Fraudulent Transfers After Phishing: Bank Held Liable for Lack of Technical Proof (CA Douai, 3rd ch., 11 June 2026, No. 25/02773)

Douai Court of Appeal, 3rd chamber, 11 June 2026, No. 25/02773

What happened in this case?

The facts are unfortunately very commonplace, which is precisely what makes this decision relevant to all phishing victims. The holder of several accounts opened with Crédit du Nord (the bank to whose rights Société générale now succeeds, following the merger by absorption that became final on 1^st January 2023) received an email on 16 December 2020 that appeared to come from his bank. The message invited him to log in to his personal online banking area to read a message presented as important. The hyperlink led to a web page resembling the bank’s portal, on which the victim entered his personal authentication codes.

On 16 and 17 December 2020, two transfers of €2,400 each (€4,800 in total) were executed from his account to an unknown beneficiary. The victim filed a criminal complaint for fraud (escroquerie) on 22 December 2020. As the bank refused to reimburse him and did not accept the amicable settlement proposed by the consumer mediator, the customer brought proceedings against it on 21 September 2022 to obtain redress.

First setback: by a judgment of 25 February 2025, the Lille Court of First Instance dismissed all of the victim’s claims. It is this judgment that the Douai Court of Appeal overturned, completely reversing the situation in the customer’s favour.

Why are the transfers “unauthorised”?

Characterising the transaction is the first step, because it determines the applicable legal regime. Under Article L. 133-3, I of the Monetary and Financial Code, a payment transaction is the act of paying, transferring or withdrawing funds. Under Articles L. 133-6 and L. 133-7 of the same code, such a transaction is authorised only if the payer has consented to its execution, in the form agreed with the payment service provider. That consent must relate both to the identity of the beneficiary and to the amount of the transaction.

On this point, Société générale had itself defused the debate. In its pleadings it stated that it had “never argued that the two transfer transactions at the heart of the proceedings were the result of transactions consented to/ordered” by its customer. As the absence of consent was not disputed, the court drew the logical consequence: these transfers are unauthorised transactions within the meaning of Article L. 133-6. The reimbursement machinery could therefore be set in motion.

Who must prove what: the bank or the customer?

This is the heart of the decision, and the reason why this judgment deserves to be read carefully by every victim. The applicable regime is not the ordinary law of liability but a special regime of full harmonisation, resulting from the transposition of the European directives on payment services. The court recalls that the regime of Articles L. 133-18 et seq. of the Monetary and Financial Code applies “to the exclusion of any alternative liability regime arising from national law”.

This regime follows a protective logic. Article L. 133-18 requires the bank to reimburse the payer within a short period, restoring the debited account to the state it would have been in had the transaction not taken place. The bank can escape this obligation in only one case, set out in Article L. 133-19, IV: if the losses result from fraudulent conduct by the payer or if the payer has failed, intentionally or through gross negligence, to comply with their security obligations.

But, and this is the major contribution, before it can even invoke the customer’s gross negligence, the bank must clear a preliminary evidential hurdle. Article L. 133-23, paragraph 1, provides that where a user denies having authorised an executed transaction, it is for the bank to prove that the transaction was authenticated, duly recorded and accounted for, and that it was not affected by a technical or other deficiency. Paragraph 2 adds an essential safeguard: the mere use of the payment instrument, as recorded by the bank, is not necessarily sufficient to prove that the transaction was authorised or that the customer was grossly negligent.

Had strong authentication been implemented?

The PSD2 Directive (Directive (EU) 2015/2366 of 25 November 2015), transposed in Article L. 133-44 of the Monetary and Financial Code, introduced the requirement of strong authentication (authentification forte). Under point f) of Article L. 133-4, this rests on the use of at least two independent elements belonging to the categories “knowledge” (something only the user knows), “possession” (something only the user possesses) and “inherence” (something the user is).

In this case, the court considered that strong authentication had indeed been triggered. The “knowledge” factor came from the confidential codes entered by the victim on the fake page. The “possession” factor came from a message sent under the “SMS OTP” procedure to the customer’s telephone number, in the context of adding a trusted beneficiary. The bank therefore cleared this first hurdle: strong authentication had technically been requested at the time of the events. But this interim victory was not enough, as we shall see.

Does a “trusted beneficiary” relieve the bank of any burden of proof?

The bank had raised a technical argument. Under the second paragraph of Article 13 of Regulation (EU) 2018/389, the provider is allowed not to apply strong authentication where the payer initiates a transaction in favour of a beneficiary on a list of trusted beneficiaries previously created by the payer. The bank inferred from this that, since the transfers had been sent to an account previously registered as a trusted beneficiary, it was not required to apply strong authentication to the payments themselves.

The court acknowledges the relevance of this argument on the question of authentication alone: yes, the exemption in Article 13 applies to payments to a trusted beneficiary. The argument is therefore “irrelevant”. But, and this is crucial, this exemption concerns only strong authentication. It in no way relieves the bank of proving the absence of a technical deficiency, which is a separate requirement. It is on this second ground that everything was decided.

Why did the bank fail to prove the absence of a technical deficiency?

The absence of a technical deficiency can be presumed where the bank demonstrates the physical validation, by the payer himself, of all the operations that enabled the payment. Here, however, it was undisputed that the victim had not personally validated all of those operations. No presumption could therefore operate in the bank’s favour: it was for the bank to demonstrate positively that the process had not been affected by a deficiency.

To this end, Société générale produced two internal emails, incorporating data and screenshots from its IT system: one detailing the “SMS OTP” authentication when the trusted beneficiary was added, the other establishing that the telephone number used did indeed correspond to the customer’s. The court held this evidence to be “wholly insufficient”, for three cumulative reasons:

The court’s conclusion is unequivocal: Société générale “does not establish a sequence of events that allows it to conclude with sufficient certainty that the transactions were carried out without the fraudsters exploiting a security flaw”. It therefore fails to discharge its burden of proving that the transactions were not affected by a technical deficiency. It is this evidential failure, and not an assessment of the customer’s conduct, that sealed the bank’s liability.

Does the victim’s gross negligence change anything?

This is the most powerful lesson of the judgment from a strategic standpoint. The bank had built most of its defence on the customer’s gross negligence: according to it, phishing was already widespread in 2020, and a reasonably attentive user could have detected the fraud. It also argued that the customer had necessarily received the OTP code and passed it on to the fraudsters.

The court sweeps aside this entire debate in one stroke. It holds that, “without it being necessary to assess the reality of the gross negligence alleged”, the victim is entitled to reimbursement. In other words: since the bank failed at the preliminary evidential stage, the very question of gross negligence becomes moot. The customer’s conduct does not have to be discussed.

This hierarchy of questions is a considerable weapon for victims. All too often, the debate immediately crystallises around the customer’s “fault”: was he careless in clicking, in entering his codes? The Douai judgment puts things back in the order intended by the European legislator: first the bank proves the technical reliability of its system, only then do we talk about the customer. Many banks, unable to produce their connection logs, do not clear the first step.

What exactly can be recovered?

The reimbursement provided for by Article L. 133-18 must be full, with neither loss nor gain for the payer. The bank restores the account to the state it would have been in without the fraudulent transaction. Here, the amount of €4,800 (two transfers of €2,400) was not disputed as to its quantum; the court dismissed the bank’s argument that this was an “indeterminate loss”: the obligation to reimburse relates to a precise amount, which is by nature determined.

One point deserves attention regarding the interplay with criminal proceedings. The bank invoked a possible deduction: the perpetrator of the fraud had been ordered by the criminal court (tribunal correctionnel) to pay €2,400 in respect of the material loss. Referring to a recent judgment (Cass. 1st civ., 5 November 2025, No. 24-22.303), the court recalls that a sum awarded by the criminal court for financial loss must indeed be deducted from the civil reimbursement, since it has the same effect. But, under Article 1353 of the Civil Code (code civil), it is for the bank, which claims to be partly discharged, to prove the extinguishing fact. Yet the criminal conviction was not final: the perpetrator had appealed and the proceedings were still pending. As the bank did not establish a final conviction, no deduction was allowed. The reimbursement therefore remained in full: €4,800.

The bank was also ordered to pay all costs at first instance and on appeal, together with €2,000 in respect of irrecoverable costs at first instance and €2,000 on appeal (Article 700 of the Code of Civil Procedure (code de procédure civile)).

Why was non-material damage refused?

Not every aspect of the decision is favourable, and honesty requires us to say so. The victim claimed €6,000 for non-material damage (préjudice moral), arguing in particular that other victims of the same fraudsters had been reimbursed by their banks. The court rejected this claim, upholding the judgment on this point.

The reasoning follows directly from the exclusivity of the special regime. Since the European directives brought about full harmonisation, the regime of Articles L. 133-18 et seq. applies to the exclusion of any other. The ordinary law of contractual liability therefore cannot apply to a claim based on the same triggering events. Yet this special regime “makes no provision for compensation in respect of non-material damage”. The claim therefore has no legal basis.

This illustrates the ambivalence of the special payments regime: the same exclusivity that protects the customer by guaranteeing near-automatic reimbursement of unauthorised transactions deprives him, conversely, of the possibility of claiming compensation for non-material damage that is nonetheless real: anxiety, a sense of injustice, time lost in the face of the bank’s refusal. This is a structural limit that must be understood before bringing an action, so as to calibrate one’s claims and avoid weakening the case with a claim that is bound to fail.

What practical lessons are there for fraud victims?

This judgment is not a mere case-law curiosity: it is a roadmap for anyone who has had funds stolen through phishing and who is met with their bank’s refusal.

First reflex: shift the debate to the burden of proof. Rather than justifying oneself against alleged carelessness, the victim should require the bank to produce the full proof provided for by Article L. 133-23: not only authentication, but also, and above all, the absence of a technical deficiency. The decisive document is the log of use of the access device (Article 2 of Regulation (EU) 2018/389), that is, the time-stamped history of connections. Many banks make do with screenshots and the “delivered” status of an SMS: the Douai judgment shows that this is not enough.

Second reflex: neutralise the trusted beneficiary argument. The bank will often try to invoke the exemption from strong authentication for a trusted beneficiary. The answer, as the court gave it, is that this exemption does not release it from its separate obligation to prove the absence of a technical deficiency.

Third reflex: secure and document one’s own consistency. The victim’s credibility here rests on having spontaneously and consistently acknowledged being tricked. Filing a criminal complaint for fraud promptly and giving consistent statements strengthen the case, not as a basis for compensation but as elements of credibility.

Filing a criminal complaint and, where appropriate, reporting to the authorities remain useful for the punitive side and for recovery from the perpetrator of the fraud, but they are no substitute for the civil action based on the payment services regime, which remains the most direct and effective route to obtaining reimbursement.

Conclusion: A Decision Everyone Should Read

The Douai Court of Appeal’s judgment of 11 June 2026 illustrates, in a particularly instructive way, the protective mechanism for unauthorised payment transactions. Its practical significance is considerable: it confirms that the bank cannot content itself with invoking the customer’s carelessness or the exemption linked to the trusted beneficiary. Above all, it must prove that its system functioned flawlessly, and in particular produce its connection log. Failing that, full reimbursement is required, without the customer’s negligence even being discussed.

The limit lies in non-material damage, which is excluded as a result of the full harmonisation of the special regime. A single decision never exhausts the litigation: each case calls for a tailor-made strategy that knows which grounds to press and which to avoid. If your bank has refused to reimburse fraudulent transfers, do not assume that your “negligence” will stand in the way of compensation: the first question to ask is that of the burden of proof borne by the bank. The firm LE BOT Avocat assists victims of banking fraud in building and defending these cases.

FAQ: Frequently Asked Questions