Phishing Scam: CIC Bank Ordered to Reimburse €2,900 for Failing to Prove Authentication (TJ Paris, 10 June 2026, No. 26/00547)

Paris Court of First Instance, local civil division (PCP JTJ proxi fond), 10 June 2026, RG No. 26/00547

What happened in this €2,900 phishing case?

The facts described in the judgment have become sadly commonplace. A customer of Crédit industriel et commercial (CIC), holding a sustainable development savings account (livret de développement durable, LDD) and a current account, falls victim to a phishing scam. It all starts with a fake link leading to a fake “Le Bon Coin” web page, a deception which, according to the customer, Le Bon Coin itself confirmed in writing. Caught out, she gives the fraudster her bank card number and her personal details, but never, she insists, her security code (the three-digit cryptogram, known as the CVV).

What follows, on 1 February 2024, takes only a few minutes. At 2:26 p.m., a beneficiary named “Leboncoin” is created on the customer’s accounts. At 2:28 p.m., an internal transfer of €2,980 is made from the LDD to the current account. At 2:30 p.m., an external transfer of €2,900 is sent to the fake beneficiary “Leboncoin”. At 2:31 p.m., a mobile confirmation is recorded. The customer states that she never authorised these transactions, nor created this beneficiary, which she says was added without her knowledge through an intrusion into her banking app.

Reacting quickly, she reported the fraud the same day: a phone call to her adviser, a letter, then a complaint filed with the authorities. With no reimbursement forthcoming, she sued CIC, by a bailiff’s writ (acte de commissaire de justice) of 27 January 2026, before the Paris Court of First Instance. She claims reimbursement of the €2,900, interest, and €1,000 in damages for the bank’s breach of its duty of vigilance.

The bank, for its part, puts forward two arguments. First, the transactions were allegedly “correctly authenticated” through its “CERTICODE PLUS” strong authentication system, the customer’s iPhone having been registered since July 2023 and the mobile confirmations having been recorded on that device. Second, and in any event, the customer allegedly committed gross negligence by giving her card number to a fraudster, without being alerted by the absurd amount debited. The question before the court was therefore simple to state but weighty in consequence: had the bank sufficiently proved that these transactions were indeed authorised and free of any technical failure?

What is an unauthorised payment transaction?

The whole dispute turns on this notion. The Monetary and Financial Code, which transposes the European directives on payment services, sets out a definition that is very protective of the payer.

Definition: Unauthorised Payment Transaction
Under Article L. 133-6 of the Monetary and Financial Code, a payment transaction is “authorised” only if the payer has given consent to its execution. In the absence of such consent, the transaction is deemed unauthorised. The mere fact that a payment was technically executed therefore does not mean that it was authorised.

The consequence is set out in Article L. 133-18: where an unauthorised transaction is reported by the user under the conditions of Article L. 133-24, the payment service provider (the bank) must reimburse the payer “immediately and at the latest by the end of the following business day”. This is a quasi-automatic reimbursement mechanism, designed so that the victim is not deprived of her funds for months.

This reimbursement is set aside only in limited cases, listed in Article L. 133-19: the payer bears the losses if she acted fraudulently or with gross negligence. And, crucially, the same article provides that, except in cases of fraud on her part, the payer bears no financial consequences where the transaction was carried out without the bank requiring strong authentication. In other words, strong authentication is not merely a defence argument for the bank: it is an obligation whose absence works against it.

Who bears the burden of proof when a transfer is disputed?

This is the heart of the judgment, and the reason it deserves to be read carefully by anyone in dispute with their bank. The answer comes down to a single article: Article L. 133-23 of the Monetary and Financial Code.

Definition: Burden of Proof (Article L. 133-23)
Where a user denies having authorised a transaction, it is for the bank, not the customer, to prove that the transaction was authenticated, duly recorded and accounted for, and that it was not affected by a technical or other deficiency. The second paragraph adds that the use of the payment instrument, as recorded by the bank, “is not necessarily sufficient” to prove that the customer gave her consent.

This rule runs against common intuition. Many victims believe they must “prove” that they authorised nothing, which would be impossible proof of a negative fact. The law says the opposite: it is enough for the customer to dispute the transaction for the bank to bear a full burden of proof. In this case, the court expressly notes that the customer filed a complaint and wrote to the bank the same day; that challenge is enough to give rise, for CIC, to the burden of proof under Article L. 133-23.

What are the two stages imposed on the bank?

The judgment sets out with remarkable clarity the evidential mechanism arising from the combination of these provisions and the Cour de cassation’s settled case law. This burden unfolds in a “mandatory two-stage progression”, an “evidential hierarchy” which, the court says, “cannot be circumvented”.

The order is anything but theoretical. If the bank fails at stage 1, the debate about the customer’s conduct, about her alleged carelessness, simply never opens. That is exactly what happened here.

Why did CIC fail to prove authentication?

To meet its obligation, CIC put before the court the statement of the transactions of 1 February 2024 and screenshots of the confirmations recorded by its system. The court dismisses these items one by one, and identifies three cumulative and independent failings.

Definition: Strong Authentication
Strong authentication (or two-factor authentication) requires the combination of at least two independent elements to validate a transaction: something the customer knows (password, code), has (phone, card) or is (fingerprint, face). It is the key requirement of the PSD2 Directive. CIC’s “CERTICODE PLUS” system is one implementation of it. The bank must still prove that it actually worked during the disputed transaction.

First failing: an internal transfer “not submitted” via the internet, entirely unexplained. The statement shows that an internal transfer of €2,980 was executed from the LDD to the current account at 2:28 p.m., marked “not submitted” and with the channel “INTERNET”. Yet the customer had given the fraudster only her card number and her personal details. How, then, could a transfer have been executed from an internet interface? The bank provides no explanation of the nature and level of authentication of this internal transfer, nor of the identity of whoever logged in. This shortcoming, the court notes, deprives CIC of any possibility of providing the required proof.

Second failing: an instant transfer to a beneficiary that was not eligible for it. This is the most telling contradiction. A document produced by the customer expressly states that the beneficiary “Leboncoin” was “not eligible for instant transfers”. Yet the statement shows, at 2:30 p.m., an entry labelled “VIR INST LEBONCOIN” for €2,900, in other words precisely an instant transfer. This contradiction, which the bank does not explain, reveals according to the court a system deficiency that allowed an instant transfer to be executed to an account that was not eligible for it, in breach of the obligation to demonstrate the absence of any technical deficiency.

Definition: Instant Transfer
An instant transfer moves funds within seconds, at any hour. Its speed, and the fact that it is irreversible once executed, make it the fraudsters’ favourite tool. Not every beneficiary account is eligible: executing an instant transfer to an ineligible account therefore points to a technical anomaly in the payment chain.

Third failing: no connection logs. CIC produces no connection log that would identify who opened the banking session at the critical times, establish the originating IP address, or rule out the possibility of an intrusion or session hijacking by a third party. Yet demonstrating the absence of a “technical or other” deficiency means being able to trace and identify the origin of the transactions. Without this logging data, the proof simply cannot be provided.

The court concludes bluntly: these “cumulative and independent” failings prevent the bank from demonstrating that the transactions were authenticated and free of deficiency. CIC therefore fails at the first stage of its burden of proof. The transactions of 1 February 2024 are classified as unauthorised payment transactions.

Why was the customer’s gross negligence not examined?

This is the direct consequence, and an educational one, of the evidential hierarchy. The bank was banking heavily on gross negligence: the customer had, after all, given her card number to a fraudster.

Definition: Gross Negligence
Gross negligence is conduct by the user who has manifestly failed to take elementary precautions to protect her personalised security credentials. It is the only fault (along with fraud) that allows the bank to refuse reimbursement of an unauthorised transaction. But it is never presumed: it is for the bank to prove it, and only after clearing the authentication stage.

The court applies the logic of the texts strictly: “in accordance with the evidential hierarchy established by Article L. 133-23, there is no need to examine any possible gross negligence”. Since the bank has not cleared the first step, the second remains closed. At this stage it matters little whether the customer was careless: the bank’s evidential failure is enough to bring about reimbursement. This is a major lesson for victims, against whom banks almost systematically raise gross negligence: that argument carries weight only if the bank has first proved the authentication of the transaction.

Why were damages refused?

The judgment is not, however, a victory across the board, and this is where one must be clear-eyed. In addition to reimbursement, the customer claimed €1,000 in damages for the bank’s breach of its duty of vigilance. That claim is rejected.

The court applies a now well-established line of case law: where the liability of a payment service provider is sought on account of an unauthorised or incorrectly executed transaction, only the special regime of Articles L. 133-18 to L. 133-24 of the Monetary and Financial Code applies, to the exclusion of any other ordinary-law liability regime, and in particular of Article 1231-1 of the Civil Code (code civil) (Cass. com., 2 May 2024, No. 22-18.074). The ordinary-law “duty of vigilance” route is therefore closed where the dispute concerns an unauthorised transaction. The court adds that the customer did not demonstrate any loss distinct from that resulting from the unauthorised transaction, which has already been fully made good by the reimbursement.

What interest can the victim actually obtain?

On this point too, the court reins in the claim. The customer sought the contractual interest on her sustainable development savings account from 1 February 2024, which would have restored the remuneration lost on the account. The court refuses: the reimbursement regime of Article L. 133-18 gives entitlement only to interest at the statutory rate, running from the formal notice constituted by the summons, that is 27 January 2026.

The bill is not negligible: beyond the €2,900, the award of €1,000 under Article 700 and the order to pay costs mean that the bank bears part of the cost of the proceedings. And provisional enforcement as of right (Article 514 of the Code of Civil Procedure, code de procédure civile) requires the bank to pay immediately, without waiting for the outcome of any appeal.

What should you do if you are the victim of a fraudulent transfer?

This decision, without revolutionising the law, illustrates concretely the course of action and the reflexes that make the difference. Several practical lessons emerge.

Dispute the transaction immediately and in writing. The customer called her adviser, wrote to the bank and filed a complaint the same day. The court stresses that this prompt challenge was enough to place on the bank the burden of proof under Article L. 133-23. Speed and a written record are essential.

Ask the bank for the technical evidence. It is for the bank to produce the connection logs, the IP addresses, proof of strong authentication and the absence of any technical deficiency. If it does not produce them, which is common, its failure counts against it. A victim does well to demand these items explicitly.

Hunt for inconsistencies in the statement. Here, two anomalies decided the case: a “not submitted” transfer via the internet although the customer had not given her login credentials, and an instant transfer to a beneficiary “not eligible” for that type of transfer. These technical details, often overlooked, reveal failings.

Choose the right legal basis. A claim for reimbursement of the unauthorised transaction is the royal road. Grafting an ordinary-law claim for damages onto it risks partial rejection. It is better to concentrate on the special regime of the Monetary and Financial Code, and to reserve any compensation claim for a genuinely distinct loss.

Conclusion

The Paris Court of First Instance’s judgment of 10 June 2026 invents nothing, and that is precisely its strength: it applies with exemplary rigour the evidential hierarchy of Article L. 133-23 of the Monetary and Financial Code. The lesson is clear for victims of banking fraud (phishing, fake adviser, identity theft): the bank must first prove the authentication of the transaction and the absence of any technical deficiency. Until that first step is cleared, the debate on the customer’s gross negligence does not even arise. Here, an unexplained transfer, a contradiction over eligibility for instant transfers and the absence of logs were enough to condemn CIC.

The decision also reminds us of its own limits: the special regime of the Monetary and Financial Code is exclusive, which closes the door to ordinary-law damages for failure of vigilance, and gives entitlement only to interest at the statutory rate. A well-run action against the bank must therefore aim accurately. If you are facing a fraudulent debit and your bank refuses to reimburse you by pointing to your “negligence”, this decision shows that there is solid ground on which to compel it, provided you demand of it what the law requires: proof. The law firm LE BOT Avocat, dedicated to banking law, supports victims through this process.

FAQ: Frequently Asked Questions