Spoofing: The Bank Must Reimburse Despite Sécur’Pass Strong Authentication (TJ Lyon, 23 June 2026, No. RG 23/02724)

Court of First Instance (tribunal judiciaire) of Lyon, local and protection division (pôle de la proximité et de la protection), 23 June 2026, No. RG 23/02724

What Happened in This Fake Bank Adviser Case?

The facts are disarmingly ordinary, and that is precisely what makes this judgment so useful, since the scenario is repeated every day in France. On 23 December 2022, a customer of Caisse d’Épargne Rhône-Alpes received a telephone call from an individual claiming to belong to his bank’s anti-fraud department. The caller said he had detected fraud on the customer’s bank account and proposed, to remedy it, to renew the customer’s bank card and replace his login credentials.

A decisive detail: the number displayed on the customer’s telephone was 04.27.84.13.02, which is exactly the number of his bank branch in Meyzieu, as it appears on his account statements. Reassured by this display, the customer gave his caller the various codes he received by SMS on his telephone. What he did not know was that these codes in fact allowed the fraudster to transfer the Sécur’Pass application (Caisse d’Épargne’s strong authentication device) from his iPhone to an Android telephone that did not belong to him.

On 27 and 28 December 2022, four days after that transfer, seven card transactions were carried out without his knowledge: two payments to the Binance platform (€295 and €2,200), an Apple payment of €2,129, a first payment of €1,019, two transactions classified as “non-market” (€176.24 and €205.47) and a Darty.com purchase of €1,019. Total: €7,043.71.

On 28 December 2022, the bank itself sent its customer a message reporting a suspicion of fraud. The customer then noticed four transactions debited for €5,643 and blocked his card the same day. The next day, he discovered three further transactions for €1,400.71 and immediately made an online report to the national gendarmerie.

What followed was equally typical: by email of 29 December 2022, the bank rejected the claim for compensation on the ground that the transactions had been authenticated via the Sécur’Pass service and that it was for the customer to safeguard the security of his data. After a formal notice by registered letter of 9 January 2023 and a reminder on 6 March 2023, the bank repeated its refusal on 8 March 2023: it accepted that its customer had been the victim of a scam, but criticised him for having “failed to be vigilant” by revealing the confidential codes received by SMS. The customer then summoned it, on 4 May 2023, before the local and protection division of the Court of First Instance (tribunal judiciaire) of Lyon.

What Does the Monetary and Financial Code Say About Unauthorised Transactions?

The applicable regime is mandatory (d’ordre public) and remarkably protective of the payment service user. It rests on a precise architecture that the judgment recalls methodically.

What Is the Principle Laid Down by Articles L. 133-18 and L. 133-19?

In the case of an unauthorised payment transaction, reported under the conditions of Article L. 133-24 of the Monetary and Financial Code, the payment service provider immediately reimburses the payer the amount of the transaction (Article L. 133-18). This principle admits of only one exception: the payer is liable if the payer acted fraudulently or failed, intentionally or through gross negligence, to meet the obligations to keep personalised security data safe (Article L. 133-16) and to report without delay any unauthorised use (Article L. 133-17).

Article L. 133-19, II, of the same code further provides that the payer is not liable if the unauthorised transaction was carried out by misappropriating, without the payer’s knowledge, the payment instrument or the data linked to it, which corresponds exactly to the fake bank adviser fraud scenario.

Who Bears the Burden of Proof?

This is the cardinal point of this litigation, and the Lyon judgment recalls it forcefully by quoting Article L. 133-23 of the Monetary and Financial Code in full: where a user denies having authorised a transaction, it is for the bank to prove that the transaction was authenticated, duly recorded and accounted for and that it was not affected by a technical or other deficiency. Above all, the text adds that the use of the payment instrument as recorded by the bank is not necessarily sufficient to prove that the transaction was authorised by the payer, or that the payer committed gross negligence. It is for the bank, and the bank alone, to provide the evidence of the customer’s fraud or gross negligence.

Why Did the Court Hold That the Customer Had Not Consented to the Transactions?

The bank argued that the transactions had been “validated by strong authentication by means of a Sécur’Pass” and that, for that reason alone, they had to be regarded as authorised. The court dismisses the argument in three steps, with reasoning whose simplicity is its strength.

First step: the bank did not dispute the scam itself, which it moreover described as an “impersonation” (usurpation). Yet that scam precisely led to the transactions being carried out by means of a Sécur’Pass registered on a telephone that did not belong to the customer. One cannot, on the one hand, accept that the authentication device was fraudulently transferred to a third party’s device and, on the other, maintain that its use amounts to the consent of the account holder.

Second step: the court turns the bank’s own technical explanations against it. Caisse d’Épargne itself stated that any transfer of Sécur’Pass to a new telephone triggers a three-day security period (D+3) during which no transaction can be carried out with that tool. Yet the disputed transactions date from 27 and 28 December 2022, four days after the transfer made on 23 December: the fraudsters simply waited for the security period to expire. Far from exonerating the bank, this mechanism confirms that the transactions were indeed made from the third party’s telephone.

Third step: the customer’s promptness. He blocked his card as soon as he discovered the debits, which could only appear on his account on 28 and 29 December because of the delay in booking card payments. This speed of reaction, the court stresses, “demonstrates even more” the absence of consent. The judgment concludes that the transactions were carried out “by misappropriating, without his knowledge, the data linked to his bank card”, within the meaning of Article L. 133-19, II, of the Monetary and Financial Code.

Is Sécur’Pass Strong Authentication Enough to Prove Consent?

No, and this is one of the major lessons of the judgment. Two questions that banks are happy to keep confused must be clearly distinguished.

First question: were the transactions authenticated, recorded and accounted for without technical deficiency? On this point, the court acknowledges the bank’s position: the computer records produced show that the transactions were authenticated by means of Sécur’Pass and properly accounted for, which the customer, moreover, did not dispute.

Second question, radically distinct: does this authentication prove that the account holder consented to the transactions? The answer is no. Article L. 133-23, paragraph 2, of the Monetary and Financial Code states it expressly: the use of the payment instrument as recorded “is not necessarily sufficient in itself” to prove authorisation. Where the authentication device has been transferred to a fraudster’s telephone using codes obtained by manipulation, every “strong” validation comes from the fraudster, not from the customer. Strong authentication shifts the question; it does not resolve it.

The bank also argued that strong authentication “does not enable the bank to detect deceptions in which a customer authorises a transaction ordered by a malicious third party”. The argument is revealing: it amounts to acknowledging that the device presented to the customer as maximum security is structurally blind to the most widespread fraud scenario. It is also worth noting that the obligations arising from the RTS supplementing PSD2 (strong authentication, but also monitoring of unusual transactions) are an angle of attack still under-used in this litigation: a transfer of a security application followed, the day after the security period expired, by a burst of seven payments to crypto platforms and electronics retailers bears no relation to the usual usage profile of a personal account.

Does Spoofing Rule Out Gross Negligence by the Customer?

The bank had one last line of defence: gross negligence. Had the customer not, after all, given a stranger the codes received by SMS? This is where the Lyon judgment shows all its interest, by making a methodical application of the French Supreme Court’s case law.

How Does the French Supreme Court Assess Gross Negligence in Cases of Spoofing?

In a judgment published in the Bulletin on 23 October 2024 (Cass. com., 23 October 2024, No. 23-16.267), the Commercial Chamber of the French Supreme Court held that no gross negligence within the meaning of Article L. 133-19 of the Monetary and Financial Code can be attributed to an account holder who, contacted by telephone by a person posing as an employee of his bank whose number was displayed, uses the personalised security device at that person’s request. The Court noted there that the “spoofing” modus operandi had put the customer at ease and lowered his vigilance, which is lower when facing a telephone call than that of a person receiving an email, who has more time to spot anomalies. The Court of First Instance of Lyon takes up this reasoning almost word for word.

How Did the Court Apply This Framework to the Case?

The customer produced screenshots showing that on Friday 23 December 2022 he had received a call from 04.27.84.13.02, a number strictly identical to that of his Meyzieu branch appearing on his account statements. The court even carries out a small calendar demonstration to date the call with certainty from the older calls visible on the screenshot.

Since the number displayed corresponded to that of his branch, the court holds, the customer “legitimately believed he was dealing with a bank employee and therefore had his vigilance lowered”. Three circumstances further increase the effectiveness of the manipulation: it was a telephone call, leaving little time and few means to spot possible anomalies; the pretext invoked (a fraud in progress) necessarily placed the victim in an anxiety-inducing situation that heightened his lack of vigilance; and the disclosure of the codes had, in the customer’s mind, the sole aim of remedying that supposed fraud. The disclosure of the confidential codes “cannot be held against him”, the judgment concludes.

Are the Bank’s General Warnings Enough to Establish Negligence?

The argument deserves a closer look, because every bank raises it. Caisse d’Épargne argued that it had circulated to users of its Direct Écureuil service security instructions on fraud, which the customer was said to have ignored. The court answers with a very clear distinction: these general instructions are irrelevant, because the method used here (impersonating a bank employee, “almost undetectable for a normally attentive user”) is distinct from the classic fraud scenarios covered by those warnings. And the court concludes: “in the absence of proof of specific warnings about spoofing, it cannot consider that [the customer] was informed of this practice”.

In other words, a bank that wants to set against its customer his supposed knowledge of the risks must show that it warned him about the precise technique of which he was a victim, and did so before the events. A generic “security tips” page on the bank’s website is not enough.

How Did the Fraud Unfold, Step by Step?

What to Do If You Fall Victim to a Fake Bank Adviser?

This judgment confirms that a victim of spoofing has strong arguments for obtaining full reimbursement of the fraudulent transactions, even where the victim personally disclosed security codes. The case still has to be built in the right order.

The first priority is to report without delay: block the card as soon as you discover the transactions and notify the bank of your dispute, as Article L. 133-17 of the Monetary and Financial Code requires. In our case, the customer’s promptness (blocking the card the same day as the alert, reporting to the gendarmerie the very next day) was expressly taken by the court as an indication of the absence of consent.

The second step is to preserve the evidence: screenshots of the call log showing the spoofed number (a decisive exhibit in this case, since it made it possible to establish the spoofing), SMS messages received, account statements showing the branch’s number, and emails from the bank. It is this body of evidence that will make it possible to show that the number displayed was that of the branch and that the victim’s vigilance was legitimately deceived.

Third step: the request for reimbursement based on Articles L. 133-18 et seq. of the Monetary and Financial Code, then, in case of refusal, a formal notice and legal proceedings. Be careful, however: what you write to your bank and in your complaint may be decisive for what follows. A clumsy turn of phrase (“I validated the transaction”, “I gave my codes”) will systematically be exploited by the bank to argue gross negligence. Before making any statement, read our full guide: Bank Fraud: What to Say and Not to Say to Your Bank and in Your Complaint.

Finally, note that the starting point for interest at the statutory rate was set at the date of the summons (4 May 2023) and not at the formal notice of 9 January 2023: the victim did not produce the acknowledgment of receipt that would have dated receipt of his registered letter. Practical lesson: keep the acknowledgment of receipt of your formal notice carefully, or you risk losing several months, even years, of interest.

What Is the Significance of This Judgment?

This judgment of the local and protection division of the Court of First Instance of Lyon is a first-instance decision, unreported, delivered at first instance (en premier ressort): it is therefore open to appeal and does not in itself have the value of a binding precedent. Its value lies elsewhere: it shows how the lower courts have embraced the French Supreme Court’s case law of 23 October 2024 and now apply it beyond its original case.

It must be stressed that the judgment of 23 October 2024 concerned transfers validated by the customer himself through his security device, at the fraudster’s request. The Lyon case has a different profile: transfer of the strong authentication application to the fraudster’s device, then bank card payments made without any intervention by the victim. The court transposes the spoofing analytical framework to this scenario without difficulty, and adds two remarkable contributions: the requirement of specific warnings about the fraud technique at issue, and the neutralisation of the argument based on strong authentication where the device itself has been hijacked.

For victims, the message is encouraging: neither the validation of SMS codes under the influence of manipulation nor the “strong authentication” label brandished by the bank stands in the way of reimbursement, once spoofing is established. For banks, the bill is clear: unless they prove gross negligence (proof for which they alone bear the burden), they must reimburse, and generic information campaigns will not exonerate them.

FAQ: Your Questions About Fake Bank Adviser Fraud