Fraudulent Transfers After Phone Theft: The Bank Must Prove Strong Authentication (CA Grenoble, Com. Ch., 26 February 2026, No. 24/02381)

Grenoble Court of Appeal, Commercial Chamber, 26 February 2026, No. 24/02381

The facts: a phone theft in Morocco and suspicious transfers during the night

The case began in Morocco on 30 May 2022, when the chairman of the company RGE 38 had his mobile phone snatched from him. The Société Générale banking app, giving access to the company’s business account, was installed on that device. Aware of the seriousness of the situation, the manager reacted quickly: he made a report to the manufacturer Apple to have the device blocked and activated “lost” mode at 9:20 GMT, which in particular deactivates the Apple Pay app.

Despite these precautions, events took a dramatic turn. During the night of 30 to 31 May 2022, between 00:10 and 04:18, twelve fraudulent transfers were made from RGE 38’s business account, for a total amount of €12,375. These transactions took place while the manager had already left Morocco and was on a flight back to France.

The next morning, 31 May 2022, RGE 38 went immediately to the Société Générale counter to report the fraudulent transactions and completed a dispute form. The same day, at 16:20, the manager filed a complaint with the gendarmerie. But the story did not end there: on 24 June 2022, Société Générale authorised a further transfer of €3,000, even though it had previously been blocked by the bank itself. The total loss now amounted to €15,375.

Faced with the bank’s refusal to reimburse these sums, RGE 38 decided to refer the matter to the banking mediator and then, following the failure of that mediation, summoned Société Générale before the Commercial Court of Vienne (tribunal de commerce) on 17 January 2023.

The legal framework for strong authentication and the reimbursement of unauthorised transactions

To understand what was at stake in this dispute, it is essential to master the legal framework applicable to unauthorised payment transactions. This framework rests mainly on the Monetary and Financial Code, which transposes into French law the European Payment Services Directive, known as “PSD2” (Directive 2015/2366/EU).

The obligations of the payment service provider

The legislator has established a fundamental principle in favour of users of banking services: in the event of an unauthorised payment transaction, it is the bank that must reimburse the customer, and this reimbursement must take place promptly. Article L. 133-18 of the Monetary and Financial Code states this rule clearly: the payment service provider must refund the payer the amount of the unauthorised transaction “immediately after becoming aware of the transaction or after being informed of it, and in any event no later than the end of the following business day”.

This reimbursement obligation has only one limited exception: the bank may refuse to reimburse if it has “good reasons to suspect fraud by the user”, and in that case it must communicate those reasons in writing to the Banque de France. In other words, mere suspicion is not enough: the bank must have concrete and probative evidence.

Moreover, Article L. 133-23 of the same code brings about a crucial reversal of the burden of proof: where a customer disputes a transaction, “it is for the payment service provider to prove that the transaction in question was authenticated, duly recorded and accounted for, and that it was not affected by a technical or other deficiency”. This reversal is of capital importance: it is for the bank to demonstrate that everything proceeded normally, and not for the customer to prove that he was the victim of fraud.

The user’s obligations and the notion of gross negligence

While the regulations strongly protect customers, they also impose obligations on them. Article L. 133-16 of the Monetary and Financial Code provides that “as soon as he receives a payment instrument, the payment service user shall take all reasonable measures to keep his personalised security data safe”.

Similarly, Article L. 133-17 requires the user to inform his service provider “without delay” in the event of loss, theft, misappropriation or unauthorised use of his payment instrument, “for the purpose of blocking the instrument”. This obligation of prompt notification aims to limit the consequences of a compromise of banking data.

However, even where these obligations are breached, the customer benefits from significant protection. Article L. 133-19 of the Monetary and Financial Code draws an essential distinction:

• If the unauthorised transaction was carried out “by misappropriating, without the payer’s knowledge, the payment instrument or the data linked to it”, the payer’s liability is not engaged, even if he has been careless.
• The payer bears losses only if he has committed “gross negligence” or “fraudulent conduct”.
• And above all, according to paragraph V of that article, “unless acting fraudulently, the payer shall bear no financial consequences if the unauthorised payment transaction was carried out without the payer’s payment service provider requiring strong authentication of the payer”.

This last provision is fundamental: if the bank has not put in place strong authentication compliant with regulatory requirements, the customer cannot be held liable, whatever his possible negligence. It is precisely this point that would be decisive in the RGE 38 case.

Strong authentication: definition and requirements of the PSD2 Directive

The notion of strong authentication lies at the heart of the system protecting electronic payments. Article L. 133-4 of the Monetary and Financial Code gives a precise definition: it is an authentication based on the use of “two or more elements” belonging to the following three categories:

This strong authentication requirement stems from the PSD2 Directive, which aims to strengthen the security of electronic payments in the face of rising online fraud. The underlying idea is simple: for a fraudster to carry out a transaction, it is no longer enough for him to have access to a single element (for example, the victim’s phone); he must also have at least one other independent element (for example, a secret code that the victim has not stored on his phone).

In the context of remote banking services, banks have developed various systems to meet this requirement. For example, Société Générale’s “Pass Sécurité Pro” system, at the heart of this case, is presented as a strong authentication device. But it is still necessary for this system to have actually been used and for the bank to be able to prove it.

The first-instance decision: the customer’s negligence upheld

On 13 June 2024, the Commercial Court of Vienne (tribunal de commerce) delivered a judgment unfavourable to RGE 38. For the first-instance judges, the bank had fulfilled its obligations by putting in place a strong authentication system compliant with the PSD2 Directive. According to the court, the “Pass Sécurité Pro” system met the dual authentication requirements, and RGE 38 benefited from it for all its online transactions.

The court then held that RGE 38 had committed “gross negligence” (négligence grave) that made the fraud possible. Several factors were held against the customer:

The delay in reporting the theft. The court noted that the phone was stolen on 30 May 2022 between 9:30 and 10:30, but that the manager reported the theft to Société Générale only on the morning of 31 May, more than 24 hours after the events. According to the court, the deactivation of the Apple Pay app, which took place late, had no effect on Société Générale’s remote banking service.

The failure to use the bank’s emergency service. The judges found that Société Générale offers its customers the possibility of blocking their payment instruments 24 hours a day, 7 days a week, by telephone or via the banking app. RGE 38 did not use this emergency service to immediately block its access to online banking.

The time elapsed before the fraudulent transfers. The court noted that the manager returned to France on 30 May at 13:35, and that the fraudulent transfers were made only during the night of 30 to 31 May, between 01:21 and 04:53. According to the court, RGE 38 “had all the time necessary to activate the blocking of the remote banking service”.

The inadequacy of the phone protection measures. For the court, the fact that the fraudster was able to use the phone showed that the device was not protected by a sufficient access code, which also constitutes negligence.

Consequently, the court dismissed all of RGE 38’s claims and even ordered it to pay Société Générale €3,000 under Article 700 of the Code of Civil Procedure (Code de procédure civile), as well as the court costs.

This decision illustrates a strict approach to the customer’s obligations regarding banking security. But it would be overturned on appeal, on a different legal basis.

The appeal and the arguments of the company RGE 38

RGE 38 appealed the judgment on 24 June 2024. Before the Grenoble Court of Appeal, it developed an argumentative strategy centred on two main lines: first, it denied having committed gross negligence; second, and above all, it argued that the bank had not proved that the disputed transfers were authenticated by a strong authentication system compliant with regulatory requirements.

The challenge to the gross negligence finding

The appellant began by deconstructing the court’s reasoning on its alleged negligence. It put forward several factual elements that the court had, in its view, “distorted”:

The speed of the reactions after the theft. RGE 38 stressed that its manager reacted very quickly after his phone was stolen. From 9:20 GMT, less than an hour after the theft at 8:30 GMT, he activated his phone’s “lost” mode, which automatically deactivated the Apple Pay app. This responsiveness shows, in its view, that no negligence was committed.

The practical impossibility of doing more in Morocco. The appellant pointed out that the theft took place at 8:30, whereas its manager had to board a plane at 11:45 to return to France. Given the requirement to be present for boarding at 11:15, he did not have the time needed to present himself to the local Moroccan authorities and complete all the administrative formalities.

The prompt report in France. On the morning of 31 May, immediately after discovering the fraudulent transfers, RGE 38 went to the bank counter to report the unauthorised transactions and complete the dispute form. The same day, at 16:20, a complaint was filed with the gendarmerie.

The absence of any legal obligation to report the theft of the phone itself. The appellant relied on an important legal argument: under Article L. 133-17 of the Monetary and Financial Code, the user must report the loss of “the payment instrument or the data linked to it”. A mobile phone, as such, is not a “payment instrument”, even if a banking app is installed on it. The reporting obligation therefore concerns only the compromise of the banking data itself, which was done the following morning.

The central argument: the absence of proof of strong authentication

But the appellant’s most decisive argument concerned the question of strong authentication. RGE 38 argued that the bank did not prove that the disputed transfers were validated by a strong authentication system compliant with Article L. 133-4 of the Monetary and Financial Code.

Several points were put forward in support of this thesis:

The non-compliant nature of sending a code by text message. RGE 38 pointed out that while Société Générale claims to offer authentication by sending a one-time code by text message as an alternative to the Pass Sécurité Pro system, this method does not constitute strong authentication according to the European Banking Authority, the Prudential Supervision and Resolution Authority (Autorité de contrôle prudentiel et de résolution) and the Banque de France. Indeed, sending a text message implements only one additional factor (possession of the phone), without a genuinely independent second factor, since the fraudster who holds the phone also receives the text message.

The absence of proof that the stolen phone was enrolled in Pass Sécurité Pro. The appellant argued that the screenshot produced by the bank concerning registered devices did not show that its manager’s iPhone 12 was among the devices equipped with the strong authentication service. This absence of proof is crucial: if the stolen device was not enrolled in the Pass Sécurité Pro system, then the transfers could not have been validated by this strong authentication system.

The security failure of the bank’s app. RGE 38 highlighted a revealing anomaly: of the four apps installed on the stolen phone, only Société Générale’s was hacked. In its view, this indicates a security defect in the banking app, which allows the account identifier to be saved in advance and uses the same six-digit code both to validate a transaction and to access the app. This structural weakness compromises the security of the system.

The reversal of the burden of proof. The appellant stressed a fundamental legal point: it is not for the customer to explain how a third party was able to access his online space without his having disclosed his banking data. Requiring such proof would amount to asking him to prove a negative fact, which constitutes an “inversion of the burden of proof” contrary to Article L. 133-23 of the Monetary and Financial Code. It is for the bank to prove that the transactions were correctly authenticated, and not for the customer to prove the contrary.

Société Générale’s defences

Faced with these arguments, Société Générale maintained its position and asked for the first-instance judgment to be upheld. Its defences revolved around three main lines.

The compliance of the Pass Sécurité Pro system

The bank asserted that the Pass Sécurité Pro system it had put in place fully meets the PSD2 Directive’s strong authentication requirements. According to the bank, this system combines several authentication factors:

• A knowledge element: the identifier and six-digit secret code giving access to the Progeliance Net personal space.
• A possession element: the registered mobile phone, on which the Pass Sécurité Pro app is installed.
• Possibly, a biometric element: the transaction can be validated by facial recognition or fingerprint.

Société Générale produced computer logs which, in its view, prove that the disputed transfers were validated by the Pass Sécurité Pro system. These logs trace the history of connections and events, and show that strong authentication was indeed used.

The customer’s established negligence

The bank elaborated at length on the argument of RGE 38’s gross negligence. It stressed several failings:

Insufficient protection of the phone. According to Société Générale, if the fraudster was able to use the phone after the theft, it is because the device was not protected by a sufficient access code. It deduced that the customer had not taken “all reasonable measures” to keep its data safe, as required by Article L. 133-16 of the Monetary and Financial Code.

The delay in reporting the theft. The bank noted that between the theft on 30 May at 8:30 and the making of the fraudulent transfers during the night of 30 to 31 May from 1:20, more than 18 hours had elapsed. In its view, RGE 38 had ample time to contact the bank’s emergency service, including via the airport police.

The failure to take steps to block remote access. Société Générale criticised the customer for not having taken steps to block the remote banking access service by contacting the bank’s dedicated service, or by logging into its personal space to change its access code, or even by blocking the app itself by entering an incorrect code three times, which automatically triggers the blocking of access.

The confusion of codes. The bank noted that if the customer maintains that the login code for its personal space and the code associated with Pass Sécurité are the same, it was for the customer to change them as it saw fit. The general terms and conditions of the Progeliance Net contract moreover expressly state that, as a security measure, the secret code must be changed by the user upon first connection to the service.

The need to access the online space

Société Générale disputed the argument that only its app had been hacked. It argued that the disputed transfers were not made solely from the mobile app, but also required access to the Progeliance Net online space via an internet browser. Yet this access requires entering login codes known only to the account user, followed by a six-digit secret code to access the personal space.

According to the bank, the mere theft of the phone could therefore not allow a connection to the customer’s personal space. The fact that the fraudster succeeded in doing so shows that the secret codes were not sufficiently protected, which engages the customer’s liability for gross negligence.

The Court of Appeal’s analysis: insufficient proof of authentication

On 26 February 2026, the Grenoble Court of Appeal overturned the first-instance judgment in all its provisions. The Court’s analysis rests on a rigorous application of the rules of evidence laid down by the Monetary and Financial Code.

The reversal of the burden of proof

The Court began by recalling the cardinal principle in this area: “it is for the payment service provider to prove that strong authentication methods were made available and used, in accordance with Articles L. 133-23 et seq. of the Monetary and Financial Code”.

This reversal of the burden of proof means that the bank must positively prove that the disputed transactions were indeed authenticated by a strong authentication system compliant with legal requirements. It is not for the customer to prove the contrary or to demonstrate that he was not negligent: it is for the bank to establish that its security system functioned correctly.

This approach is consistent with the logic of the PSD2 Directive and the Monetary and Financial Code: faced with the technical complexity of banking systems, the customer is placed in a position of informational weakness. The bank alone can access the technical data showing whether strong authentication was actually implemented. It is therefore logical that the burden of proof lies with the bank.

The absence of proof of the stolen phone’s enrolment

The Court then carried out a meticulous examination of the evidence produced by Société Générale. It found that the bank had indeed produced a statement of the devices registered in the Pass Sécurité Pro system, as well as a table of the disputed transfers. But these documents did not, according to the Court, demonstrate that the phone stolen from Mr G., chairman of RGE 38, had actually been enrolled in the strong authentication system.

The Court identified several gaps in the evidence produced:

The lack of precise identification of the stolen phone. The statement produced by the bank contained “no information on the registered telephone line or on a reference number specific to this device”. The Court noted that “the two devices registered by Mr [N] were registered under the same identifiers, with the same Pass Sécurité Pro number, the same reference for the device type and app version, with no indication of a telephone line number or of any data specific to each of these devices”.

This lack of individual device traceability is problematic: how can one know with certainty which phone was used to validate the transactions if the devices are not uniquely identified in the system?

The lack of any reference to the mobile phone in the table of transfers. Likewise, the table of disputed transfers “does not make it possible any more to establish that the stolen phone was registered in the app providing strong authentication”. This table “contains no reference to the mobile phone from which the transfers were made”.

The Court drew an unequivocal conclusion: “it has not been established by the respondent, on whom the burden of proof lies, that the device stolen from Mr [G] was registered in the system intended to secure online banking transactions”.

The customer’s negligence becomes irrelevant

From this finding, the Court of Appeal drew a major legal consequence: “It follows that the payment service provider does not prove that the disputed transfers were authenticated, duly recorded and accounted for, and that they did not result from a technical or other deficiency.”

From that point on, the question of the customer’s negligence became legally irrelevant. The Court stated this expressly: “In light of Articles L. 133-23 et seq. of the Monetary and Financial Code, it follows that Société Générale can only be ordered to return to the appellant the sums transferred from its business account, without there being any need to rule on any negligence on the part of its chairman, that ground being irrelevant.”

This wording is essential: it means that once the bank fails to prove that strong authentication was correctly implemented, the question of whether or not the customer committed gross negligence no longer needs to be examined. The absence of strong authentication precludes any examination of the customer’s liability.

This solution flows directly from Article L. 133-19, V of the Monetary and Financial Code, which provides that “unless acting fraudulently, the payer shall bear no financial consequences if the unauthorised payment transaction was carried out without the payer’s payment service provider requiring strong authentication of the payer”. In other words, the absence of strong authentication compliant with the regulations automatically exonerates the customer from any liability, unless it is proved that he himself orchestrated the fraud.

Consequently, the Court overturned the first-instance judgment in all its provisions and ordered Société Générale to reimburse RGE 38 the sum of €12,384.60, as well as to pay it €3,000 under Article 700 of the Code of Civil Procedure, in addition to the costs of the first-instance and appeal proceedings.

The scope of the decision and its practical lessons

This decision of the Grenoble Court of Appeal is of considerable importance for all users of banking services, whether individuals or businesses. It strongly reminds banks of their obligations regarding payment security and proof of authentication.

Banks’ strengthened evidentiary obligations

The first lesson of this judgment: banks must not only put in place strong authentication systems compliant with the PSD2 Directive, but must also be able to prove, for each disputed transaction, that these systems were actually used.

This evidentiary requirement has several practical consequences for banking institutions:

The need for precise technical traceability. Banks must keep detailed logs making it possible to identify with certainty the device from which a transaction was carried out. It is not enough to state that a customer registered “a phone” in the strong authentication system: it must be possible to identify precisely which phone was used to validate each transaction, for example by its IMEI number, its telephone line number, or any other unique identifier.

The obligation to produce legible and comprehensible evidence. The documents produced by the bank must enable the judge, and possibly the customer himself, to verify that strong authentication was indeed implemented. Cryptic or incomplete logs are not enough: the evidence must be clear, precise and demonstrative.

The risk of strict case law in the event of insufficient evidence. As this judgment shows, if the evidence produced by the bank does not make it possible to establish with certainty that strong authentication was correctly used, the judge will draw the consequences by ordering the bank to reimburse, whatever the customer’s possible negligence.

Recommendations for companies that fall victim to fraud

For businesses and individuals who fall victim to fraudulent transactions, this judgment also provides valuable lessons on how to proceed and which arguments to put forward.

React quickly, but without panicking. Even though speed of reaction remains important, this judgment shows that the customer is not required to do the impossible. If the circumstances (travel abroad, lack of internet connection, flight times) make immediate reporting difficult, this is not enough to establish gross negligence, provided that the report is made as soon as possible.

Systematically dispute fraudulent transactions. The mere fact of disputing a transaction triggers the reversal of the burden of proof: it is then for the bank to prove that the transaction was correctly authenticated. You should therefore not hesitate to formally dispute all suspicious transactions, even if the bank initially states that it refuses to reimburse.

Demand precise technical evidence from the bank. As this judgment shows, banks often produce technical documents (logs, statements of registered devices) that do not genuinely prove that the device used for the fraudulent transaction was indeed registered in the strong authentication system. It is essential to challenge the probative value of these documents if they do not contain precise identifying information (telephone number, IMEI, etc.).

Invoke the inadequacy of strong authentication. If the bank claims to have put in place a strong authentication system, it should be required to demonstrate that this system is genuinely based on at least two truly independent factors. For example, sending a simple code by text message to the phone that is also used to log in to the banking app is not sufficient strong authentication, since both factors (possession of the phone and receipt of the text message) are compromised simultaneously if the phone is stolen.

Do not be intimidated by the negligence argument. Banks systematically invoke the customer’s negligence to refuse reimbursement. But as this judgment shows, once strong authentication has not been correctly implemented, the question of negligence becomes legally irrelevant. You should therefore not be discouraged by these arguments.

Seek the assistance of a specialist lawyer. Disputes relating to fraudulent banking transactions raise complex legal and technical questions. The assistance of a lawyer specialising in banking law is strongly recommended to analyse the evidence produced by the bank, identify its possible flaws, and effectively assert the customer’s rights.

The limits of the decision

This decision should not, however, be over-interpreted. The Grenoble Court of Appeal does not say that banks can never invoke the customer’s negligence to refuse reimbursement. It simply states that where the bank does not prove that strong authentication was correctly implemented, the question of negligence does not need to be examined.

Thus, in a different situation where the bank had actually proved that strong authentication had been correctly used, the judge could have examined the question of the customer’s gross negligence. For example, if the customer had voluntarily disclosed his secret codes to a third party, or had written his codes down visibly on his phone, such gross negligence could justify a refusal to reimburse.

Likewise, the decision does not call into question the principle that the customer has obligations regarding the security of his payment instruments. Articles L. 133-16 and L. 133-17 of the Monetary and Financial Code continue to apply: the user must take “all reasonable measures” to keep his data safe and must report “without delay” the loss or theft of his payment instrument.

But the major contribution of this judgment is to clarify that these customer obligations can be invoked by the bank only if it has itself fulfilled its own obligations, namely putting in place strong authentication and, above all, proving that this authentication was used for the disputed transactions.

Conclusion

The decision of the Grenoble Court of Appeal of 26 February 2026 marks an important step in the protection of banking service users against fraudulent transactions. By stating clearly that the burden of proving strong authentication lies with the bank, and that this proof must be precise and demonstrative, the Court reminds banking institutions of the extent of their responsibilities.

In a context of multiplying transfer frauds and the growing sophistication of the techniques used by cybercriminals, this case law offers welcome protection to businesses and individuals who fall victim to such conduct. It also sends a clear signal to banks: putting security systems in place is not enough; they must also be able to prove that these systems were actually used and that they meet the strict requirements of the regulations.

For victims of fraudulent transactions, this decision is an encouraging precedent. It shows that it is possible to effectively challenge a bank’s refusal to reimburse, where the bank cannot provide rigorous proof of the authentication of the disputed transactions. It also illustrates the importance of being assisted by a legal professional capable of analysing the technical evidence produced by the bank and challenging its probative value.

Beyond the specific case, this case law forms part of a broader movement to strengthen the protection of consumers and businesses in their dealings with banking institutions. It reminds us that banking law is not a one-way street, where only the customer’s obligations are sanctioned. Banks also have strict obligations, and their breach of those obligations engages their liability, with the consequence of an obligation to reimburse the misappropriated sums.

If you are the victim of fraudulent banking transactions and your bank refuses to reimburse you, do not hesitate to challenge that decision and to be assisted by a specialist lawyer. As this judgment shows, the case law may find in your favour, even if the bank invokes your alleged negligence. The key is to check whether the bank can genuinely prove that the transactions were authenticated in accordance with the regulations. In many cases, this proof is lacking, and the bank must then bear the consequences of that shortcoming.

FAQ: Frequently Asked Questions