Amiens Court of Appeal, Economic Chamber, 23 October 2025, No. 23/05055
🔑 Key Takeaways
- SIM swapping consists of obtaining a new SIM card linked to the victim’s number in order to intercept their bank validation codes.
- The resulting transfers are unauthorised payment transactions: the victim never consented to them.
- “Where the payment service provider chooses to take the risk of not using strong authentication, it must bear that risk without being able to invoke its customer’s gross negligence.”
- Being the victim of SIM swapping is not gross negligence: on the contrary, it demonstrates the fraudsters’ modus operandi.
- The Amiens Court of Appeal ordered Crédit agricole to reimburse €22,465, with interest at the statutory rate and capitalisation.
- The bank’s third-party claim against the telephone operator (Free Mobile) was dismissed, for want of proven fault on the operator’s part.
Contents ▼
- What is SIM swapping, the fraud that hijacks your number?
- How do fraudsters take control of your line?
- Why are transfers resulting from SIM swapping “unauthorised”?
- Is SIM swapping in itself gross negligence?
- What did the Amiens Court of Appeal decide on 23 October 2025?
- Can a bank that waives strong authentication escape liability?
- Is the telephone operator responsible for the fraud?
- What should you do if you are a victim of SIM swapping?
- FAQ: Frequently Asked Questions
What is SIM swapping, the fraud that hijacks your number?
SIM swapping is one of the most formidable frauds, because it attacks the link on which many bank security measures still rely: your telephone number. Once he controls your line, the fraudster receives in your place the SMS messages containing the validation codes sent by the bank. He can then add a beneficiary, validate a transfer, or even enrol your card on a mobile wallet, all while intercepting the codes meant to protect you.
SIM swapping is an account takeover fraud. The fraudster obtains from the telephone operator a new SIM card (or an eSIM) linked to the victim’s number, which transfers the line to his own device. He thus intercepts SMS authentication codes and targets a weakness in two-factor verification.
How do fraudsters take control of your line?
The typical scenario combines several steps. The fraudsters first gather personal information (often through prior phishing or a data leak), then present themselves to the operator, in a shop, at an interactive kiosk or through customer service, posing as the line holder in order to obtain a new SIM card. As soon as this SIM is activated, the old one is deactivated: the victim’s phone loses its network. From then on, all SMS messages, including bank codes, arrive with the fraudster.
🎣 Collection of personal data (phishing, leak, social engineering)
↓
📵 Request for a new SIM from the operator: the line switches over, the victim’s phone loses its network
↓
📩 Interception of SMS messages and bank validation codes
↓
🏦 Addition of beneficiaries and transfers from the online banking space
↓
⚖️ Unauthorised payment transactions → right to reimbursement
The victim, for their part, often notices nothing until they see the prolonged loss of network or the debits on their account. It is precisely this time lag that makes the fraud effective, and that explains why the legal response must be well understood.
Why are transfers resulting from SIM swapping “unauthorised”?
As with all impersonation frauds, the key to the reasoning is consent. The victim of SIM swapping neither added the beneficiaries nor validated the transfers: it was the fraudsters who acted, by intercepting codes intended for the victim. The transactions are therefore, by definition, unauthorised payment transactions.
This is a transaction to which the account holder has not given consent (Art. L. 133-6 of the Monetary and Financial Code (code monétaire et financier)). In the context of SIM swapping, the Amiens Court of Appeal stresses that “the use of identifiers (code, password received by SMS, etc.) is not sufficient to establish the user’s consent”.
The applicable regime is that of Articles L. 133-18 to L. 133-24 of the Monetary and Financial Code, to the exclusion of any other. The Court of Appeal recalls this at the outset: where the liability of a payment service provider is sought in respect of an unauthorised transaction, only this special regime applies. And this regime sets out a simple principle: the bank reimburses, unless it proves fraud or gross negligence on the customer’s part.
Is SIM swapping in itself gross negligence?
This is the banks’ reflex argument: “you were the victim of SIM swapping, so you must have disclosed your data, so you were grossly negligent”. The Amiens Court of Appeal categorically refuses this slide in reasoning.
Gross negligence is a particularly serious failure by the customer to protect their security data. It cannot be inferred from the mere fact that the payment instrument or the data linked to it were used: the bank must prove it concretely, and that negligence must be the main and preponderant cause of the transaction.
The victim, the court notes, did not validate the transactions and did not add the beneficiaries either: validation was carried out by a third party. Receiving a fraudulent email is not gross negligence either. Above all, the court sets a causation requirement that changes everything: gross negligence must be “the main and preponderant cause of the disputed transaction”. Yet in SIM swapping, the determining cause of the fraud is the hijacking of the telephone line and the failure of the security measures, not any lack of vigilance on the customer’s part.
What did the Amiens Court of Appeal decide on 23 October 2025?
The facts are emblematic. A company holding an account with Crédit agricole discovered four fraudulent transfers issued on the same day to the same beneficiary, for a total of €29,865. The bank managed to recover €7,400, but refused to reimburse the balance of €22,465, on the ground that the transactions would only have been possible after the customer disclosed its identifiers following phishing. The director’s telephone line had been the subject of SIM swapping: a fraudster had obtained a new SIM card from an interactive kiosk.
At first instance, the Commercial Court (tribunal de commerce) had dismissed the company’s claim. The Court of Appeal overturns that decision and orders the bank to pay. Its reasoning deserves to be followed step by step, as it offers a roadmap for victims:
→ The use of identifiers is not enough to prove the customer’s consent: the transactions are unauthorised.
→ It is for the court first to examine whether the transaction was executed using strong authentication.
→ The bank acknowledges that it did not use strong authentication for the transfers (only the addition of IBANs benefited from it).
→ “Where the provider chooses to take the risk of not using strong authentication, it must bear that risk without being able to invoke its customer’s gross negligence.”
→ Apart from the SIM swapping, the circumstances of the fraudsters’ actions remain unknown: the bank demonstrates no gross negligence.
→ Order to pay: €22,465, interest at the statutory rate from the formal notice, capitalisation of interest, and €5,000 in legal costs.
The message is unambiguous. A bank cannot, on the one hand, dispense with strong authentication for transfers and, on the other, blame its customer for the very fraud that this lack of security made possible. The risk it chose to run, it must bear.
Can a bank that waives strong authentication escape liability?
No, and this is the heart of the judgment. The Monetary and Financial Code requires the payment service provider to apply strong authentication when the payer accesses their account online, initiates an electronic payment or carries out a remote transaction involving a risk of fraud (Art. L. 133-44).
Arising from the PSD2 Directive, strong authentication relies on at least two independent elements from among: something the user knows (password), something the user has (phone) and something the user is (biometrics), designed so that the compromise of one does not undermine the reliability of the others. A simple code received by SMS, which can be intercepted through SIM swapping, does not always suffice to meet this requirement.
Article L. 133-19, V draws the consequence of this obligation: save for fraudulent conduct by the payer himself, the payer “bears no financial consequences if the unauthorised payment transaction was carried out without the payment service provider requiring strong authentication”. And the court adds a formidable point: even where the bank did use strong authentication, in order to escape liability it must not only prove the customer’s fraud or gross negligence, but also establish the infallibility of its own system.
This reasoning opens up an often neglected avenue: that of the bank’s technical obligations under the RTS standards (the regulatory technical standards supplementing PSD2), which govern strong authentication, transaction monitoring and the detection of abnormal patterns. A burst of transfers to an unknown beneficiary within a few hours presents pattern anomalies that a compliant monitoring system should have detected. This is a liability lever complementary to the reimbursement regime, still under-exploited by victims.
On the other hand, one should avoid basing a compensation claim on an alleged breach of anti-money-laundering vigilance obligations (AML/CFT): the French Supreme Court (Cour de cassation) holds that these obligations serve solely to combat money laundering and terrorist financing, and do not protect the customer’s private interests. The argument is best focused on the regime for unauthorised transactions and on the technical security obligations.
Is the telephone operator responsible for the fraud?
The question is legitimate, since it is the operator that issues the new SIM card to the fraudster. In the case decided in Amiens, the bank had in fact brought the operator (Free Mobile) in as a third party, hoping to make it bear the final burden. The court dismissed this third-party claim.
Its reasoning: to establish the operator’s liability, a concrete fault on its part in issuing the SIM must still be proven. Yet the bank did not establish the exact circumstances of that issue, whereas the operator demonstrated that it had put security measures in place (personal identifier and secret code for the subscriber area as well as for ordering a new SIM). Having been deceived by fraudsters who were misusing the subscriber’s personal data was not, in itself, enough to establish fault on the operator’s part.
The practical significance is twofold. For the victim, the essential point lies elsewhere: their natural counterpart for reimbursement is the bank, under the regime for unauthorised transactions, and not the operator. The final allocation of the burden between bank and operator is a debate between professionals that must not delay the customer’s compensation. This does not rule out, in other cases better documented on the conditions under which the SIM was issued, a fault of the operator being found: everything depends on the evidence gathered.
What should you do if you are a victim of SIM swapping?
Speed is even more crucial here, because the loss of network is often the first warning sign. Here are the reflexes to adopt.
1️⃣ If your line stops working for no reason, contact your operator immediately to check for a possible SIM change.
↓
2️⃣ Block your card and ask for online access to be blocked.
↓
3️⃣ Dispute the transactions in writing with the bank (registered letter), citing Articles L. 133-18, L. 133-19 and L. 133-44.
↓
4️⃣ File a complaint and keep the receipt.
↓
5️⃣ Gather the evidence: history of the loss of network, exchanges with the operator, statements, codes received.
↓
6️⃣ If the bank refuses, serve formal notice then consider legal action.
The strategic point to remember: ask the bank to state whether strong authentication was applied to the disputed transfers, and require it to produce proof. If it acknowledges, as in the Amiens case, that it did not use it for the transfers, its position becomes very fragile. And never sign a document acknowledging negligence: it is not for you to prove your prudence, it is for the bank to prove your fault.
Conclusion
The Amiens Court of Appeal judgment of 23 October 2025 is a strong decision for victims of SIM swapping. It enshrines a common-sense idea, long battered by refusals to reimburse: a customer cannot be blamed for a fraud that the lack of security at their bank made possible. SIM swapping is not customer negligence; it is the exploitation of a flaw that the bank was required to lock down. If you have seen your number hijacked and your account emptied, the regime for unauthorised transactions and the requirement for strong authentication are your best allies, and the case law now sides with you.
