Riom Court of Appeal (Cour d’appel), Commercial Chamber, 4 June 2025, No. 24/01384
🔑 Key Takeaways
- The card number (PAN), the expiry date and the card verification value (CVV) are not “personalised security credentials” within the meaning of Article L.133-4 of the Monetary and Financial Code (code monétaire et financier, CMF).
- The use of Secur’Pass to validate a transaction does not create an irrebuttable presumption of consent where the customer has been manipulated by a coordinated telephone fraud.
- A fraud combining phishing and telephone spoofing is regarded as social engineering of a level of sophistication that rules out gross negligence (négligence grave) on the part of the customer.
- Amount reimbursed: approximately €8,817, corresponding to the 4 disputed fraudulent transactions.
- Banque Populaire is ordered to pay even though the transactions were validated through the Secur’Pass mobile app.
Contents ▼
- What happened? The two-stage fraud
- Are card numbers “personalised security credentials”?
- Is Secur’Pass enough to prove the account holder’s consent?
- What did the Riom Court of Appeal decide?
- What is the significance of this judgment for victims of combined scams?
- Conclusion
- FAQ: Frequently Asked Questions
What Happened? The Two-Stage Fraud
The facts illustrate an increasingly widespread fraud technique, based on a sequence of two complementary manoeuvres.
Step 1: The Fake SNCF Connect Site and the One-Euro Payment
Phishing refers to a technique in which fraudsters create a convincing copy of a legitimate website or message (here, SNCF Connect) to induce the victim to enter their payment details.
The victim lands on a site that perfectly imitates SNCF Connect. To complete a transaction, they are asked to make a symbolic payment of one euro by entering their full banking details: card number (PAN), expiry date and card verification value (CVV). This one-euro payment is merely a pretext to harvest the card details.
Step 2: The Spoofed Call and the Secur’Pass Validation
Telephone spoofing is a technique that allows a caller to make a telephone number that is not their own appear on the recipient’s screen. The fraudster can thus display the official number of Visa’s fraud department, of the bank, or of any trusted organisation.
Shortly afterwards, the victim receives a call. The official number of the Visa card-blocking service appears on their screen. The voice introduces itself as an adviser from the fraud department. To “secure” their account, the victim is guided towards validating transactions via Secur’Pass. They believe they are validating “counter-cancellation” transactions but are in fact validating the fraudulent payments. Four transactions are executed for a total of approximately €8,817.
🔄 Diagram of the Combined Phishing + Spoofing Fraud
↓
📞 Phase 2: Spoofed call (Visa number displayed) → fake anti-fraud adviser
↓
📱 Phase 3: Manipulation: the victim validates via Secur’Pass to “secure” their account
↓
💸 Phase 4: 4 fraudulent transactions validated (≈ €8,817)
↓
✅ Bank ordered to pay by the Riom Court of Appeal (4 June 2025)
Are Card Numbers “Personalised Security Credentials”?
“Personalised security credentials” (données de sécurité personnalisées) are defined by Article L.133-4 of the CMF as the personalised features provided to a payment service user for authentication purposes. These are typically a PIN, a password for accessing the online customer area, or a one-time validation code. The specific function of these credentials is to authenticate the account holder.
The bank attempted to argue that the victim had committed gross negligence by disclosing their banking details on the fake SNCF site. The Riom Court of Appeal rejects this argument: card numbers (PAN, expiry date, verification value) are card data, not personalised security credentials within the meaning of Article L.133-4 CMF. Disclosing them does not, in itself, amount to disclosing data that allows authentication in the legal sense.
This distinction has direct consequences: if card numbers are not personalised security credentials, disclosing them to a fraudulent site cannot be characterised as gross negligence under Article L.133-19 CMF. The ground of gross negligence partly collapses.
Is Secur’Pass Enough to Prove the Account Holder’s Consent?
Secur’Pass is the strong authentication app offered by the banks of the BPCE group. It allows sensitive transactions to be validated by entering a PIN or using biometrics. It is a strong authentication device within the meaning of PSD2.
The Court dismisses the bank’s argument. Strong authentication via Secur’Pass shows that the app was indeed used on the account holder’s phone, but does not show that the holder acted freely and with full knowledge of the facts. Where a fraudster has convinced the victim that validating these transactions was necessary to protect their account, the validation is tainted by a defect of consent (vice du consentement).
The Court draws a clear distinction between technical authentication (Secur’Pass was used on the customer’s phone) and free and informed consent to the transaction (which the telephone fraud precisely vitiated).
What Did the Riom Court of Appeal Decide?
The Court orders Banque Populaire to reimburse all four fraudulent transactions, amounting to approximately €8,817, on two pillars: (1) the card numbers disclosed on the fake SNCF site are not personalised security credentials, so disclosing them is not gross negligence; (2) the validation via Secur’Pass carried out under the sway of sophisticated telephone manipulation does not constitute free and informed consent.
What Is the Significance of This Judgment for Victims of Combined Scams?
This judgment is particularly valuable for victims of scams combining phishing and telephone spoofing. This type of fraud is growing sharply: fraudsters have understood that it is more effective to get the victim to validate the transactions themselves via their strong authentication tool.
📊 What This Judgment Changes in Practice
✅ Secur’Pass validated under manipulation ≠ free consent → technical authentication is not enough to exonerate the bank
✅ Two-stage fraud = sophisticated social engineering → rules out the accusation of inexcusable carelessness
✅ Full reimbursement ordered → €8,817 reimbursed, with no sharing of liability
It should also be recalled that the Regulatory Technical Standards (RTS) of the European Banking Authority require banks to put in place mechanisms for monitoring and detecting abnormal transactions. This complementary lever, still little used in French litigation, deserves to be invoked systematically.
Conclusion
The Riom Court of Appeal’s judgment of 4 June 2025 settles two fundamental questions clearly: bank card numbers are not personalised security credentials, and validation via a strong authentication app does not prove the customer’s free consent where the customer has been manipulated by an elaborate telephone fraud.
The firm LE BOT Avocat supports victims of banking fraud, in particular those facing these sophisticated multi-stage scams. Contact us to analyse the remedies available.
