Paris Court of Appeal, Pôle 5 ch. 6, 28 January 2026, No. 24/01045
🔑 Key Takeaways
- The bank must prove that the transaction was authenticated, recorded and executed without technical failure, before even discussing the customer’s negligence.
- Certicode Plus documents that are incomplete, undated, unsigned and have no established link with the account agreement do not amount to proof of authentication.
- Nine fraudulent transfers for a total of €23,000 were reimbursed in full to the victim.
- Phishing remains the leading vector of fraud in France: approximately 2.4 million victims are recorded each year.
- Without proof of regular authentication, the argument of gross negligence (Article L. 133-19 of the Monetary and Financial Code (code monétaire et financier)) is of no use to the bank.
- Article L. 133-23 of the Monetary and Financial Code (CMF) requires the payment service provider to demonstrate, by any means, that the transaction was properly authenticated and authorised.
Contents ▼
- What Happened? The Facts of the Case
- How Does a Phishing Attack Work?
- What Is the Legal Framework for Unauthorised Transactions?
- Who Must Prove What in the Case of Fraud?
- What Is the Payer’s Gross Negligence?
- What Did the Paris Court of Appeal Decide?
- Why Did the Certicode Plus Evidence Fail?
- What Is the Logical Consequence of the Absence of Proof of Authentication?
- What Is the Practical Scope of This Judgment for Fraud Victims?
- What to Do If You Are a Phishing Victim and Your Bank Refuses to Reimburse?
- Conclusion
- FAQ: Frequently Asked Questions
What Happened? The Facts of the Case
Between 3 and 12 August 2021, nine transfers were debited from the account of a La Banque Postale customer, for a cumulative amount of approximately €23,000. The customer had not ordered them. He discovered these transactions and immediately disputed them with his bank, which refused to reimburse, taking the view that the transactions had been properly authenticated and that the customer had committed gross negligence by disclosing his credentials to third parties.
The case was brought before the courts. At first instance, the court partly upheld the bank’s position. The case went up to the Paris Court of Appeal, which, in its judgment of 28 January 2026, adopted a radically different analysis.
How Does a Phishing Attack Work?
Phishing is a fraud technique by which a scammer poses as a trusted body (bank, government agency, operator) via a falsified email, text message or website. The aim is to get the victim to disclose his or her credentials, passwords or validation codes, which are then used to carry out fraudulent transactions in his or her name.
In this type of fraud, the victim receives a message that appears to come from his or her bank: identical layout, reproduced logo, official tone. A link leads to a page that perfectly imitates the login interface. The victim enters his or her credentials there, believing that he or she is accessing the customer area. This data is immediately captured by the fraudsters, who use it to log in to the real account and order transfers, often in series and very quickly to avoid detection.
What Is the Legal Framework for Unauthorised Transactions?
Where a payment transaction is disputed by the account holder, a precise body of rules applies: Articles L. 133-18 to L. 133-24 of the Monetary and Financial Code (CMF), which transpose into French law the European Payment Services Directive (PSD2). This regime is exclusive of any other basis of civil liability.
Who Must Prove What in the Case of Fraud?
Article L. 133-23 of the CMF is the keystone of the evidentiary system. Where a user denies having authorised a transaction, it is for the payment service provider (the bank) to prove that the transaction was authenticated, duly recorded, and not affected by a technical deficiency. Only once these three elements are established can the bank rely on any gross negligence by the customer.
What Is the Payer’s Gross Negligence?
Case law has gradually refined the notion. A customer who discloses his or her codes to a scammer who has convinced him or her that he or she is dealing with the bank does not necessarily commit gross negligence. But this debate can only begin if the bank has first satisfied its initial burden of proof.
What Did the Paris Court of Appeal Decide?
The Paris Court of Appeal overturns the first-instance judgment and orders La Banque Postale to reimburse the entire €23,000 fraudulently debited. The bank did not provide proof of the authentication of the nine disputed transactions, and this failure deprives it of the possibility of invoking the customer’s gross negligence.
Why Did the Certicode Plus Evidence Fail?
La Banque Postale produced before the Court documents relating to its Certicode Plus system. The Court rejected this evidence: the documents were incomplete, undated, unsigned, and had no link with the customer’s account agreement. The bank presented generic and insufficiently individualised documents.
Some institutions produce generic certificates that describe their authentication system in general, without providing individualised proof for each disputed transaction. This practice is insufficient: the evidence must establish that THIS transaction, on THIS date, for THIS customer, was indeed authenticated.
What Is the Logical Consequence of the Absence of Proof of Authentication?
The consequence is mechanical: if the bank does not prove authentication, Article L. 133-18 of the CMF applies and reimbursement is due immediately. The customer’s gross negligence, even if established, can be invoked only after the bank has satisfied this prior demonstration.
What Is the Practical Scope of This Judgment for Fraud Victims?
Any victim who disputes payment transactions must first formally demand that the bank produce proof of the authentication of each of the disputed transactions: not a general certificate, but individualised proof, dated and linked to the account agreement.
📋 Recommended Strategy for Phishing Victims
2️⃣ Expressly ask the bank to produce proof of authentication for each transaction
3️⃣ Check that the documents produced are dated, signed, individualised and linked to your account agreement
4️⃣ If the bank refuses or produces insufficient evidence, refer the matter to the banking ombudsman or bring legal proceedings
5️⃣ Keep all the evidence of the fraud (emails, text messages, screenshots)
The Regulatory Technical Standards (RTS) of the European Banking Authority impose precise requirements on strong authentication and transaction monitoring. Where a bank fails to comply with these standards, its civil liability may be engaged on this basis.
What to Do If You Are a Phishing Victim and Your Bank Refuses to Reimburse?
Do not accept the bank’s refusal as a final answer. The time limit for disputing is 13 months from the date of the debit (Article L. 133-24 CMF). This time limit is mandatory. Gather all the relevant documents and consult a lawyer specialising in banking law.
Conclusion
The judgment of the Paris Court of Appeal of 28 January 2026 is a strong signal: the burden of proof on banks in matters of unauthorised payments cannot be satisfied by incomplete, undated, unsigned or non-individualised documents. La Banque Postale is ordered to reimburse €23,000 without the court even having to rule on the customer’s conduct.
The firm LE BOT Avocat assists victims of bank fraud at every stage of their claim. If you have been the victim of phishing and your bank refuses to reimburse, do not let the time limits run out: contact us.
