SIM Swapping: Bank Held Liable for Lack of Proof of Strong Authentication (CA Douai, 18 June 2026, No. 24/02174)

CA Douai, ch. 2 sect. 1, 18 June 2026, No. 24/02174

What Is SIM Swapping and How Did the Fraud Unfold?

A limited liability company (SARL), holder of a bank account opened with BNP Paribas, accessed its online banking space using its manager’s mobile telephone line, taken out in a personal capacity with the operator SFR. That telephone was used in particular to validate logins and transactions: an entirely common arrangement in small and medium-sized businesses, where the manager’s smartphone concentrates access to professional banking services.

It is precisely this concentration that the fraudsters exploited, using a now well-identified technique: SIM swapping.

The chronology adopted by the judgment is eloquent. On 23 October 2021, the manager received a series of text messages from his operator: one informed him that his request to change his “backup” email address had been registered, others that his new postal address had been taken into account, and a last one that an order for a new SIM card had been placed. The manager, who was behind none of these requests, took no action, thinking they were “spam” or errors. On 25 October, the operator confirmed the SIM card order and its dispatch within three working days.

On 27 October 2021, the bank sent an email reporting that a new beneficiary had been created and registered on the company’s business account. The manager, who was no more behind this action, tried to log in to his personal space to have the operation cancelled: access was refused. The next day, 28 October 2021, two instant SEPA transfers were issued from the company’s account to this unknown beneficiary: €4,951, then €6,958, making €11,909 in total. On 29 October, the manager filed a criminal complaint and claimed reimbursement from the bank, which refused.

A revealing detail: fraudulent bank card payments made on 27 and 28 October on the manager’s personal account were, for their part, reimbursed by the bank. The dispute therefore crystallised solely over the transfers issued from the company’s account, and it is this selective refusal that the Douai Court of Appeal now sanctions.

Why Had the Commercial Court Dismissed the Victim Company’s Claims?

By writs of 2 and 15 March 2023, the company brought proceedings before the Lille Métropole Commercial Court seeking an order of joint and several liability (in solidum) against the bank, on the basis of Article L. 133-18 of the Monetary and Financial Code, and against the telephone operator, on the basis of tortious liability under Articles 1240 et seq. of the Civil Code (code civil).

By judgment of 16 April 2024, the court dismissed all the claims. Its reasoning had two stages: first, the manager had allegedly been negligent in remaining unresponsive for several days despite “potentially abnormal” operations on his telephone line; second, the SIM card fraud was not in itself sufficient to activate the online banking service, since the personal and confidential data attached to it were also needed, and no fault by the bank that allowed those data to leak had been shown.

How Did This Reasoning Disregard the Applicable Statutory Regime?

The Court of Appeal immediately identifies the fundamental flaw in the judgment: the court “did not, however, rule in the light of the provisions of the Monetary and Financial Code applicable in the case of an unauthorised transfer, yet relied on by the company […] which lay down an exclusive liability regime”.

In other words, reasoning as the court had done, by looking for “negligent fault” on the part of the customer and “fault” on the part of the bank, amounts to applying an ordinary-law analytical grid to a matter that the legislature has entirely regulated. On this statutory ground, the burden of proof is allocated with remarkable precision, and it falls first on the bank.

What Did the Bank Have to Prove According to the Douai Court of Appeal?

The Court methodically sets out the architecture of the statutory regime, in three provisions.

Which Articles of the Monetary and Financial Code Apply to Fraudulent Transfers?

Article L. 133-18 of the Monetary and Financial Code lays down the principle: in the case of an unauthorised payment transaction reported by the user under the conditions provided for in Article L. 133-24, the payment service provider must immediately reimburse the amount of the transaction (at the latest by the end of the following business day) and restore the debited account to the state it would have been in had the transaction not taken place.

Article L. 133-19, IV, provides the exception: the payer bears all losses if they result from fraudulent conduct on their part or if they failed, intentionally or through gross negligence, to meet the obligations of Articles L. 133-16 (preserving the security of their personalised security data) and L. 133-17 (reporting without delay the loss, theft or misappropriation of their payment instrument).

Article L. 133-23, finally, governs proof: where a user denies having authorised a transaction, it is for their payment service provider “to prove that the transaction in question was authenticated, duly recorded and booked and that it was not affected by a technical or other deficiency”. Its second paragraph specifies that the use of the payment instrument as recorded by the provider “is not necessarily sufficient as such” to prove that the transaction was authorised by the payer or that the payer was grossly negligent.

The Court draws the following summary: a bank that intends to make its customer bear the losses “must also prove that the transaction in question was authenticated, duly recorded and booked and that it was not affected by a technical or other deficiency, and not merely show that the payment user failed, intentionally or through gross negligence, to meet the obligations referred to in Articles L. 133-16 and L. 133-17”. Proof of authentication is therefore a precondition: without it, the debate on the customer’s gross negligence need not even be opened.

Why Are the General Documents Produced by the Bank Not Enough?

This is the heart of the judgment, and its most concrete contribution for practitioners. Before the Court, the bank had put before it a set of documents describing its security mechanisms: extracts of fraud information distributed to its customers, presentation sheets for its authentication system, and a user guide for its online services.

The Court brushes aside this defence in a single sentence: “the bank confines itself to assertions about the authentication procedures it applies, to producing general documents on those procedures […] but it produces no specific document relating to the disputed transactions with a view to establishing that they were actually carried out in the manner it indicates”.

The Court then draws the consequence: the bank “thus does not prove that these transactions were actually subjected to a strong authentication procedure, duly recorded and booked, or that they were not affected by a technical deficiency, or that they were authenticated by the company […] itself”. The finding of this failure of proof is enough, on its own, to grant the reimbursement claim, in application of the provisions cited above.

The lesson is crystal clear: describing a security system is not proving its application. What the bank must produce are technical items specific to the disputed transactions (connection logs, authentication traces, time-stamps, identification of the terminal and channel used) making it possible to reconstruct, transaction by transaction, the authentication process actually followed. A sales brochure, however detailed, describes a mechanism in theory; it demonstrates nothing of what actually happened on the day of the disputed transfers.

This requirement is part of a case-law trend now well established before the lower courts, which increasingly refuse to be satisfied with general assertions about the robustness of banking systems and require the production of specific, precise and intelligible technical data.

Had the Victim Committed Gross Negligence?

The bank argued, in the alternative, that there had “necessarily” been disclosure of the login data by the company itself: only a voluntary communication of the identifier or digital key (which is not contained in the SIM card) would have allowed the fraudster to install the banking application on a new telephone and log in.

The argument is a frequent one: since the system is deemed unbreachable, if a fraud took place it is because the customer must have disclosed their codes. The Douai Court of Appeal rejects it with a formula worth preserving: “the user’s gross negligence cannot be inferred from the mere fact that the payment instrument or the personal data linked to it were used”.

This reasoning, stated “for the sake of completeness”, neutralises the banks’ circular syllogism: the fraudulent use of data does not prove culpable disclosure of it, since it may just as well result from a security flaw, an interception or, as here, the hijacking of the telephone line serving as an authentication factor. The court’s reasoning, which had blamed the manager for failing to react to the suspicious text messages for several days, is thus disavowed twice over: first because the question of negligence did not even arise as long as the authentication of the transactions was not proven, and second because gross negligence requires positive and concrete proof, not deduction.

Why Does the Telephone Operator Escape Any Liability?

The part of the judgment devoted to the telephone operator ends, for its part, with confirmation of the dismissal. The victim company, and the bank, which was looking for someone to stand as guarantor, argued that the operator had committed a fault by handing a new SIM card to a third party without verifying their identity.

But the telephone subscription had been taken out by the manager in a personal capacity: the company, a third party to the contract, could act only on tortious grounds, and had to prove a fault by the operator at the origin of its loss. Yet, the Court notes, nothing made it possible to determine precisely the circumstances in which the SIM card order had been placed: the bank itself envisaged several hypotheses, including an order via the operator’s customer area using login data that it is not known how the fraudster would have obtained. Nothing established that the operator could have been aware of an identity theft, or that it had failed to follow the delivery procedures provided for in the contract, whose special conditions were not produced. Finally, the Court stresses that the succession of text messages sent by the operator had precisely served to inform the subscriber of the abnormal operations on his line.

The claim against the operator is therefore dismissed, as is the third-party claim for indemnity brought by the bank. Strategically, the lesson is valuable: in SIM swapping frauds, an action against the telephone operator runs into a double obstacle: the frequent absence of any contractual link between the victim company and the operator (the subscription being in the manager’s name), and the difficulty of proving a fault in the issuing of the SIM card, the circumstances of which generally remain opaque. The action against the bank, for its part, benefits from the favourable evidential regime of the Monetary and Financial Code: that is where the essential battle must be fought.

What Does the Victim Company Actually Obtain?

The Court of Appeal reverses the judgment in its provisions concerning the bank and, ruling anew, orders the bank to pay the company €11,909, that is, the full amount of the two fraudulent transfers, with interest at the statutory rate from 28 November 2021, and orders the capitalisation of accrued interest due for a full year, in application of Article 1343-2 of the Civil Code.

The company also sought an increase of fifteen points in the interest rate: the Court rejects this claim, made “without any ground”. The reminder is useful: every claim, even an ancillary one, must be legally founded and reasoned in the submissions, failing which it is doomed to be rejected even if the principal claim is upheld.

The bank is finally ordered to pay the costs of both the first-instance and appeal proceedings, and to pay €3,000 under Article 700 of the Code of Civil Procedure. The order made at first instance in favour of the telephone operator (€1,000 under Article 700) is, on the other hand, upheld against the victim company, which had brought it into the proceedings: the downside of the procedural choice to sue the operator.

What Should You Do if Your Company Is the Victim of SIM Swapping?

The first hours and the first statements are decisive for the rest of the case. As soon as suspicious activity is discovered on the telephone line (text messages announcing a change of address, an unsolicited SIM card order, sudden loss of network), you must immediately contact the operator to have the line and the SIM card blocked, then the bank to block the account and report the unauthorised transactions, in accordance with Article L. 133-17 of the Monetary and Financial Code. The written report to the bank must be made without delay and kept: it starts the reimbursement period under Article L. 133-18.

Wording the dispute and the complaint is a delicate exercise: clumsy statements (admitting to having “validated” a transaction, to having communicated a code, or characterising one’s own inattention) are systematically exploited by banks to argue gross negligence. Before any written exchange with the bank and before filing a complaint, it is strongly recommended to read our practical guide: Bank Fraud: What to Say and Not to Say to Your Bank and in Your Complaint.

If reimbursement is refused, the judgment discussed sets out the litigation roadmap: demand from the bank proof, transaction by transaction, of strong authentication, recording and booking of the disputed transfers, and of the absence of technical deficiency. The obligations arising from Delegated Regulation (EU) 2018/389 (RTS), which supplements PSD2 as regards strong authentication and transaction monitoring, offer in this respect a still under-used line of attack: they provide the technical benchmark against which the bank’s justifications can be measured and, often, found wanting.

Conclusion

The judgment of the Douai Court of Appeal of 18 June 2026 does not innovate: it rigorously applies a statutory regime that the commercial court had simply ignored. That is precisely what makes it interesting. It recalls that fraudulent transfer disputes are not argued on the vague ground of fault and imprudence, but on the well-marked ground of Articles L. 133-18 to L. 133-24 of the Monetary and Financial Code; that the first question is never the customer’s negligence, but the proof (specific, technical, transaction by transaction) of authentication; and that banks which come to the hearing with brochures presenting their security systems expose themselves to being held liable for failure of proof. For businesses that are victims of SIM swapping, often dismissed at first instance in the name of a supposed self-evident truth (“you must have disclosed your codes”), this decision confirms that a well-constructed appeal, refocused on the statutory evidential regime, can completely reverse the outcome of the dispute.

FAQ: Your Questions on SIM Swapping and Reimbursement of Fraudulent Transfers