Paris Court of First Instance, 9th Chamber, 1st Section, 9 April 2025, No. 23/08669
🔑 Key Takeaways
- Quishing (a booby-trapped QR code) is a variant of phishing: legally, the resulting debits are unauthorised payment transactions.
- Article L. 133-18 of the Monetary and Financial Code (code monétaire et financier) requires the bank to immediately reimburse any unauthorised transaction reported by the customer.
- The burden of proof lies with the bank: it is for the bank to demonstrate the customer’s gross negligence (négligence grave, Art. L. 133-23), not for the customer to prove the absence of fault.
- The Paris Court of First Instance held that the “probable phishing” relied on by the bank is not enough: BNP Paribas was ordered to reimburse €14,069.91.
- After 30 days, the sums due bear interest at the statutory rate increased by 15 points.
- Having scanned a QR code or having had data stolen does not, on its own, amount to gross negligence.
Table of Contents ▼
- What is quishing, the QR code scam exploding in 2026?
- How does the fake parking ticket scam work?
- Why is a debit resulting from quishing an “unauthorised transaction”?
- What does Article L. 133-18 of the Monetary and Financial Code say?
- Who bears the burden of proof: the victim or the bank?
- Is “probable phishing” enough to refuse reimbursement?
- What should we take from the Paris Court of First Instance judgment of 9 April 2025?
- Does strong authentication change anything for the victim?
- What should you do in practice if you are a victim of quishing?
- FAQ: Frequently Asked Questions
What is quishing, the QR code scam exploding in 2026?
The word is a portmanteau: it combines QR code and phishing. Quishing covers all scams that use a QR code as bait. The code itself contains no scam: it simply redirects the victim to a website, a payment page or a file controlled by the fraudsters. Once on that site, the victim is invited to enter their bank details, their online banking credentials or a validation code, which go straight to the fraudster.
Quishing is a form of phishing in which the trap takes the form of a QR code. Scanned with a smartphone, this code opens a fraudulent page imitating an official or merchant website, designed to capture personal data, bank credentials or authentication codes.
Why does this technique work so well? First, because scanning a QR code has become an everyday gesture since the health crisis: we scan without thinking, in restaurants, on terminals, on posters. Second, because the human eye cannot “read” a QR code: it is impossible to check at a glance which address it points to, unlike a hyperlink that you can hover over. Finally, because a smartphone, smaller than a computer screen, often hides the real address of the site and the signs of a counterfeit. The Ministry of the Interior has in fact updated in 2026 its practical guide on cyberattacks to expressly cover “QR phishing”.
How does the fake parking ticket scam work?
The most viral version in 2026 targets motorists. A piece of paper resembling a genuine penalty notice, sometimes adorned with an official logo, is left under the windscreen wiper. It announces a fine of a deliberately modest amount (often €35) to be paid within 48 hours to avoid an increase to €135. Urgency and fear of the penalty do the rest: the victim scans the QR code printed on the fake notice, lands on a site imitating the official fines portal, and enters their number plate and then their bank details. The money obviously does not go into the State’s coffers.
📄 Fake notice / booby-trapped QR code (windscreen, email, poster, letter)
↓
📱 The victim scans: sense of urgency, credible amount
↓
🌐 Counterfeit site imitating an official or merchant portal
↓
🔑 Entry of bank details and/or a validation code
↓
💸 Fraudulent debits, sometimes enrolment of the card in a mobile wallet
↓
⚖️ Unauthorised payment transaction → right to reimbursement
Other variants are circulating: fake QR codes stuck on parking meters and charging points, booby-trapped codes in an email about a “parcel awaiting delivery” or a “tax refund”, stickers placed over a genuine QR code on a poster. The common point remains the same: getting the victim to hand over, themselves, data that will then be used to debit their account.
Why is a debit resulting from quishing an “unauthorised transaction”?
This is the whole issue, and it is also the first piece of good news for the victim. In law, the reasoning is not “you were fooled, too bad for you”. It is in terms of consent. The victim of quishing never consented to the disputed debits: they thought they were paying a €35 fine, not authorising a debit of several thousand euros for the benefit of an unknown third party. The transactions that follow are therefore not payments they wanted: they are unauthorised payment transactions.
This is a transaction that the account holder did not authorise, that is, to which they did not give their consent within the meaning of Article L. 133-6 of the Monetary and Financial Code. Phishing fraud, including quishing, falls into this category: the victim never wanted the transfer of money carried out by the fraudster.
What does Article L. 133-18 of the Monetary and Financial Code say?
The text is perfectly clear. Where an unauthorised payment transaction is reported by the user, the bank “shall reimburse the payer the amount of the unauthorised transaction immediately after becoming aware of the transaction or after being informed of it, and in any event no later than the end of the following business day”. The principle is therefore immediate reimbursement. The bank must restore the account to the state in which it would have been had the transaction not taken place.
The only reservation: the bank may defer reimbursement “if it has good reasons to suspect fraud by the user”, that is, fraud committed by the customer themselves, not fraud of which they are the victim, provided it communicates those reasons in writing to the Banque de France. In other words, refusing to reimburse is the strictly regulated exception, not the principle. The text adds a decisive financial incentive: after thirty days of delay, the sums due bear interest at the statutory rate increased by fifteen points. On several thousand euros and several months of proceedings, the bill for the bank quickly becomes significant.
Who bears the burden of proof: the victim or the bank?
Many victims give up because their bank tells them that they “disclosed their data” and were therefore “negligent”. This is precisely the mistake not to make. The Monetary and Financial Code organises a reversal of the burden of proof that is very favourable to the customer.
Article L. 133-19, IV does provide that the payer bears the losses if they acted fraudulently or if they failed, “intentionally or through gross negligence”, in their obligation to keep their data secure. But Article L. 133-23 immediately specifies who must prove what: where the user denies having authorised a transaction, “it is for their payment service provider to prove that the transaction in question was authenticated, duly recorded and accounted for, and that it was not affected by a technical or other deficiency”. And the same text adds a crucial sentence: “The use of the payment instrument as recorded by the payment service provider is not necessarily sufficient in itself to prove that the transaction was authorised by the payer or that the payer failed […] through gross negligence to fulfil their obligations”.
This is conduct of particular imprudence, going well beyond a simple mistake or lapse of attention. The case law requires a marked failure by the customer to protect their data. Above all, gross negligence cannot be deduced from the mere fact that the personal data were used: the bank must establish it concretely.
The consequence is clear: it is the bank that bears the burden of proving the gross negligence it alleges against its customer. As long as it does not provide that proof, it must reimburse. The victim does not have to demonstrate that they were beyond reproach.
Is “probable phishing” enough to refuse reimbursement?
No, and this is one of the most useful contributions of recent case law. Banks have got into the habit of invoking a seemingly unanswerable line of reasoning: “the transactions were validated with your confidential data, so you necessarily disclosed it, so you were grossly negligent”. The Paris Court of First Instance swept this syllogism aside. It is for the bank, it writes, “to prove the payer’s fault, whether intentional or not, other than by demonstrating the use of highly confidential data”. And above all: the bank “cannot content itself with invoking the probable phishing” of which the customer was allegedly the victim.
This wording is valuable for all victims of quishing. The fact that the fraudster had the data does not prove that the victim knowingly handed it over with marked imprudence. Between “my data were used” and “I committed gross negligence” lies a whole chain of reasoning that the bank must build and support, and which it cannot replace with a mere presumption.
What should we take from the Paris Court of First Instance judgment of 9 April 2025?
The facts perfectly illustrate the mechanisms of modern fraud by data capture and fraudulent enrolment on a mobile wallet. A BNP Paribas customer receives a new bank card, issued by the bank after it detected an attempted hacking of the previous one. He activates it the same day. Very quickly, transactions are made via the Lyf Pay payment application (which allows payment by means of a QR code presented to merchants) for a total of €14,069.91, including two payments of €7,000 to a butcher’s shop located far from his home and with which he has no connection. As soon as he receives a fraud alert text message, the customer replies “no”, puts a stop on his card the same day and files a complaint online.
The bank nevertheless refuses reimbursement, maintaining that the customer must have disclosed his credentials to a third party and that he had committed gross negligence. The court did not follow this reasoning, for several reasons that every victim of quishing should know:
→ It did not demonstrate that the customer had disclosed his data to a third party; no communication with a third party was established.
→ It did not produce the text messages and emails it claimed to have sent, but only “examples” of messages.
→ The enrolment of the card on the payment service had been validated from the fraudster’s device and email address: the customer had therefore not validated the transaction himself.
→ The customer had reacted immediately (stop on the card, complaint, detailed dispute).
→ Conclusion: the bank “fails to discharge the burden of proving gross negligence that lies with it”.
Result: BNP Paribas is ordered to reimburse €14,069.91, with interest at the statutory rate increased by fifteen points from 1 July 2022 (thirty days after the dispute), and to pay €3,000 in procedural costs. The court does, however, dismiss the claim for damages for abusive resistance and non-material loss, considering that the bank had been able, initially, to entertain a suspicion: it should be noted that these ancillary claims remain harder to obtain than reimbursement itself, which is owed as of right.
The lesson goes beyond the particular case. Whether the fraud goes through a hijacked Lyf Pay QR code, a fake fines website or a classic phishing email, the legal regime is the same: the bank must prove gross negligence, failing which it reimburses.
Does strong authentication change anything for the victim?
Banks often put forward one last argument: “the transaction was validated by strong authentication, so it is deemed authorised”. Here again, the argument must be put into perspective.
Arising from the European Payment Services Directive (PSD2), strong authentication is based on the combination of at least two independent elements among: something the user knows (password), something they possess (phone) and something they are (biometrics). It aims to secure access to the account and the validation of payments.
On the one hand, authentication is only the technical outcome of a process that may have been entirely brought about by deception: if the victim was manipulated into validating a step, or if the fraudster bypassed the mechanism, the recorded validation does not prove the free and informed consent of the account holder. On the other hand, where the bank chooses not to use strong authentication where it was required, Article L. 133-19, V places the financial consequences of the transaction on the bank, not on the customer.
Finally, there is a ground still under-used by victims: that of the bank’s technical obligations under the RTS standards that supplement PSD2 (strong authentication, transaction monitoring, detection of abnormal patterns). Where a bank lets manifestly atypical debits through without reacting (two payments of €7,000 within minutes at an unusual merchant, for example), the question of the failure of its monitoring system may legitimately be raised. This is a separate lever of liability, which is cumulative with the reimbursement regime.
One useful clarification, however: a failure of anti-money laundering vigilance obligations (AML/CTF) does not, in itself, provide a basis for compensation for the victim. The French Supreme Court (Cour de cassation) has held that these obligations serve solely to combat money laundering and terrorist financing, and not to protect customers’ private interests. It is therefore better to concentrate the argument on the regime for unauthorised transactions and, where appropriate, on the technical security obligations.
What should you do in practice if you are a victim of quishing?
The speed and traceability of your steps are decisive. Here is the procedure to follow, in order.
1️⃣ Stop the card immediately and, if necessary, have the account blocked.
↓
2️⃣ Dispute the transactions in writing with the bank (registered letter), citing Articles L. 133-18 and L. 133-23 of the Monetary and Financial Code.
↓
3️⃣ File a complaint (police station, gendarmerie or online platform) and keep the receipt.
↓
4️⃣ Keep the evidence: photo of the fake notice, screenshot of the QR code and of the site, text messages, emails, statements.
↓
5️⃣ If reimbursement is refused, send a formal notice and then consider legal action.
Two pitfalls to avoid at all costs. First, do not sign any acknowledgement of negligence and do not let yourself be persuaded that “it is your fault”: it is not for you to demonstrate your absence of fault. Second, do not delay: Article L. 133-24 requires the transaction to be reported “without undue delay”, and the law provides a maximum period of thirteen months to dispute it. The faster and better documented the dispute, the more untenable the bank’s position becomes.
If the bank persists in its refusal, court action has real chances of success, as the commented decision illustrates. Being assisted by a lawyer makes it possible to build the most solid evidential strategy: requiring the bank to produce the real authentication data (and not “examples”), demonstrating the absence of marked gross negligence, and claiming, beyond the principal, interest at the statutory rate increased by fifteen points.
Conclusion
Quishing illustrates an uncomfortable truth: fraud techniques evolve faster than the vigilance of the general public. But the law did not wait for the QR code to protect victims of unauthorised transactions. The message from the judges is consistent and favourable: the bank cannot content itself with suspecting phishing in order to refuse to reimburse. It must prove concrete and marked gross negligence, and in many cases it is unable to provide that proof. If you have scanned a booby-trapped QR code and seen your account debited, never consider the game lost: you have a powerful legal regime, and case law that is being built in your favour.
