Secur’Pass Does Not Prove Strong Authentication: Caisse d’Épargne Ordered to Reimburse €9,000 (CA Paris, 29 October 2026, No. 25/16092)

CA Paris, Division 4, Chamber 9-A, 29 October 2026, docket no. 25/16092

What happened in this case of disputed payments?

What were the disputed payments?

The holder of an account opened with Caisse d’Épargne et de Prévoyance Île-de-France had a deferred-debit bank card. On 29 June 2023, a card payment of €5,000 was recorded on his account in favour of “Admiralmarkets.com”. On 13 July 2023, a second payment of €4,000 was recorded in favour of the same payee.

On 2 August 2023, noticing that the outstanding balance on his card was abnormally high, the customer discovered these two payments, which he denied having made, even though he had not been dispossessed of his bank card. He sent a complaint to his bank through the online app the same day, then filed a criminal complaint the following day, 3 August 2023.

The bank refused any reimbursement, invoking the validation of the transactions by means of its customer’s personalised security credentials, more specifically through the Secur’Pass strong authentication system associated, in its view, with his iPhone registered as a trusted device. A formal notice remained unanswered on 28 December 2023, and the customer summoned the bank on 23 May 2024 before the local civil division (pôle civil de proximité) of the Paris Judicial Court (tribunal judiciaire).

What had the first-instance judge decided?

By a judgment of 3 July 2025, the local civil division of the Paris Judicial Court (tribunal judiciaire) had dismissed all of the customer’s claims. The first judge had considered that the bank demonstrated that the disputed payments had been validated by means of the strong authentication system, so that the customer “had not established their fraudulent nature”. He had also ordered him to pay the costs and €1,000 to the bank under Article 700 of the French Code of Civil Procedure (code de procédure civile).

This reasoning carried within it a reversal of the burden of proof: it is never for the payer to prove the fraud; it is for the bank to establish the technical regularity of the transaction and then, where applicable, the fault of its customer. This is precisely what the appellant argued before the court, and it is on this ground that the judgment was overturned.

What does the Monetary and Financial Code say about unauthorised transactions?

The applicable regime is a matter of public policy (ordre public) and results from the transposition of the Payment Services Directive (PSD2). The Court of Appeal methodically recalls its architecture, from Articles L. 133-3, L. 133-6 and L. 133-7 of the Monetary and Financial Code (whether a transaction is authorised depends on the payer’s consent, given in the agreed form) through to Articles L. 133-18 and L. 133-19 (reimbursement of unauthorised transactions) and L. 133-23 (burden of proof).

What is strong authentication?

Article L. 133-44 of the Monetary and Financial Code requires the bank to apply strong authentication when the payer accesses his account online, initiates an electronic payment transaction or carries out a transaction through a remote means of communication that may involve a risk of fraud.

The Caisse d’Épargne’s Secur’Pass system falls within this framework: the bank explained that it can be associated with only one trusted device, in this case the customer’s iPhone, and that each sensitive transaction is validated by entering a 4-digit code on that device. On paper, the architecture therefore does combine knowledge (the code) and possession (the registered phone). The whole question was whether the bank proved that this scheme had actually worked for the two disputed transactions.

Who must prove what when a transaction is disputed?

Article L. 133-23 of the Monetary and Financial Code sets up a double evidentiary lock, which the court restates in two stages:

This mechanism is far from theoretical: it lies at the heart of extensive litigation, in which the lower courts increasingly require banks to provide complete technical proof, as we already analysed in connection with bank card fraud where the bank must prove strong authentication before any refusal to reimburse and also the judgment of the Besançon Court of Appeal holding that the bank cannot refuse reimbursement on the basis of mere presumptions.

Why was the bank’s evidence held to be insufficient?

What was missing from the connection log?

The bank put before the court the log of connections to the remote banking space. The court reads it meticulously, and its finding is severe. When the transaction is carried out by means of the Secur’Pass system, the log contains very few entries: the columns usually filled in (subscriber identifier, connection type, operating system, operating mode, “Device information” designating the hardware, IP address, source port, internet service provider, country) are blank.

For the two disputed transactions in favour of admiralmarkets.com (the validation of the €5,000 payment on 29 June 2023 at 00:23:28 and that of the €4,000 payment on 13 July 2023 at 13:34:43), the log indicates neither which device nor which IP address was used to activate Secur’Pass. It is therefore impossible to link the validation to the famous trusted iPhone, which the bank nevertheless made a central argument.

Is the PIN enough to prove strong authentication?

No, and this is the judgment’s clearest contribution. The only thing appearing in the log was the use of the customer’s personal PIN, “which corresponds to an element of knowledge and nothing that can be linked to possession or inherence”. In other words, the bank proved only one of the two minimum factors required by Article L. 133-4, f of the Monetary and Financial Code.

The court stresses that “the mere mention of the use of Securpass”, which seemed to be enough for the Caisse d’Épargne, “is insufficient where the transaction is disputed”. Nothing in the log made it possible to consider that the code and Secur’Pass had indeed been activated from the customer’s trusted phone. Consequently, nothing made it possible to consider that the transaction had been validly recorded and validated. This requirement is in line with settled case law according to which the use of the PIN does not, in itself, prove that the holder authorised the payment.

Which anomalies undermined the bank’s case?

Two inconsistencies within the bank’s own log completed the destruction of its demonstration, and the court notes them with particular care:

First anomaly: besides the two disputed transactions, the log shows a third transaction of €5,000 in favour of admiralmarkets.com, on 12 July 2023 at 18:19:12, which appears to have been validated like the others but “which curiously cannot be found in the accounts” of the customer. A transaction that was validated but cannot be found in the accounting records directly calls into question the reliability of the recording and accounting, two express requirements of Article L. 133-23.

Second anomaly: on 3 July 2023 at 16:45:11, a transaction was validated through Secur’Pass from an Android phone, with the mention OK, whereas the same log mentions no change of trusted phone and the bank claimed that Secur’Pass can only be activated from the trusted iPhone. The court notes that this is “to say the least curious”: either the system is not as locked down as the bank claims, or the log is faulty. In either case, the possibility of a technical deficiency or a compromise could not be ruled out.

The conclusion follows logically: it does not appear possible to consider that the bank demonstrates that it was indeed the user’s strong authentication data that was used and that there was no technical failure. The first limb of the proof not being met, reimbursement was required. We find here the reasoning already applied to the same system in the case where the bank was ordered to reimburse despite the Secur’Pass validation.

Does consistency with the customer’s habits replace technical proof?

The bank had built a second line of defence, more contextual: the disputed transactions allegedly fit within consistent financial behaviour. It pointed out that the account had been credited with €8,000 on 29 June 2023, used the same day for an undisputed payment of €3,846 and for the first disputed transaction; that the customer had raised his card limit to €12,000 on 12 July 2023, a transaction requiring strong authentication; that he had ordered the same day an undisputed transfer of €5,000 to an investment platform; and that he had subsequently continued normal banking activity.

It added that the payee, Admiral Markets, is a genuine online trading company operating the website admiralmarkets.com, not to be confused with a homonymous site presented as fraudulent. The customer, for his part, objected that he does not make risky investments, that his monthly card debits were usually very modest compared with the disputed amounts, and that several entries in the log were inconsistent with his equipment and his internet service provider.

The court does not dwell on this contextual debate, and that is a lesson in itself: the economic plausibility of a transaction does not relieve the bank of the technical proof required by Article L. 133-23. A body of behavioural indications replaces neither the identification of the device, nor the IP address, nor the demonstration of the absence of technical deficiency. The text knows only one hierarchy: first the proof of regular authentication, then, where applicable, that of fraud or gross negligence.

Why was no gross negligence found?

The second limb of Article L. 133-23 offered the bank no more help: no fraud or gross negligence of the customer was “established or even inferred from the evidence produced”. The customer had not been dispossessed of his card, had not disclosed any security data, and no scenario of breach of his duty of care was documented.

The court takes care to answer an implicit objection: the delay between the transactions (29 June and 13 July 2023) and the report (2 August 2023). It notes that the customer “promptly informed his bank”, observing that, because of the deferred nature of the debit on his card, the first disputed payment appeared only on the statement issued on 26 July 2023. The obligation to inform the bank without delay under Article L. 133-17 of the Monetary and Financial Code runs from actual knowledge of the transaction, not from its recording date: the monthly statement being the first source of information for the holder of a deferred-debit card, a report made within the week following its issue was perfectly diligent.

On this point, the judgment usefully supplements the case law that refuses to infer gross negligence from the mere computer trace of the use of the PIN, even where the card itself was used, as the same court of appeal had already held in a case concerning a bank card theft abroad where the computer trace of the PIN was not sufficient to establish gross negligence.

What is the practical scope of this judgment for victims?

The judgment of 29 October 2026 is rich in concrete lessons for anyone facing a refusal to reimburse:

First, it confirms that the judge must examine the intrinsic quality of the logs produced by the bank. Empty columns, orphan timestamps, a validated transaction that cannot be found in the accounts, an unknown device: each of these flaws is enough to make the proof of authentication fail. Victims and their counsel therefore have every interest in dissecting the connection logs line by line; they often prove, as here, to be the most effective weapon against the bank that produces them.

Next, it recalls that invoking a commercial system (Secur’Pass, Certicode, 3D Secure or otherwise) does not amount to proof: what matters is the demonstration, for each disputed transaction, that two independent factors were combined from the enrolled device, without technical deficiency. Failing that, reimbursement is due, however sophisticated the system is alleged to be.

Finally, beyond the evidentiary ground, the banks’ technical obligations arising from the regulatory technical standards (RTS) supplementing PSD2 (strong authentication, transaction monitoring, anomaly detection) are a lever still underused by victims, which we detailed in our analysis of banks’ artificial intelligence as an argument for reimbursement based on the RTS and PSD2.

How can you effectively dispute an unauthorised transaction?

The first step is to report the transaction to your bank without delay, as soon as you discover it, through a channel leaving a written trace (secure messaging in the app, registered letter). The report must be made no later than thirteen months after the debit (Article L. 133-24 of the Monetary and Financial Code). In case of refusal, a detailed formal notice will start the running of interest, as in this case where interest runs from 28 December 2023.

Filing a criminal complaint is, on the other hand, not at all mandatory to obtain reimbursement: the regime of Articles L. 133-18 et seq. of the Monetary and Financial Code applies independently of any criminal proceedings, and a bank cannot make reimbursement conditional on the production of a complaint receipt. If the victim nevertheless chooses to file a complaint, he or she should say as little as possible: set out the bare facts (dates, amounts, disputed transactions), without hypotheses about the modus operandi or comments on his or her own conduct, which could be used against him or her. We detail these essential precautions in our article Bank fraud: what to say and not to say to your bank and in your complaint.

What should we take away from the judgment of 29 October 2026?

This judgment of the Paris Court of Appeal is an exemplary and particularly instructive application of the evidentiary regime for unauthorised payment transactions. It reaffirms that a bank refusing a reimbursement must produce complete technical proof: identification of the device, IP address, demonstration that two independent factors were combined, and perfect consistency between the authentication log and the account’s accounting records. The mere invocation of an in-house strong authentication system, even one called Secur’Pass, does not clear this threshold.

It also recalls that a judgment which reproaches the customer for not “establishing the fraudulent nature” of the transactions reverses the burden of proof, in direct contradiction with Article L. 133-23 of the Monetary and Financial Code. Victims whose claims were dismissed at first instance on this basis have every interest in having their file reviewed on appeal.

The firm LE BOT Avocat, a banking law lawyer in Paris, assists individuals and businesses who are victims of unauthorised payment transactions in their dealings with banks, from amicable dispute to court proceedings.

FAQ — Frequently asked questions