Société Générale’s claims were all dismissed. It failed to prove gross negligence on the part of our client, who was the victim of a fraud involving the spoofing of the bank’s telephone number.
Gross negligence ruled out
Uplifted penalties (L133-18)
April 2023. Our client receives a phone call. The number displayed is that of his bank, Société Générale. On the line, a person introduces himself as a "security agent", mentions a suspected fraud on his account, and asks him to call back on a "professional" number. The caller knows the account balance and how transactions work. Put at ease, our client cooperates. Within 10 days, €21,114.60 leaves his account in 8 fraudulent transfers.
Two and a half years of proceedings later, the Paris Commercial Court (Tribunal des activités économiques) has just ordered Société Générale to reimburse the stolen sums in full, together with the late-payment penalties uplifted by 15 points provided for by Article L133-18 of the Monetary and Financial Code (code monétaire et financier).
A Formidable Fraud: Telephone Spoofing
"Spoofing" consists of impersonating the telephone number displayed by the bank in order to put the victim at ease. In this case, the fraudster used this technique to obtain from our client his remote banking access codes, then a code received by SMS. He was thus able to enrol his own phone as a "security phone", and from there validate the fraudulent transfers himself via the "Pass sécurité".
The result: 8 transfers between 6 and 14 April 2023, for a total of €21,114.60, of which only €5,800 could be recredited through the bank recall procedure. That left €15,287.65 which the bank refused to reimburse.
The Legal Debate: Strong Authentication vs Gross Negligence
Article L133-19 V of the Monetary and Financial Code lays down a simple principle: if the bank does not require strong authentication, it must reimburse unauthorised transactions, unless the customer acted fraudulently. And even where strong authentication is present, the bank can refuse reimbursement only by proving the customer's gross negligence (négligence grave) (Article L133-19 IV).
Société Générale argued that the enrolment of the new "Pass sécurité" had been subject to strong authentication (phone + confidential code + SMS code), and that our client had committed gross negligence by disclosing his codes and by failing to react to the SMS notifications of the transfers.
The court carried out a careful analysis:
- On strong authentication: the court accepts that the bank provides sufficient evidence that the transactions were properly authenticated, recorded and accounted for, without any technical failure. A point for the bank, but not enough to exonerate it.
- On gross negligence: this is where the bank fails. The court finds that our client was the victim of a spoofing-type fraud relying essentially on the simultaneous transmission of his customer codes and of a validation code received by SMS. In this particular context, his conduct cannot be characterised as sufficiently negligent to engage his liability.
A Decisive Argument: The Alert Campaigns Post-Dated the Fraud
Société Générale put before the court the information campaigns it had launched to warn its customers about fraud techniques. But the court notes that the specific alert on spoofing dates from June 2023, which is after the events of April 2023. The bank could therefore not criticise our client for failing to be vigilant against a technique of which it had not yet itself warned its customers.
Practical lesson: to be able to argue a lack of vigilance against its customer, the bank must first have informed him of the risks in good time.
The Uplifted Penalties of Article L133-18: An Often-Overlooked Lever
Where the bank does not reimburse an unauthorised transaction by the end of the next business day (unless it notifies the Banque de France of its reasons for suspecting customer fraud), it owes its customer uplifted interest:
- Statutory rate + 5 points for delays of up to 7 days
- Statutory rate + 10 points for delays of between 7 and 30 days
- Statutory rate + 15 points beyond 30 days
In this case, the bank did not notify the Banque de France in writing of its suspicions of fraud. The court therefore applies the rate uplifted by 15 points from 18 April 2023, which is more than three and a half years of interest at nearly 22% a year. In total, roughly €11,500 in interest on top of the principal reimbursement, or nearly 75% of the principal. The final bill for the bank comes close to €28,000.
The Decision
By judgment of 2 October 2026, the Paris Commercial Court:
- Orders Société Générale to pay €15,287.65 in reimbursement of the fraudulent transfers;
- With uplifted late-payment penalties (Article L133-18 CMF, last paragraph) from 18 April 2023;
- Dismisses all of Société Générale's claims;
- Orders Société Générale to pay €1,500 under Article 700 of the Code of Civil Procedure (code de procédure civile);
- Orders it to bear all costs.
The only disappointment: the court dismisses our client's claim for €3,000 for non-material loss (préjudice moral), considering that the reimbursement and the uplifted penalties already constitute sufficient compensation.
Please note: this judgment was delivered at first instance and is not final. Société Générale has the statutory appeal period, running from service of the judgment, to bring the matter before the Paris Court of Appeal.
What to Remember If You Are the Victim of Banking Fraud
- Spoofing is not gross negligence. When a fraudster impersonates your bank's number and puts you at ease with information he is not supposed to know, your conduct is assessed in light of that deception, not in the abstract.
- The bank must prove gross negligence: you do not have to prove your good faith. And that proof is hard to provide in a well-orchestrated spoofing scenario.
- The bank's alert campaigns must pre-date the events. If the bank warned you about a fraud technique after you fell victim to it, it cannot hold anything against you on that basis.
- Remember the uplifted late-payment penalties of Article L133-18 CMF. They can represent very substantial sums: here, 75% of the principal. It is a lever to be exploited systematically.
- Act quickly. As soon as you notice a transaction you did not authorise, block your account, file a complaint, and notify your bank by registered letter.
