Transfer Scam: Bank Held Liable for Failure of Vigilance

What happened in this case?

An 80-year-old woman, who had held an account with Crédit Mutuel since 2014, went to a branch counter on 16 August 2017 to order a transfer of €40,000 to a company established in Great Britain. A month later, on 19 September 2017, she repeated the operation to the same company, this time for €83,000. In total, €123,000 left her accounts within a few weeks.

The customer believed she was investing in diamonds. She was in fact the victim of a scam set up through internet advertisements. Realising the deception, she filed a criminal complaint on 5 February 2018, then formally demanded that her two Crédit Mutuel branches (the one where the account was opened and the one she had visited) reimburse her. Faced with their refusal, she sued them before the Toulouse Court of First Instance (tribunal judiciaire).

At first instance, on 20 April 2023, the court ordered the two banks, in solidum, to pay the customer €49,200 for breach of their duty of vigilance and warning. The banks appealed. In the meantime, the customer died; her two sons took over the proceedings as heirs. The Toulouse Court of Appeal delivered its judgment on 12 May 2026.

Could the bank rely on the 13-month foreclosure period?

This was the banks’ first and most technical argument. One of them argued that the action was time-barred (forclose). It relied on Article L. 133-24 of the Monetary and Financial Code, under which a payment service user must report an “unauthorised or incorrectly executed” transaction within thirteen months of the debit, failing which the claim is foreclosed. The summons, however, had been issued well beyond that period.

The court first notes an inconsistency in the bank’s position: at the same time, it was asking the court to find that the transfer orders were authorised. Yet the foreclosure regime of the Monetary and Financial Code only concerns unauthorised or incorrectly executed transactions.

To decide the point, the court relies on a recent judgment of the French Supreme Court (Cour de cassation) (Cass. com., 15 January 2025, No. 23-15.437). That decision laid down a clear principle: where the bank’s liability is sought in respect of an unauthorised or incorrectly executed transaction, only the special regime of Articles L. 133-18 to L. 133-24 of the Monetary and Financial Code applies, which transpose Directive (EU) 2015/2366 on payment services, to the exclusion of any ordinary-law regime.

But the court draws the opposite reasoning from this for our case: conversely, where the transactions were authorised, this special regime does not apply, and the bank’s liability can only be sought on the basis of its ordinary contractual liability. Here, the transfers had indeed been ordered and signed by the customer: they were authorised. The 13-month foreclosure was therefore ineffective. The argument is dismissed.

What is the bank’s duty of vigilance?

The heart of the judgment concerns the interplay between two seemingly contradictory obligations borne by the banker.

On the one hand, the bank is bound by a duty of non-interference (devoir de non-immixtion). This principle prohibits it from interfering in its customers’ affairs and from judging the appropriateness of the transactions they order. In principle, it therefore does not have to carry out inquiries or demand supporting documents to make sure that a transaction is proper or prudent. The customer is free to dispose of their money as they see fit.

On the other hand, this duty “gives way”, in the court’s words, in the presence of apparent anomalies. This is the general duty of vigilance, based on the ordinary law of liability. Faced with an apparent anomaly, the bank must carry out additional checks and, in very specific cases, even refuse to participate.

The logic is therefore as follows: the banker does not have to monitor all of its customers’ transactions, but neither can it turn a blind eye to what “jumps out”. The whole difficulty lies in deciding where to set the cursor.

How is an intellectual anomaly characterised?

No material anomaly was alleged: the transfer orders were in due and proper form. It remained to be seen whether they were affected by an intellectual anomaly. The court carries out a concrete analysis, comparing the transactions with the customer’s usual behaviour.

It identifies a series of converging factors:

• Unusually high amounts: €123,000 in one month, whereas examination of the statements shows that the customer rarely made transfers, her day-to-day spending going through direct debit, cheque or card, for modest sums.
• An unusual foreign destination: a bank headquartered in the United Kingdom, whereas her usual payments never involved foreign institutions.
• Transactions that empty the account: the first transfer of €40,000 absorbed nearly 90% of the sums held, bringing the balance down to €4,375.51. The second required a top-up of €87,014.37 (from the surrender of a life insurance policy), which was in turn immediately absorbed.
• The close repetition of atypical transactions over a short period, mixing large debits and credits.
• The length of the relationship: the account having been open since 2014, the three years of hindsight were sufficient to measure how unusual these movements were.

The court sets out an essential line of reasoning: taken in isolation, each factor is not necessarily such as to raise an alert. It is their accumulation that constitutes the apparent intellectual anomaly. The customer’s age alone was not enough; but combined with the amounts, the destination and the break with her habits, the whole formed a body of obvious evidence.

Does the bank’s oral warning change anything?

The banks argued that they had orally warned the customer when she came to the counter. The argument backfires on them, for two reasons.

First, on the ground of evidence: the banks provide nothing establishing that this warning was actually given. Yet it is for the person relying on a fact to prove it. A mere assertion is not enough.

Second, and this is the most formidable argument, taken up from the first-instance judge: the very fact of relying on a warning tends to show that the banks were aware of the intellectual anomaly affecting these transactions. In other words, by saying “we had warned her”, the bank implicitly admits that there was indeed a need to warn her, and therefore that an anomaly called for a reaction. The court’s conclusion: the banks breached their duty of vigilance.

Why is the compensation only €24,600?

This is where the judgment proves markedly less favourable to the victim than it seems. Recognising the bank’s breach does not mean making good the entire loss.

The court recalls that the loss “can only be analysed as a loss of opportunity” not to make the transfers. The bank’s breach did not directly cause the loss of the funds: the scam caused it. The bank’s fault merely deprived the customer of an opportunity to be alerted in time and to give up on the transactions.

To set this fraction, the court takes into account the customer’s gross imprudence: she had invested on the strength of internet advertisements, without carrying out the slightest check. The court moreover notes “that it is not certain that a warning from the banks would have made her give up” those investments. This imprudence is held, “to a significant degree”, to be at the origin of the damage.

Result: the loss of opportunity is assessed at 20% of the damage. The award therefore falls from €49,200 (first-instance judge) to €24,600 (€123,000 × 20%). The court specifies in passing that the loss of opportunity is calculated on both transfers, and not on the second one only as one bank argued, because each one, on its own, constituted an apparent anomaly.

A Reasoning Favourable in Principle, Harsh on the Figure

From the victims’ point of view, this judgment calls for a nuanced reading. On principle, it is valuable: it confirms that the bank cannot take refuge behind its duty of non-interference in the face of a body of anomalies, and that an unproven oral warning backfires on it. It also neutralises the foreclosure argument, often raised against victims.

On the quantum, however, the 20% rate raises questions. Loss of opportunity is a tool of fairness, but its application leaves the judge a wide margin of discretion. Adopting such a low rate amounts to making the victim bear 80% of a loss for which the bank was nevertheless held partly liable. One may question the coherence of a system in which the bank, a professional bound by a duty of vigilance, sees its contribution capped by the imprudence of an 80-year-old customer who was manifestly vulnerable. For victims, the decisive issue thus shifts to demonstrating the loss-of-opportunity rate: everything must be done, upstream, to document that, properly alerted, the victim would indeed have given up.

What is the practical scope for scam victims?

Several concrete lessons emerge from this judgment for anyone who has been the victim of a transfer scam.

Identify the right basis. The first question is whether the transaction was authorised or not. If the victim herself validated the transfer (investment scam, “CEO fraud”, romance scam), the ground is that of ordinary liability and the duty of vigilance. If the transaction was triggered without her knowledge (hijacked login credentials, fake adviser fraud), the debate falls under the special regime of the Monetary and Financial Code, where other levers exist, in particular the obligations arising from the technical security standards (RTS) supplementing the Payment Services Directive, such as strong authentication and transaction monitoring.

Document the anomaly. Characterising the intellectual anomaly rests on the account statements. It is crucial to gather the banking history to show the break with usual account behaviour: nature of payments, amounts, recipients, frequency. It is the accumulation of evidence that persuades the judge.

Anticipate the debate on loss of opportunity. Obtaining recognition of the breach is only the first step. The battle over the amount is fought on the loss-of-opportunity rate. The more the victim can show that a clear warning would have made her give up, the higher that rate may be raised.

Conclusion

The judgment of the Toulouse Court of Appeal of 12 May 2026 forms part of a line of case law favourable to holding banks accountable in the face of scams. It confirms that the duty of vigilance takes precedence over the duty of non-interference as soon as a body of intellectual anomalies should have alerted the institution, and that the bank cannot content itself with relying on an unproven oral warning. But it also reminds us, severely, that the victim’s imprudence weighs heavily in the balance: the loss of opportunity, limited here to 20%, leaves the bulk of her loss to be borne by the customer. For savers who are victims of fraud, the lesson is twofold: the bank’s liability is real, but its recognition does not dispense with a rigorous strategy on the recoverable amount.

Frequently Asked Questions