Stolen Bank Card Abroad: The Computer Trace of the PIN Is Not Enough to Establish Gross Negligence (CA Paris, 16 April 2026, No. 25/07690)

CA Paris, Pôle 4 ch. 9-A, 16 April 2026, No. RG 25/07690 (Unreported)

What Is the Context of the Judgment of 16 April 2026?

Fraud involving bank cards stolen abroad has, since the entry into force of Directive (EU) 2015/2366 (PSD2) and Delegated Regulation (EU) 2018/389, been one of the most frequent types of dispute. The pattern has become a classic: the card disappears in circumstances of which the holder is not immediately aware, several transactions are executed in rapid succession while the cardholder is unavailable, and the bank then relies on the technical regularity of the authentication (PIN entered, chip read, sometimes entry of an additional factor) to refuse any reimbursement.

The judgment of 16 April 2026 follows precisely this pattern: a card stolen during a hospital stay in Turkey, twenty-seven fraudulent transactions in four days, and a bank invoking three distinct acts of negligence by the holder to escape all liability. The Court of Appeal rejects this argument and confirms the reimbursement, recalling two useful principles for the whole body of stolen card disputes.

What Were the Facts Before the Court of Appeal?

The holder of a bank account opened with a major French bank was hospitalised in Turkey between 6 and 10 January 2023. During this period, her bank card disappeared. Between 6 and 10 January 2023, twenty-seven transactions were recorded on her account using this card, for a total of €6,785.26: three contactless payments, twelve purchases made by entering the PIN and twelve cash withdrawals.

As soon as she was discharged from hospital, on 10 January 2023, the holder contacted her bank adviser by SMS to report the theft and stop her card. On her return to France, she filed a complaint on 16 January 2023 with the police station near her home, describing the theft committed during her hospital stay. By writ of 20 September 2023, she summoned her bank before the Paris Court of First Instance (tribunal judiciaire de Paris) for reimbursement of the disputed transactions.

By judgment of 2 April 2025, the Paris Court of First Instance ordered the bank to reimburse €6,785.26, together with interest at the statutory rate increased by fifteen points, and to pay €300 under Article 700 of the Code of Civil Procedure (code de procédure civile). The bank appealed.

What Were the Opposing Positions of the Bank and the Customer?

Before the Court of Appeal, the bank argued that it had complied with all of its obligations to secure the payment instrument. It relied on the exemption from strong authentication provided for contactless payments by Article 11 of Delegated Regulation (EU) 2018/389. For the other transactions, it relied on the entry of the PIN as proof both of authentication and of the absence of technical failure. It attributed three cumulative acts of negligence to the holder: failure to keep the card safe, as it was left in the hotel room, failure to keep the PIN confidential, which in its view had necessarily been disclosed to a third party, and failure to react promptly in monitoring the account.

The holder replied that the summary table produced by the bank as exhibit No. 2 had no probative value, being merely a document drawn up by the bank for the purposes of its defence. She denied any negligence in the safekeeping of the card or the confidentiality of the PIN, recalled her hospitalisation and the impossibility of monitoring her account in that context, and argued that the mere use of the PIN was not sufficient to establish fault on the part of the cardholder.

What Does the Paris Court of Appeal Hold?

The Court of Appeal upholds the judgment under appeal in all its provisions, with one exception: it removes the fifteen-point increase in statutory interest applied by the court of first instance and substitutes the simple statutory rate, running from the appeal judgment alone. The bank is also ordered to pay €500 under Article 700 of the Code of Civil Procedure for the appeal proceedings, and the costs.

Why Does the Court Confirm the Reimbursement?

Citing Articles L. 133-3, L. 133-4, L. 133-6, L. 133-7, L. 133-16, L. 133-17, L. 133-18 and L. 133-19 of the Monetary and Financial Code, the Court of Appeal applies the classic allocation of obligations between the bank, which must ensure that the personalised security data is inaccessible and prevent any use after notification, and the user, who must safeguard the security of their data and notify their bank as soon as they become aware of a loss, theft or unauthorised use.

The court rejects in turn each of the three grounds of negligence relied on by the bank. It first notes that nothing casts doubt on the reality of the theft committed in Turkey, attested by the SMS of 10 January 2023 to the bank adviser and by the police complaint of 16 January 2023. It then holds that the mere computer trace of use of the PIN, produced by the bank, is not sufficient to establish that the holder had authorised the transactions or that she had committed gross negligence. Finally, it recalls that the circumstances of the card’s disappearance (a hospital stay abroad) do not amount to a serious breach of the safekeeping obligations, and that the holder cannot be criticised for not having kept her card at the place of hospitalisation, whose level of security did not exceed that of the hotel room.

On these grounds, the court confirms the order to pay €6,785.26.

Why Does the Court Overturn the Increased Interest?

The court of first instance had attached to the principal award interest at the statutory rate increased by fifteen points. The court overturns this point and applies the simple statutory rate, running from the appeal judgment alone, without further explanation in its reasoning.

This overturning calls for measured criticism. Article L. 133-18 of the Monetary and Financial Code requires the bank, in the event of an unauthorised payment transaction reported by the holder, to immediately reimburse the sums debited. Breach of this obligation of immediate reimbursement gives rise to a statutory increase, calibrated by Article L. 133-18 on the model of the late payment penalties applicable to credit institutions. Where the delay is prolonged, as in the present case, the accumulation of increases can reach significant levels: this is precisely what the court of first instance had applied in using a rate increased by fifteen points.

By overturning this point and applying the simple statutory rate from its judgment alone, that is to say by depriving the holder of interest for the earlier period and removing the statutory increase, the Court of Appeal deprives itself of the sanction provided by the legislator for delay in reimbursement. The precise legal basis for this overturning may be questioned, given that the principal award is confirmed and the conditions for applying the statutory increase appeared to be met at first instance. The reasoning on this point deserves to be clarified. Legal commentators will no doubt note the questionable nature of this partial removal of the sanction.

What Does It Contribute on Proof and Gross Negligence?

The central contribution of the judgment, and the one that makes it useful well beyond the case at hand, lies in the reasoning on proof of gross negligence. The court sets out, with great clarity, three propositions worth retaining for all stolen card fraud cases.

Why Is the Computer Trace of the Code Not Enough?

The court expressly states that the fact that the transactions were carried out using the card with entry of the PIN, which the bank establishes from the computer traces it produces, is not sufficient, by itself, to establish that the holder authorised these transactions or that they committed gross negligence. This statement is essential: it prevents the bank from simply producing the technical logs of the transaction to close the debate.

The logic is implacable. Article L. 133-23 of the Monetary and Financial Code places the burden of proof of authentication and of the absence of technical failure on the bank. But this technical proof does not exhaust the discussion: the bank must still demonstrate, in order to defeat reimbursement, either fraudulent conduct by the holder or their established gross negligence. The trace of the entry of the PIN is only an indication; it does not dispense with demonstrating fault on the part of the cardholder.

How Can the Code Be Captured Without a Careful Cardholder’s Knowledge?

The court goes further and states a highly useful technical principle: it is perfectly possible to capture, without the holder’s knowledge, the PIN of a bank card during ordinary, non-negligent use of it, even where the holder had taken all useful precautions, and then to succeed in stealing that card. This, adds the court, is precisely what explains the wording of the above-mentioned provisions of the Monetary and Financial Code.

This ground has considerable scope. It removes the argument, long put forward by banks, that the concomitance of the use of the card and the PIN necessarily gives rise to a presumption of disclosure by the cardholder. The court affirms on the contrary that this concomitance is compatible with normal and careful use: a hidden camera above a cash machine, a skimming device, shoulder surfing, or later compromise of the card by a third party who had previously observed the PIN.

Does a Hospital Stay Abroad Justify a Failure to Safeguard the Card?

The court then examines the precise circumstances of the card’s disappearance. It notes that these circumstances (a hospital stay abroad) do not allow, in the absence of additional evidence, a serious breach of the safekeeping obligations borne by the holder to be established. The court adds that the theft could not have been detected before the payment, and that the holder cannot be criticised for not having kept her card at the place of hospitalisation, whose level of security did not exceed that of the hotel room.

On the alleged inertia, the court notes that the holder contacted her bank on the very day she discovered the disappearance, which does not reveal any culpable inertia, and that she cannot be criticised for not having checked her account balance while she was hospitalised. This in concreto assessment is valuable: it recognises that the diligence expected of the cardholder must be assessed in light of their actual situation, and not of an abstract standard of permanent monitoring of the account.

What Criticism Can Be Made of the Overturning of the Increased Interest?

While the rigour of the reasoning on gross negligence deserves praise, the overturning of the increased interest merits, as stated, measured criticism. Three points raise a difficulty.

First point: the legal basis of the increase. Article L. 133-18 of the Monetary and Financial Code does not merely require immediate reimbursement of unauthorised transactions: it attaches to this obligation a penalty for delay, by reference to the statutory increase mechanisms that apply where there is no spontaneous reimbursement. This penalty is not optional: it applies as of right, as soon as the bank fails to comply with its obligation of immediate reimbursement.

Second point: the internal consistency of the decision. The court fully confirms the order to reimburse and thereby acknowledges that the bank should have reimbursed without delay following the report of the theft in January 2023. Yet reimbursement took place neither amicably, nor at first instance within a short time, nor, a fortiori, on appeal. The penalty for delay therefore appeared to apply in full.

Third point: the practical effect. By substituting the simple statutory rate from the appeal judgment alone for the fifteen-point increase applied by the court of first instance, the court deprives the victim of almost all of the interest that would have compensated for the immobilisation of the funds for more than three years. The penalty for failure to reimburse immediately is thus emptied of much of its substance.

The generalisation of this approach in stolen card disputes may be questioned. If the practice is confirmed, it would lead to an imbalance: the bank is penalised on the principal but, in practice, recovers the penalty for its own delay. Such a development would deserve, at the very least, explicit reasoning, which is lacking in the present judgment.

What Are the Practical Consequences for Victims?

Subject to the qualifications above, the judgment of 16 April 2026 remains, for the most part, favourable to victims of stolen card fraud. It consolidates two principles that can be used day to day in building a claim for reimbursement against the bank.

How Should the Claim Be Structured Before the Court?

The defence of a stolen card fraud victim benefits from being organised around three hierarchical axes.

Beyond the strict mechanism of Article L. 133-19, stolen card disputes can also draw on the technical obligations imposed on the bank by Delegated Regulation (EU) 2018/389 as a whole (transaction monitoring, detection of pattern anomalies, independence of authentication elements). A bank that failed to detect the cascade of twenty-seven transactions in four days on an account with radically different habits is exposed to having its civil liability engaged on this additional basis. This angle remains under-used and deserves to be systematically explored. A criminal complaint and a report to the public prosecutor retain their usefulness as evidence and for recovery, without constituting a civil basis for compensation.

What Urgent Steps Should Be Taken After a Card Is Stolen?

The judgment recalls, between the lines, that the holder’s diligence in reacting to the theft is assessed in concrete terms. Three steps must be taken without delay, as soon as the theft or disappearance of the card is discovered.

The traceability of each of these steps is essential: it is what will make it possible, before the court, to rebut the allegations of inertia or negligence by which the bank regularly attempts to extricate itself.

Conclusion: A Judgment That Is Useful for All Stolen Card Cases

The judgment of 16 April 2026 of the Paris Court of Appeal does not create new law. It applies, rigorously, the principles of the Monetary and Financial Code arising from the transposition of PSD2. But its practical interest lies in the clarity of its reasoning on two points frequently obscured in stolen card disputes: the computer trace of the PIN does not, by itself, amount to proof of gross negligence, and discreet capture of the code remains compatible with normal and careful use of the card. These two statements are directly transposable to all stolen card fraud cases and will usefully feed the submissions of victims.

The judgment does, however, have a real limitation: the overturning, without detailed reasoning, of the statutory increase in interest. On this specific point, legal commentators and the courts of cassation may usefully clarify the applicable regime. In the meantime, victims have an interest in formulating their claims for increased interest with precision, in expressly requesting that this increase be maintained in the event of an appeal, and in challenging any insufficiently reasoned overturning.

At the firm LE BOT Avocat, this type of judgment directly feeds the defence of individuals who are victims of fraud involving a card stolen abroad. The reasoning on the burden of proof and the limited scope of computer traces now systematically forms part of the architecture of the submissions made to the courts of fact.

FAQ: Frequently Asked Questions