French Supreme Court (Cour de cassation), Commercial, Financial and Economic Chamber, 30 August 2023, appeal No. 22-11.707, published in the Bulletin (F-B)
🔑 Key Takeaways
- Unless the payer acted fraudulently, where the bank has not required strong authentication it may not claim any financial consequence from the customer (Art. L. 133-19, V, of the Monetary and Financial Code (code monétaire et financier)).
- The judge must examine the question of strong authentication as a priority, BEFORE any discussion of possible gross negligence by the payer.
- The strong authentication obligation arising from Article L. 133-44 of the Monetary and Financial Code came into force on 14 September 2019.
- Delegated Regulation (EU) 2018/389 of 27 November 2017 (RTS) sets out the technical standards for strong customer authentication.
- The judgment quashes a decision that had found gross negligence on the part of a customer who gave her 3D Secure code to a fraudster, without checking whether strong authentication had actually been applied.
- The decision is quashed for lack of legal basis: phishing litigation must now begin with the technical analysis of the transaction, not with putting the customer’s carelessness on trial.
Table of Contents ▼
- What is the background to the judgment of 30 August 2023?
- What were the facts before the Cour de cassation?
- What legal question was raised?
- What exactly does the Commercial Chamber hold?
- How do strong authentication and gross negligence fit together?
- Why is the date of 14 September 2019 decisive?
- What is the strong authentication required by law?
- What role does Delegated Regulation 2018/389 (RTS) play?
- Is a 3D Secure code enough to constitute strong authentication?
- What is the practical scope of the decision for phishing victims?
- Who bears the burden of proof?
- How should a reimbursement claim be built after this judgment?
- What limits and grey areas remain?
- Conclusion
- FAQ
What is the background to the judgment of 30 August 2023?
Litigation over phishing fraud has taken up an ever larger place before the civil courts for several years. The pattern is almost always the same: a fraudster poses as a bank employee, warns the victim of an alleged fraud attempt on her account, and persuades her to validate a “technical” transaction by giving out a code received by text message. The transaction validated is never the one announced: it is in fact a fraudulent payment, sometimes for a considerable amount, immediately siphoned off to a third-party account.
For a long time, the lower courts overwhelmingly refused to compensate victims, holding that they had themselves given the security code to the fraudster and had thereby committed “gross negligence” within the meaning of Article L. 133-19 of the Monetary and Financial Code. This case law rested on a mechanical reading of the text: if the payer negligently betrayed her personal code, she bears the loss, full stop.
The judgment of the Commercial Chamber of the Cour de cassation of 30 August 2023, published in the Bulletin (F-B), puts an end to that reading. It introduces a mandatory preliminary step: before the payer’s gross negligence can even be discussed, the judge must examine whether the bank, at the time of the transaction, required strong authentication within the meaning of the Monetary and Financial Code. If it did not, the examination stops there and the bank must reimburse.
A scam technique consisting of inducing a person to reveal personal data (access codes, passwords, banking validation codes) by posing as a trusted third party, most often a bank adviser, a public official or a technical service.
What were the facts before the Cour de cassation?
The holder of an account opened with a regional branch of Crédit Agricole had been contacted by telephone and by message by a third party presenting himself as an employee of her bank. In response to this approach, the customer had given out the six-digit “3D Secure” code, intended to validate internet payments made from her account.
Following this disclosure, an internet payment that she had not made was executed on 27 January 2020 from her account. The customer immediately asked the bank to reimburse the sum debited and to compensate her loss, on the basis of Articles L. 133-18 et seq. of the Monetary and Financial Code.
The bank refused. It argued that the customer had, in its view, committed gross negligence by knowingly giving an outside third party a security code intended to validate a financial transaction. The Clermont-Ferrand Court of First Instance (tribunal judiciaire), ruling at final instance by judgment of 13 January 2022, sided with the bank and dismissed the customer’s claims in full.
On the customer’s appeal on points of law, the Commercial Chamber of the Cour de cassation quashes the judgment under appeal for lack of legal basis.
What legal question was raised?
The question put to the Commercial Chamber can be summarised as follows: may the judge reject the reimbursement claim of a payer who is the victim of an unauthorised transaction on the sole ground of her gross negligence, without first checking whether the bank required strong authentication at the time of the disputed transaction?
This question, technical in appearance, is central: it determines whether the first analysis to be carried out concerns the customer’s conduct (was she careless?) or the banking tool (did the bank provide a level of security that complies with the law?). The Commercial Chamber rules clearly in favour of the second reading.
What exactly does the Commercial Chamber hold?
Citing Articles L. 133-19, V, and L. 133-44 of the Monetary and Financial Code, in their wording resulting from Order No. 2017-1252 of 9 August 2017, the judgment states that, save for fraudulent conduct on her part, the payer bears no financial consequence if the unauthorised payment transaction was carried out without the payment service provider requiring strong authentication of the payer.
The Commercial Chamber infers from this that the court, which merely noted the customer’s gross negligence without checking whether the disputed payment transaction had been carried out without the bank requiring strong authentication of the payer, did not give its decision a legal basis. The judgment is quashed in its entirety and the case is remitted to the same court, differently composed.
⚖️ The Rule Laid Down
Article L. 133-19, V, of the Monetary and Financial Code establishes an autonomous protection for the payer: where an unauthorised transaction was carried out without strong authentication required by the bank, the payer bears no loss, unless it is shown that she herself took part fraudulently in the transaction. Gross negligence, which appears in paragraph IV of the same article, becomes inoperative.
How do strong authentication and gross negligence fit together?
To understand the scope of the decision, one must picture the new sequencing imposed by the Court. Before the judgment, the judge’s reasoning in a phishing case almost systematically started from the customer’s conduct: was she negligent? If so, and if that negligence was classed as “gross”, the bank was relieved of liability. The judgment of 30 August 2023 reverses the order of the questions.
🔍 Steps of the Reasoning Imposed on the Judge
Step 1 → Was the disputed payment transaction executed at a time when the bank was required to demand strong authentication?
Step 2 → If so, did the bank actually require that strong authentication at the time of the transaction?
If NO → The payer bears no financial consequence, unless she acted fraudulently. Discussion of gross negligence is ruled out. The bank must reimburse.
If YES → The judge may then examine whether the payer met her duties of care and, where appropriate, find gross negligence within the meaning of Article L. 133-19, IV.
The practical effect is considerable. A large share of phishing cases concern online payments validated by a six-digit code received by text message. Yet, as we shall see, this mechanism does not always meet the technical requirements of strong authentication. A bank that relied on it loses, in that situation, the ability to invoke the customer’s gross negligence.
Why is the date of 14 September 2019 decisive?
Article L. 133-19, V, of the Monetary and Financial Code refers to Article L. 133-44 of the same code, which imposes strong authentication. The judgment takes care to specify the date on which that provision came into force: by application of Article 34, VIII, 3°, of Order No. 2017-1252 of 9 August 2017, Article L. 133-44 came into force on 14 September 2019, eighteen months after the entry into force of Commission Delegated Regulation (EU) 2018/389 of 27 November 2017.
This precision is not insignificant. It sets the temporal scope of the protective mechanism:
📅 Chronological Landmarks
27 November 2017 → adoption of Delegated Regulation (EU) 2018/389 (the RTS).
9 August 2017 → Order No. 2017-1252 rewriting Title III of Book I of the Monetary and Financial Code.
14 September 2019 → entry into force of Article L. 133-44 and, by cross-reference, of the protective mechanism in paragraph V of Article L. 133-19.
27 January 2020 → date of the fraudulent transaction at issue in the judgment. More than four months after the provision came into force.
For all transactions after 14 September 2019, the framework imposed by the Commercial Chamber applies in full. Earlier transactions fall under the old regime, in which the debate focused, without this preliminary step, on the characterisation of the payer’s negligence.
What is the strong authentication required by law?
Strong authentication is the pivot of the reasoning. It remains to specify what this legal notion covers, because in everyday language it is all too often confused with the sending of a simple text message code.
An authentication procedure based on the combination of at least two independent elements from the following categories: knowledge (something only the customer knows), possession (something only the customer holds) and inherence (something the customer is, for example biometric data). The compromise of one element must not call into question the reliability of the others.
This definition is enshrined in Article L. 133-4, f, of the Monetary and Financial Code, which transposes Directive (EU) 2015/2366 of 25 November 2015 (PSD2). It is specified by Delegated Regulation (EU) 2018/389 of 27 November 2017, which adopts the regulatory technical standards (the RTS) drawn up by the European Banking Authority.
What role does Delegated Regulation 2018/389 (RTS) play?
Delegated Regulation (EU) 2018/389 occupies a central place in the judgment’s reasoning, since its date of entry into force determines that of Article L. 133-44 of the Monetary and Financial Code. What is more, it is this regulation that details the technical standards the bank must meet for a transaction to be regarded as protected by strong authentication that complies with the law.
Without going into technical detail, which is not the purpose of this commentary, it should be noted that this regulation imposes on the bank precise requirements on transaction monitoring, independence between the authentication elements, protection of authentication data and detection of transactions showing pattern anomalies. These obligations, still largely under-used in litigation, are a serious lever for victims: a bank that has not put in place an RTS-compliant system risks having its civil liability engaged, independently of the debate on the customer’s negligence.
Is a 3D Secure code enough to constitute strong authentication?
The judgment did not have to decide this question, since it quashes for lack of legal basis and remits the case to the trial court. But the question is central and deserves attention.
The “3D Secure” mechanism refers to a protocol for validating online bank card payments. In its historical versions, it consisted of asking the customer for a code received by text message to confirm the transaction. This system has evolved (the so-called “3DS v2” standard) to include transaction scoring mechanisms, additional authentication factors and, in some cases, exemptions from strong authentication.
Not every mechanism labelled “3D Secure” therefore amounts to strong authentication within the meaning of the law. For the judge, the concrete question will be this: did the bank require, for the disputed transaction, two independent elements each belonging to a distinct category (knowledge, possession, inherence)? A code received by text message, on its own, does not meet this requirement where the possession element (the phone) and the knowledge element (the code) can be compromised in a coordinated way by a single attack, which is precisely the case with phishing.
⚠️ Key Point
The bank’s presentation of a “3D Secure” protocol is not, in itself, enough to show that strong authentication was required. The customer can, and must, specifically challenge the compliance of the technical system used for the disputed transaction with the requirements of Delegated Regulation (EU) 2018/389.
What is the practical scope of the decision for phishing victims?
The judgment of 30 August 2023 does not, strictly speaking, say that phishing victims must systematically be reimbursed. It says something else, which is just as decisive: the judge can no longer dispense with the technical analysis. The customer’s conduct becomes an issue only after the bank’s technical conduct has been tested against the legal requirements.
This shift in the line of attack has three immediate practical consequences.
Who bears the burden of proof?
The allocation of the burden of proof, in matters of unauthorised payment transactions, is traditionally governed by Article L. 133-23 of the Monetary and Financial Code. Where the payer denies having authorised a transaction that was executed, it is for the payment service provider to prove that the transaction was authenticated, duly recorded and accounted for, and that it was not affected by a technical or other deficiency.
Combined with the judgment of 30 August 2023, this rule takes on its full force: it is for the bank to demonstrate, with the technical file to support it, that it actually required strong authentication complying with the law for the disputed transaction. Failing that, the sanction follows: no strong authentication, no gross negligence that can be raised against the customer. Reimbursement is due.
✅ Practical Consequence
A customer who disputes a payment transaction does not have to prove the absence of strong authentication herself. It is enough for her to invoke Article L. 133-19, V, of the Monetary and Financial Code; it is then for the bank to demonstrate that it met its technical obligations.
How should a reimbursement claim be built after this judgment?
The judgment of 30 August 2023 invites a rethink of the architecture of the submissions made to the judge. An effective claim is now organised around three prioritised lines of argument.
🛠️ Three Lines of Argument for the Reimbursement Claim
Line 1: Strong authentication (Art. L. 133-19, V): ask the bank to disclose the authentication system actually required for the disputed transaction. Argue, in the event of insufficiency or absence, that Article L. 133-19, V, applies as of right.
Line 2: Proof of the transaction (Art. L. 133-23): require production of the technical authentication data, the transaction logs, the scoring analysis and the monitoring data in line with Delegated Regulation (EU) 2018/389. Challenge each item.
Line 3: Gross negligence (Art. L. 133-19, IV): in the alternative only, contest the characterisation of gross negligence, relying on the sophistication of the fraud, the misleading resemblance of the contact, the absence of clear warning signals and, where relevant, the payer’s vulnerability.
This structure produces two useful effects. First, it places the discussion on the technical ground, where the bank holds the evidence but must produce it, which rebalances the information asymmetry. Second, it avoids the victim being, from the outset of the debate, in the defensive position of having to explain her own conduct, a position in which, as we know, the outcome is often unfavourable to her.
What limits and grey areas remain?
The scope of the judgment must be qualified on three points, which are the subject of abundant litigation and on which vigilance remains necessary.
First limit: the payer’s fraudulent conduct. Article L. 133-19, V, removes the protection in only one case: that of a payer who took part fraudulently in the transaction. This exception is narrow. It is not to be confused with gross negligence. It requires specific proof, borne by the bank, of active and concerted conduct by the payer with a view to profiting from the disputed transaction. This distinction is essential and makes it possible to reject in advance the attempts, sometimes encountered, to classify as “fraudulent conduct” what is merely severe carelessness.
Second limit: transactions exempt from strong authentication. Delegated Regulation (EU) 2018/389 provides for exemption cases: low amounts, recurring transactions to a trusted beneficiary previously declared, low-risk transactions determined by behavioural analysis. In those situations, the absence of strong authentication at the time of the transaction is not in itself a fault. But the analysis remains open to challenge: the bank must then demonstrate that it precisely met the conditions of the exemption, and that the scoring of the disputed transaction was genuinely low, which is often contestable in a phishing fraud context showing pattern anomalies.
Third limit: the possible reintroduction of gross negligence downstream. If the bank shows that it required compliant strong authentication, the judge reverts to the classic framework and may, where appropriate, find the customer grossly negligent. At that stage, the dispute over the conditions for characterising gross negligence (sophistication of the method, plausibility of the contact, the customer’s experience, warning signals) retains all its acuteness. The judgment of 30 August 2023 does not remove this discussion; it repositions it in second line.
🧭 Strategic Compass
The judgment does not bury the debate on gross negligence: it moves it downstream. The decisive lever, from now on, is the technical analysis of the authentication system. Every phishing victim should, from the very first exchange with her bank, ask for disclosure of the authentication elements actually required for the disputed transaction.
Beyond the specific mechanism of Article L. 133-19, V, of the Monetary and Financial Code, other avenues of action remain open to victims. Failure to comply with the technical standards imposed by Delegated Regulation (EU) 2018/389 (obligations on monitoring, detection of atypical transactions, protection of authentication elements) can, in itself, found a civil liability claim against the bank. This angle, still under-used in practice, deserves to be systematically explored in cases where the bank formally shows that it required strong authentication but where the technical system had, at the time of the transaction, objective failings. A criminal complaint and a report to the public prosecutor remain useful for evidential purposes and for recovery, but are not to be confused with a civil basis for a claim for damages.
Conclusion: A Lasting Rebalancing in Favour of Victims
The judgment of 30 August 2023 marks a turning point in phishing fraud litigation. By requiring the judge first to examine the strong authentication required by the bank, it shifts the first question onto technical ground, where the bank is bound by precise obligations that can be checked and documented. This new architecture rebalances litigation that, for several years, had placed victims in a systematically defensive position.
That said, the judgment is not a blank cheque for every act of carelessness. It does not say that gross negligence has disappeared; it says that gross negligence is, from now on, a subsidiary question, which arises only if the bank has first shown that it met its technical obligations. For victims’ lawyers, this reversal of the order of questions opens up considerable room for manoeuvre, provided the claim is structured around the technical analysis of the transaction, and no longer around putting the customer’s carelessness on trial.
At the law firm LE BOT Avocat, this rebalancing resonates directly in the day-to-day defence of clients facing phishing fraud. The new framework imposed by the Commercial Chamber is used systematically to rebuild, case after case, the architecture of the submissions made to the judge. The judgment of 30 August 2023 has not merely clarified a point of law: it has put the bank’s technical analysis back in the place it should always have occupied.
