Transfer Fraud: Rejection, Re-Issue and Foreign Bank Are Not Apparent Anomalies (Cass. com., 1 July 2026, No. 25-15.593)

French Supreme Court, Commercial, Financial and Economic Chamber, 1 July 2026, appeal No. 25-15.593

What Were the Facts of This Transfer Fraud?

Between 18 September and 20 October 2020, a customer of the Caisse d’épargne Loire Drôme Ardèche sent his bank four transfer orders to two accounts opened with banks located abroad. The transfers were executed. The customer then realised that he had been the victim of a fraud: the funds never served the purpose he had been led to expect.

He then sued his bank, not on the ground of unauthorised transactions (he had himself given the orders), but on the ground of breach of the duty of vigilance: the bank should have become alarmed and warned him. He claims reimbursement of the sums paid and damages.

The detail of the transactions, as it emerges from the judgment, is instructive. A transfer ordered on 24 September 2020 to a payment institution in France was rejected. On 30 September 2020, the customer issued a new order for the same amount, this time to a Spanish bank, using two different RIBs, and therefore to two distinct beneficiaries. On 20 October 2020, a transfer of €38,800 was cancelled and then renewed the same day for the same amount.

Why Did the Grenoble Court of Appeal Hold the Bank Liable?

By a judgment of 18 February 2025, the Grenoble Court of Appeal declared the bank contractually liable for the loss suffered by its customer to the extent of 70% and ordered it to pay him €72,699.20 with interest at the statutory rate.

The Grenoble judges noted a combination of circumstances. The transfers took place over a short period, in particular for the benefit of a foreign bank. The bank carried out no additional checks and did not urge its customer to be vigilant. According to the court, it should have done so after the rejection of a first transfer followed by a new order for the same amount to another bank and using two different RIBs, and therefore to two distinct beneficiaries. The same reasoning applied to the transfer cancelled and replaced on the same day, which the bank allegedly executed without verifying that the cancelled transfer had indeed been recredited.

This approach, which consists in assessing globally the context of the series of transactions, is one that lower courts attentive to the situation of victims readily adopt. It rests on the idea that an attentive professional, seeing these incidents follow one another, should at the very least have asked a question.

Why Does the French Supreme Court Set Aside Article L. 133-21 in This Case?

This is a point that went somewhat unnoticed, but it deserves to be highlighted, because it is favourable to victims.

The bank had put forward a first ground, which has become a classic: the liability regime derived from Directive (EU) 2015/2366 (PSD2), transposed into Articles L. 133-18 to L. 133-24 of the Monetary and Financial Code, would exclude any competing regime based on national law; and Article L. 133-21 would exclude any liability of the provider where it executed the order in accordance with the unique identifier provided, even if that identifier corresponded to a fraudster’s account. We commented on this line of case law in connection with the judgment delivered the same day on IBAN substitution fraud, and the judgment of 20 May 2026 on the exclusivity of the PSD2 regime.

Here, the French Supreme Court rejects this ground in a single sentence: “Mr [Z] not having disputed before the Court of Appeal that he had authorised the disputed transfers, nor alleged that the beneficiary accounts of the transfers were not those appearing on the unique identifiers he had given to the bank, Article L. 133-21 of the Monetary and Financial Code is consequently not applicable.”

In other words, where the customer acknowledges having authorised the transfers and does not claim that the funds went anywhere other than to the accounts designated by the IBANs he provided, we are neither in the case of an unauthorised transaction nor in that of a wrongly executed transaction. The PSD2 special regime is beside the point. The ground of the ordinary-law duty of vigilance is therefore open, and the bank cannot shelter behind the exclusivity of the harmonised regime.

This clarification is consistent with the position the Commercial Chamber has adopted in recent months, for example in its judgment of 25 March 2026 on crypto-asset investments, where it examines the ordinary-law duty of vigilance for authorised transfers. The message is twofold: yes, ordinary law applies to authorised transfers; but no, it is not easy to obtain its application.

On What Points Does the French Supreme Court Overturn the Court of Appeal?

The French Supreme Court upholds all three limbs of the second ground, all based on Article 1231-1 of the Civil Code. It recalls, three times, the same statement of principle: “The banker, bound by the obligation not to interfere in its customer’s affairs, must alert him only where there are apparent anomalies easily detectable by a normally diligent professional.”

Is the Rejection of a Transfer Followed by a New Order an Anomaly?

First censure. The bank argued that the rejection of the transfer of 24 September 2020 had a purely technical cause. The Court of Appeal had not examined this explanation. The French Supreme Court holds that “in so deciding, without examining, as it had been invited to do, whether the rejection of a first transfer followed by a new payment order did not result from a technical cause, the Court of Appeal failed to give a legal basis to its decision”.

The lesson is clear: the rejection of a transfer is not, in itself, a warning signal. If the rejection is explained by a technical incident (IBAN format, network unavailability, ceiling), the fact that the customer re-issues the order to another account reveals nothing abnormal in the eyes of the Court.

Can the Judge Ignore the Documents Produced by the Bank?

Second censure, evidentiary in nature. The Court of Appeal criticised the bank for having executed the transfer of 20 October 2020, cancelled and then renewed, without verifying that the cancelled amount had been recredited. Yet the bank produced an account statement showing that the sum of €38,800 had been debited, credited, then debited again, which established that it had re-executed the order only after the funds had returned. The French Supreme Court censures the Court of Appeal for not having examined this statement.

It is a reminder of method: the trial court cannot find an anomaly without examining, at least summarily, the documents that contradict it.

Are a Short Period and a Foreign Bank Enough?

Third censure, the most general. The Court of Appeal had relied on the fact that the customer had ordered several transfers over a short period, in particular for the benefit of a foreign bank. For the French Supreme Court, these are “grounds unsuited to establishing apparent anomalies”.

The judgment is set aside, except insofar as it rejects the claim for compensation for non-pecuniary loss, and the case is referred back to the Chambéry Court of Appeal (cour d’appel de Chambéry). The customer is ordered to pay the costs and to pay the bank €3,000 under Article 700 of the Code of Civil Procedure (code de procédure civile).

What Is an Apparent Anomaly According to the French Supreme Court?

To understand why the Court sets the judgment aside, one must gauge how strictly the notion of apparent anomaly is understood.

The recent case law of the Commercial Chamber sets a very demanding standard. In its judgment of 4 February 2026 (No. 24-19.196), it clarified the assessment criteria. In that of 25 March 2026 (No. 24-18.093), it held that €95,294 of transfers to Belgium, in the context of a romance scam, were not enough to establish an anomaly. The judgment of 1 July 2026 falls squarely within this line: neither the frequency, nor the foreign destination, nor the rejection followed by a re-issue are, alone or together, apparent anomalies.

Is This Severity Justified?

The firm defends victims of banking fraud. This judgment is unfavourable to them, and it would be dishonest to present it otherwise. But the criticism must target the reasoning, not the result.

Two RIBs for a Single Transaction: Really Nothing Abnormal?

The most debatable point of the judgment concerns the transfer of 30 September 2020. The Court of Appeal had noted that the customer had re-issued an order for the same amount “using two different RIBs for two distinct beneficiaries”. In other words, for a single economic transaction, two distinct beneficiary accounts were provided within a few days. The French Supreme Court treats this circumstance from the angle of the technical cause of the rejection, without asking what the change of beneficiary for a single payment reveals in itself. Yet, in the typical pattern of investment frauds, the frequent change of receiving accounts is precisely the signature of the fraud: fraudsters rotate accounts as they are closed or reported. A banking professional knows this. It is regrettable that the judgment gives no explanation on this point, which deserved at least some reasoning.

Is the Global Assessment Doomed?

The Court of Appeal had reasoned by a combination of indicators: no single element was decisive on its own, but their accumulation drew an abnormal profile. The French Supreme Court deconstructs this combination element by element and concludes that the grounds are “unsuited”. This analytical method is faithful to the classic conception of the apparent anomaly, which must be obvious at a glance. But it is out of step with the tools banks now have. The transaction monitoring systems required by the RTS technical regulation supplementing PSD2 work precisely through risk scoring and the combination of weak signals: new beneficiary, unusual country, atypical amount, repetition. To hold that a cumulation of signals cannot amount to an apparent anomaly is to ignore that these signals are, technically, already detected. This is an angle that victims would do well to develop further: not what a bank clerk should have seen, but what the bank’s alert system actually saw.

Who Bears the Risk of Fraud?

In the background, the judgment reflects a legal policy choice: for authorised transfers, the risk of fraud falls on the customer, save for an established fault of the bank. This choice is consistent with the principle of non-interference, but it leaves without redress victims whose manipulation was, for its part, perfectly detectable. The European legislature has moreover understood this: Regulation 2024/886 has required beneficiary verification since 9 October 2025, and the texts of the PSD3 and the Payment Services Regulation go further in the allocation of fraud risk. The 2026 case law judges facts from 2020 with 2020 tools; it does not prejudge what the standard will be for transfers ordered in 2026.

How to Build a Case Based on the Duty of Vigilance After This Judgment

The judgment does not close the door on the duty of vigilance. It hardens its conditions. Here, concretely, is what it requires.

Establish Each Anomaly Individually

It is no longer enough to line up circumstances. For each disputed transaction, one must identify the precise irregularity, explain why it was visible without investigation, and show how it contrasted with the usual operation of the account. A chronological table of the transactions, with the account history over the previous twelve months, is indispensable.

Anticipate the Technical Explanation

If a transfer was rejected, the bank will invoke a technical cause. The exact reason for the rejection (SEPA return code, system message) must be obtained at the pre-litigation stage and tested against the fraud scenario. If the reason is “account closed” or “unknown beneficiary”, the technical argument turns against the bank.

Demand the Production of Internal Documents

The judgment criticises the Court of Appeal for not having examined the statement produced by the bank. Symmetrically, the victim must request the production of the bank’s internal records: processing logs, alerts generated by the monitoring tool, history of calls with the adviser. An application under Article 145 of the Code of Civil Procedure can be considered before any proceedings.

Shift the Debate to the Alert System

Rather than arguing the anomaly that a bank clerk should have seen, it is often more effective to show that the bank’s detection system, mandatory under the RTS technical regulation, necessarily generated an alert, and to ask what it did with it. We developed this angle in connection with banks’ artificial intelligence as an argument for reimbursement. Note: anti-money-laundering obligations cannot be invoked for this purpose, the French Supreme Court having held that their sole purpose is the fight against money laundering and terrorist financing.

Choose Your Words From the Complaint Stage

In this case, the customer had not disputed having authorised the transfers. That is what made Article L. 133-21 inapplicable, but it is also what deprived him of the protective regime for unauthorised transactions. Depending on the circumstances of the manipulation, the characterisation as an unauthorised transaction can sometimes be argued. This choice is made at the very beginning, in the first exchanges with the bank and in the criminal complaint. We have devoted a guide to it: Bank Fraud: What to Say and Not to Say to Your Bank and in Your Complaint.

Conclusion: The Door Remains Ajar, but It Is Narrow

The judgment of 1 July 2026 confirms that the French Supreme Court admits an apparent anomaly only very sparingly: neither the repetition of transfers, nor their foreign destination, nor a rejection followed by a re-issue is enough, and the judge must respond to technical explanations and examine the bank’s documents. For victims, this is a hardening of the standard of proof.

But the judgment also provides a useful confirmation: for authorised and correctly executed transfers, Article L. 133-21 and the exclusivity of the PSD2 regime cannot be relied on against the customer. The ordinary-law duty of vigilance remains the right ground, provided one comes to it with a well-built case: chronology, account history, reasons for rejection, the bank’s internal documents and, increasingly, evidence on how its alert systems work.

If you have been the victim of a transfer fraud, the question is not only whether your bank “should have seen”. It is what it actually saw, and proving it.

FAQ: Duty of Vigilance and Authorised Transfers After a Fraud