transactions. Under Article L. 133-18 of that Code, where a customer reports an unauthorised payment transaction, the payment service provider must reimburse the customer immediately, unless it shows fraud or gross negligence (négligence grave) on the customer’s part.

This protective regime rests on a rebuttable presumption: any transaction carried out without the payer’s actual consent must be reimbursed. The burden of proving that the transaction was authorised lies with the bank.

Yet in the case decided by the Versailles Court of Appeal, PSV itself expressly acknowledged that the disputed transactions were authorised transactions. This admission, recorded in its own pleadings, was fatal to its argument based on Article L. 133-18 of the Monetary and Financial Code.

The Court of Appeal recalls that the liability of payment service providers in respect of an authorised payment transaction can be engaged only on the basis of general contractual liability, to the exclusion of the special regime of the Monetary and Financial Code. This line of case law, now well established, has been reaffirmed by several recent decisions.

Why were the transfers “authorised” despite the fraud? Because Ms I., the administrative and financial manager, did in fact hold:

• The sole signing authority on the bank account concerned
• The personal access codes to the online banking system
• The physical EBICS encryption key used to secure transfers
• The formal authorisation to issue payment orders on behalf of the company

The transfers were therefore placed by an authorised person, with valid authentication means, in accordance with the procedures contractually agreed with the bank. From a strictly technical and procedural standpoint, these transactions had all the attributes of regular orders.

The Court of Appeal draws a logical consequence: the ground based on an alleged absence of strong authentication is “ineffective”. This legal qualification means that the argument, even if well founded in fact, would have no legal bearing given the characterisation adopted for the disputed transactions.

This conclusion by no means implies that the bank escapes all liability. It simply means that its liability must be sought on another legal ground: that of breach of the duty of vigilance under the general law of contractual liability. This shift in the legal debate has major consequences for the burden of proof and for the conditions under which banking liability is engaged.

What vigilance obligations rest on banks?

The principle of the bank’s duty of vigilance

The bank’s duty of vigilance is an implied contractual obligation that rests on every credit institution in its dealings with its customers. This obligation, which originates in case law, derives from the general principle that the banker, as a professional in the handling of funds, must apply its technical competence and experience to protect the legitimate interests of its customer.

However, this duty of vigilance must be reconciled with another fundamental principle: the obligation of non-interference in the customer’s affairs. The bank is not meant to review the commercial wisdom of its customer’s choices or to interfere in its management. It must diligently execute the orders given to it, without substituting itself for the business owner in his or her decisions.

It is precisely to reconcile these two conflicting requirements that case law forged the concept of apparent anomaly. The bank is required to question the regularity of a payment order and to alert its customer only where the order has objectively abnormal characteristics, sufficiently obvious for a reasonably diligent professional to detect them.

The Versailles Court of Appeal faithfully follows this settled case law in stating that “the liability of a payment service provider for breach of its duty of vigilance, being bound by an obligation of non-interference in its customer’s affairs, may be engaged if payment transactions present an apparent anomaly, the existence of which requires it to carry out particular checks”.

The central notion of apparent anomaly

The apparent anomaly is the trigger criterion for the bank’s duty to alert. Without an apparent anomaly, the bank must execute the order without question. With an apparent anomaly, it must carry out additional checks before executing the transaction.

Case law distinguishes two categories of apparent anomalies, which the Court of Appeal expressly mentions:

• Formal anomalies: these concern the very form of the payment order or the way it is executed (unusual signature, non-compliant supporting documents, absence of the usual supporting evidence)
• Intellectual anomalies: these concern the economic content of the transaction (disproportionate amount, unusual destination, abnormal frequency, absence of any link with the customer’s business)

An essential point: the anomaly must be “readily detectable by a reasonably diligent professional”. The bank is not required to conduct in-depth investigations or to turn itself into a private detective. It must simply show the attention and competence that can reasonably be expected of a professional banking institution.

Case law has gradually refined the criteria for characterising an apparent anomaly in the specific context of CEO fraud. It has thus accepted as apparent anomalies the fact that the amount of the transfers exceeds the ceilings contractually agreed with the bank, the fact that the transfers exceed the credit balance available on the account, or the destination of the funds to an unlicensed bank located outside the European Union.

However, the ruling under review adds an important clarification: not every transaction abroad is automatically an anomaly. The Court expressly recalls that where an international transfer is made to an account located in a State outside the SEPA zone and presents apparent anomalies, the banker is required to verify its regularity.

This wording shows that the geographical location of the recipient bank is not, on its own, enough to characterise an anomaly. That location must also be unusual in light of the customer’s known business practices.

The obligation to verify where there are anomalies

When an apparent anomaly is detected, the bank cannot simply execute the order with its eyes closed. It must carry out “particular checks”. These checks have two complementary components:

First component: verifying that the transactions are not unusual in the customer’s business practice. The bank must compare the characteristics of the disputed transaction with the history of transactions habitually carried out by the customer. This check presupposes that the bank retains a minimum knowledge of its customer’s business and payment habits.

Second component: asking the person authorised to issue payment orders to confirm the suspicious orders. This confirmation obligation is the heart of the protective mechanism. The bank must contact the legal representative of the customer company directly, or the person expressly mandated to validate payment orders.

The judgment of the Versailles Court of Appeal perfectly illustrates this principle. The bank argued that if it had contacted Ms I., the only person authorised to issue payment orders under the company’s internal organisation, she would necessarily have confirmed the fraudulent orders since she was herself a victim of the manipulation.

The Court of Appeal rejects this argument: “As for the bank’s argument that, had it contacted Ms I., the only person authorised to issue payment orders, she would necessarily have confirmed the disputed orders, it is ineffective, given that it did not in fact contact her, as it was required to do in the presence of apparent anomalies.”

This reasoning suggests that the bank should have contacted Mr P., the company’s president, directly, or at the very least sought dual validation including him, rather than relying exclusively on Ms I.

One final element reinforces the duty of vigilance: the bank’s knowledge of its customer. The ruling stresses that “it is not disputed that the bank was, at the time of the events, in a business relationship with PSV dating back some thirty years and had a good knowledge of its financial situation, so that the anomalies noted were especially apparent to it”.

The older and closer the banking relationship, the more the bank is deemed to know its customer’s habits, and the more apparent the anomalies become. This in-depth knowledge correspondingly increases the duty of vigilance.

Which apparent anomalies did the Court find in this case?

The elements dismissed as not suspicious

Before examining the anomalies actually found, it is instructive to understand which elements the Court of Appeal dismissed as not, in themselves, constituting apparent anomalies. This analysis “by omission” helps to define the contours of the notion more clearly.

The Italian destination of the transfers

PSV argued that the transfers to Italy should have alerted the bank. The Court of Appeal rejects this argument for several cumulative reasons:

• PSV exports a significant share of its output of machines for butchers and delicatessens
• Its website expressly mentions business relationships with several European countries, including Italy
• Between April 2019 and February 2022, the company had already made 11 transfers to Italy from the same account
• The recipient bank is located in a Member State of the European Union, in the SEPA zone, and is not an unlicensed bank

The Court concludes that “making the disputed payments to an account held with an Italian bank, in the SEPA zone, therefore did not constitute an apparent anomaly”.

The concurrent credit transfers

PSV argued that its account at Banque Populaire had been credited, on 18 and 22 February 2022, by transfers from its account at CIC, just before or at the same time as the outgoing fraudulent transfers. These unusual cash movements should, in its view, have alerted the bank.

The Court also dismisses this argument. The credit transfers came from an account opened in PSV’s own name with another bank. They were therefore simple internal cash movements between two accounts belonging to the same holder. The bank had no need to interfere in its customer’s cash management in order to determine whether or not it was advisable to transfer funds from one account to another.

Moreover, thanks to these top-ups, the disputed transfers did not cause any overdraft on the account, which rules out another classic case-law criterion for an apparent anomaly.

The individual amounts of the orders

Taken in isolation, each transfer order did not exceed the amounts habitually handled by PSV. The ruling notes that the company had annual turnover of between €5.5 and €7.5 million, and that between 2019 and 2021 it had placed 12 transfer orders of more than €50,000, the highest being approximately €81,000.

The six disputed orders, ranging from €49,452 to €70,260, thus fell within the upper range but remained consistent with previous practice. The Court finds: “Taken individually, the amount of the disputed orders placed therefore did not constitute an apparent anomaly.”

The body of evidence constituting anomalies

It is the accumulation of several unusual characteristics, taken as a whole, that constitutes the body of evidence revealing an apparent anomaly. The Court of Appeal identifies four major intellectual anomalies.

First anomaly: several transfers to the same beneficiary on the same day

The bank did not dispute that between April 2019 and February 2022, PSV had never placed several transfer orders in favour of the same beneficiary on the same day. Yet on 17 February 2022, two orders were placed on the same day (€60,784 and €53,216), and on 22 February 2022, three orders were placed on the same day (€70,260, €49,982 and €68,758).

This concentration of orders in favour of a single recipient, within a matter of hours, was a manifest break from the company’s payment habits.

Second anomaly: exceptional cumulative amount over a short period

The four years of account statements produced by PSV showed that it had never made so many transfers of such a large cumulative amount to the same beneficiary within seven days. Over the period from 16 to 22 February 2022, €352,452 was transferred to the same Italian account.

For a company whose annual turnover is between €5.5 and €7.5 million, such a transfer represents approximately 5 to 6% of annual turnover, concentrated in one week and in favour of a single recipient. This proportion was manifestly exceptional.

Third anomaly: unknown beneficiary with a name unrelated to the business

The Italian beneficiary company, named “Eurogrid Cycles”, had never received any payment from PSV before February 2022. It was therefore an entirely new supplier in the company’s business relationships.

Moreover, the corporate name “Eurogrid Cycles” manifestly evokes the cycle and bicycle sector, with no apparent link to the business of manufacturing machines for butchers and delicatessens carried on by PSV. This sectoral inconsistency, known to the bank, which maintained an ongoing relationship with its customer, was an additional warning signal.

Fourth anomaly: the exceptional peak of 22 February 2022

The three transactions carried out on 22 February 2022 represented a cumulative amount of €189,000 in a single day. This figure far exceeded PSV’s usual practice, as it had never, in the three preceding years, made a payment of more than approximately €80,000 to the same supplier.

22 February 2022 therefore marked an abrupt quantitative break: a daily amount more than twice the previous record, in favour of an unknown recipient.

The Court stresses that these anomalies were “all the more visible” because the bank had of its own accord grouped the orders: two transfers into a single one of €114,000 on 17 February, three transfers into a single one of €189,000 on 22 February. In making these groupings, without express instruction from its customer, the bank must necessarily have noticed that it was creating transactions of particularly high amounts, each exceeding €100,000.

These spontaneous groupings moreover reveal an inconsistency in the bank’s argument: if it saw fit to group the orders for reasons of technical convenience or bank charges, it follows that it had identified their repetitive nature and common destination. How, then, did it fail to detect the overall anomaly represented by these massive transfers to an unknown recipient?

The Court of Appeal concludes firmly: “These anomalies should, at the very least on 22 February 2022, have led any reasonably diligent payment service provider to alert its customer, to contact it and to ask it to confirm its payment orders.”

The date of 22 February 2022 is expressly mentioned as a critical threshold: it is on that date that the accumulation of anomalies became so obvious that no reasonably diligent banker could ignore it. Even if it could possibly be accepted that the first transfers, taken in isolation, were not sufficiently clear warning signals, the third episode on 22 February, with three transfers totalling €189,000, indisputably crossed the threshold of apparent anomaly.

How was the victim company’s liability established?

The company’s organisational shortcomings

Having found that the bank breached its duty of vigilance, the Court of Appeal does not stop there. It scrutinises the conduct of the victim company itself and identifies several serious failings in its internal organisation.

The Court of Appeal first notes a major structural shortcoming: at the time of the events, Ms I., PSV’s administrative and financial manager, held sole signing authority on the bank account and was the only person authorised to view the balance and carry out all secured transactions.

This excessive concentration of financial powers in the hands of a single person, with no control by the company’s director, is a manifest organisational vulnerability. The total absence of dual validation or after-the-fact control left the company particularly exposed to fraudulent manipulation.

The situation was all the more problematic because Mr P., the company’s president, was no longer a delegated signatory on the “EBICS Connection Pack” system at the time of the events. He therefore could not even, had he wished to, check the payment orders placed by his colleague.

Worse still: in March 2018, the company had terminated the “Mobile Business Suite” contract that would have allowed Mr P. to consult the accounts remotely. This termination had cut the director off from any direct access to his company’s banking movements, making him entirely dependent on the information Ms I. chose to give him.

Beyond these general organisational shortcomings, the Court identifies specific negligence by Ms I. in handling the fraudulent messages. The analysis of the email of 16 February 2022 is particularly illuminating.

This message, purportedly sent by Mr P. but actually coming from a fraudulent email address (and not from his real professional address), contained several glaring inconsistencies:

• It urged Ms I. to “tell no one about the matter”, including the president himself
• It forbade her from speaking to Mr P. in person or by telephone, allowing only exchanges via a “secure” email address
• It invoked an alleged “procedure imposed by the AMF” although PSV, not being listed, was not subject to any regulation by the Autorité des marchés financiers
• It asked her to contact “Maître Bouvard-Decot, of the firm Deloitte”, an incongruous mix of a lawyer’s title and the name of a major audit firm

The finding is severe: Ms I. did not exercise the basic vigilance that could be expected of an administrative and financial manager faced with such a suspicious message. A simple internet search would have allowed her to verify that the lawyer mentioned did not belong to the Deloitte firm. A brief direct telephone call to Mr P., despite the prohibition contained in the email, would immediately have revealed the deception.

The Court adds that “it is undisputed that Ms I. did not take the precaution of discussing in person with Mr P. the alleged acquisition of a company abroad for which she alone placed the disputed payment orders”. This total absence of verification with the director, when it was supposedly a major strategic transaction (the acquisition of an Italian company) involving more than €350,000, constitutes clear professional negligence.

The bank had moreover tried, without success, to raise the company’s awareness of fraud risks. In telephone conversations on 4 and 8 February 2022, a few days before the fraudulent transfers, it had offered Ms I. and Mr P. transaction validation tools capable of preventing fraud. These offers had not been taken up.

The split of liability and its consequences

On the basis of these findings, the Court of Appeal states a principle of case law that is now well established: “Where the payment service provider has breached its duty of vigilance, the negligent fault of its customer may lead to its being exonerated in whole or in part from liability.”

This rule of apportionment of liability, derived from the general law of contractual liability, allows the judge to assess, at his or her sovereign discretion, each party’s respective contribution to the occurrence of the loss. It is not an automatic exoneration, but an adjustment of compensation according to the comparative seriousness of the faults committed.

In this case, the Court of Appeal applies a severe weighting against PSV: “The fraud of which PSV was the victim thus revealed shortcomings in its internal organisation such that it was abnormally vulnerable to fraudulent manipulation. The court holds that the appellant company is, for this reason, largely responsible for its own loss.”

The phrase “largely” leaves no ambiguity: the Court considers that the main responsibility for the loss lies with the company itself, because of its defective organisation and the negligence of its employee.

This assessment results in a token award against the bank of €20,000 in damages, less than 6% of the total loss claimed (€352,452).

This solution illustrates the growing severity of the courts towards companies that are victims of CEO fraud and have not put in place minimum internal control procedures. The case law sends a clear message: banking liability for breach of the duty of vigilance is only a subsidiary safety net, which cannot make up for companies’ serious negligence in their own organisation.

It should nevertheless be stressed that this split of liability is not systematic. Case law sometimes holds the bank fully or almost fully liable where the apparent anomalies are particularly glaring and the victim company has committed no significant negligence. Each case is assessed at the courts’ sovereign discretion according to its particular circumstances.

What practical lessons can companies and banks draw from this ruling?

This ruling of the Versailles Court of Appeal offers valuable lessons both for companies and for banks facing the resurgence of CEO fraud.

For companies: the imperative of a robust internal organisation

The first lesson is unequivocal: no company can rely exclusively on its bank’s vigilance to protect itself against fraud. Putting internal control procedures in place is a security obligation that rests primarily on the business owner.

The minimum recommendations flow directly from the shortcomings identified in the ruling:

• Systematically introduce dual validation for any transfer of a significant amount or of an unusual nature, necessarily involving the director or a senior manager
• Maintain permanent view-only access for the director to all of the company’s bank accounts, including remotely via online banking tools
• Contractually agree transfer ceilings with the bank suited to the company’s real needs, and provide for a mandatory confirmation procedure for any excess
• Regularly train employees with access to payment means in CEO fraud techniques and in prudent reflexes (systematic verification of email addresses, oral confirmation by telephone in the event of an unusual request)
• Establish a closed list of authorised beneficiaries for recurring transfers, and require reinforced validation for any new beneficiary

The ruling also shows that cursory training is not enough. It is not simply a matter of making employees aware that CEO fraud exists, but of instilling concrete reflexes: checking the sender’s email address, never trusting a displayed sender name, systematically calling the director in the event of an unusual request, even if the message forbids it.

For banks: refine the detection of apparent anomalies

The ruling confirms that banking liability rests on an objective criterion: the existence of apparent anomalies readily detectable by a reasonably diligent professional. Banks must therefore develop automated detection tools capable of identifying breaks in their customers’ payment habits.

The relevant detection criteria, validated by case law, include the unusual frequency of transfer orders (several transfers on the same day to the same beneficiary), the exceptional cumulative amount over a short period (a few days or weeks), the appearance of a new beneficiary, especially if its name has no apparent link with the customer’s business, the exceeding of usual ceilings or of the individual amounts historically handled, and the coincidence of unusual credits (top-ups of the account) with immediate outgoing transfers abroad.

The ruling also recalls that the bank cannot shelter behind the argument that “if it had called the authorised person, that person would have confirmed the orders”. This reasoning is held to be ineffective: once an apparent anomaly exists, the bank must contact the customer. The duty of vigilance is not conditional on the supposed usefulness of the alert.

For the courts: a sovereign assessment of the split of liability

The ruling illustrates the margin of appreciation enjoyed by the lower courts in determining the split of liability between the bank and the victim company. This split follows no mathematical rule: it results from a concrete analysis of the respective seriousness of each party’s failings.

In this case, the bank being ordered to pay €20,000 out of the €352,452 claimed reflects a banking liability of approximately 6%, and a liability of the victim company of approximately 94%. This ratio, particularly unfavourable to the victim, is explained by the accumulation of serious organisational shortcomings: single signature, no control by the director, failure to react to manifest warning signs.

What practical lessons can companies and banks draw from this ruling?

This ruling of the Versailles Court of Appeal offers valuable lessons both for companies and for banks facing the resurgence of CEO fraud.

For companies: the imperative of a robust internal organisation

The first lesson is unequivocal: no company can rely exclusively on its bank’s vigilance to protect itself against fraud. Putting internal control procedures in place is a security obligation that rests primarily on the business owner.

The minimum recommendations flow directly from the shortcomings identified in the ruling:

• Systematically introduce dual validation for any transfer of a significant amount or of an unusual nature, necessarily involving the director or a senior manager other than the person initiating it
• Maintain permanent view-only access for the director to all of the company’s bank accounts, including remotely via online banking tools
• Contractually agree transfer ceilings with the bank suited to the company’s real needs, and provide for a mandatory confirmation procedure for any excess
• Regularly train employees with access to payment means in CEO fraud techniques and in prudent reflexes: systematic verification of email addresses, oral confirmation by telephone with the director in the event of an unusual request, even if the message forbids it
• Establish a closed list of authorised beneficiaries for recurring transfers, and require reinforced validation with a cooling-off period for any new beneficiary
• Never terminate remote view-only tools that allow the director to follow banking movements in real time

The ruling shows that the manifest incongruities of the fraudulent email (prohibition on speaking in person with the director, reference to a “procedure imposed by the AMF” for an unlisted company, mix of a lawyer’s title and an audit firm) should have alerted Ms I. This failure to react to such crude signals weighed heavily in the assessment of the company’s liability.

For banks: develop effective detection tools

Banks must invest in automated anomaly detection systems capable of identifying behavioural breaks in each business customer’s payment habits. The ruling validates the following criteria as constituting apparent anomalies:

• Several transfers placed on the same day to the same beneficiary (a practice never previously observed)
• Exceptional cumulative amount over a short period (7 days in this case) far exceeding previous practice
• New beneficiary whose corporate name has no apparent link with the customer’s known business
• One-off peak massively exceeding historical individual amounts (€189,000 in one day when the previous record was €80,000)

The ruling stresses that the length and intensity of the banking relationship increase the duty of vigilance: a bank that has been a partner for thirty years and holds regular meetings with its customer has an in-depth knowledge of its business and usual practices. The anomalies are therefore “especially apparent” to it.

Finally, the bank cannot plead the pointlessness of making contact on the ground that “the authorised person would in any event have confirmed the orders”. The obligation to verify exists as soon as the apparent anomaly is established, regardless of its supposed outcome.

Conclusion

The Versailles Court of Appeal ruling of 3 February 2026 illustrates the delicate balance that courts must strike in CEO fraud cases: penalising banks’ breaches of their duty of vigilance while taking into account the negligence of victim companies that facilitated the fraud.

The decision confirms that banking liability may be engaged under the general law of contractual liability where fraudulent transfers, although authorised in the technical sense, present apparent anomalies that the bank should have detected. These anomalies are assessed in light of a body of evidence: unusual frequency, exceptional cumulative amount, a new beneficiary unrelated to the customer’s business, suspicious coincidence between top-ups and outgoing transfers.

However, the victim’s liability may be held to be overwhelming where its internal organisation shows serious flaws: single signature with no control by the director, absence of dual validation, termination of remote view-only tools, failure to react to manifest warning signs in the fraudulent emails. The resulting split of liability may be massively unfavourable to the victim, as shown by the compensation limited to approximately 6% of the loss in this case.

Beyond the legal solutions, this ruling is a warning for all companies: protection against CEO fraud rests first and foremost on rigorous internal procedures and on employee training. Banking vigilance, although necessary, cannot make up for the company’s own organisational shortcomings.

FAQ: Frequently Asked Questions