Unauthorised Transactions: The Bank Must Prove Authentication (Angers Court of Appeal, 29 September 2026, No. 21/02526)

Angers Court of Appeal (cour d’appel), commercial chamber, 29 September 2026, No. 21/02526

What are the facts behind the dispute?

The customer held a current account with the Caisse régionale de Crédit agricole mutuel de l’Anjou et du Maine, on which a Mastercard-type bank card was operated. On 17 September 2018, she blocked the card. Between 26 April and 19 September 2018, 331 payment transactions had been recorded on her account, causing a loss that she put at €10,745.20.

She filed a criminal complaint for fraud (escroquerie). In it she stated that she had been the victim of purchases made on the internet using her card numbers, without having used the card or consulted her accounts during a stay in Turkey from 9 May to 13 September 2018. She also stated that she had remained in possession of her card.

Criminal proceedings followed. By a judgment of 14 January 2019, the Angers Criminal Court (tribunal correctionnel) found a man guilty of handling the bank card numbers of several victims, including the customer’s, and of taking her card from her. On the civil claims, the judgment of 18 September 2020 ordered him to pay the customer €10,745.20 for her material loss. The customer explained that she had been unable to recover this sum.

From 2019, she claimed reimbursement of her entire loss from the bank, without success. She then sued the bank before the Court of First Instance of Angers (tribunal judiciaire), relying on Articles L. 133-18 et seq. of the Monetary and Financial Code (code monétaire et financier). The court dismissed her claim in 2021, holding that she had to bear the consequences of gross negligence. She appealed.

The Court of Appeal overturned that judgment, except as to the dismissal of the claim for damages for abusive resistance. It ordered the bank to pay €10,745.20 with interest at the statutory rate from 23 November 2018, as well as €3,000 under Article 700 of the Code of Civil Procedure (code de procédure civile), together with costs.

Is a card fraud necessarily an unauthorised transaction?

Not necessarily, but the distinction is decisive. The regime protecting the account holder applies only to unauthorised transactions, that is, those to which they did not consent.

The court notes that the customer denied being the author of the transactions. Yet the transactions were made using her card numbers, by a person who had been found guilty of handling them. The court’s reasoning is therefore as follows: the payments were initiated by that third party, not by the customer, as regards both their beneficiaries and their amounts. They constitute unauthorised transactions.

There is, however, an exception to this characterisation, and it is instructive. A purchase of €28.50 made from SNCF on 26 April 2018 was held to be consented to. The customer had not ruled out being its author, stating that she might have made this purchase with her daughter before leaving. The court inferred that she had consented to it. A single uncertainty of this kind is therefore enough to take a transaction outside the protective regime, and the customer lost this €28.50.

In total, the sum of €10,716.70, that is €10,745.20 less €28.50, was regarded as falling under unauthorised transactions.

What must the bank reimburse, and from what date?

Article L. 133-18 of the Monetary and Financial Code requires the payer’s payment service provider to refund the amount of an unauthorised transaction reported under the conditions of Article L. 133-24, and to restore the debited account to the state in which it would have been had the transaction not taken place. Reimbursement must be made without delay.

The question of the start date for interest is often debated. The customer argued that the bank should have credited her account again from 17 September 2018, the date she blocked the card, or at the latest from her detailed claim. The court adopts the second option and has interest at the statutory rate run from 23 November 2018, the date on which the customer sent the bank the detailed list of the disputed transactions.

This solution is important in practice: blocking the card does not, in itself, give rise to the claim for restitution. It is the detailed claim, accompanied by the disputed transactions, that fixes the start date for interest adopted by the judge.

Who must prove that the customer gave their consent?

The answer is clear: the bank. This is the heart of the judgment, and it is what distinguishes it from many disputes in which the financial institution simply produces account statements.

Article L. 133-23 of the Monetary and Financial Code lays down two principles. First, where the user denies having authorised a transaction that has been executed, it is for the provider to prove that the transaction was authenticated, duly recorded and accounted for, and that it was not affected by a technical or other deficiency. Second, the use of the payment instrument as recorded is not necessarily sufficient to prove that the transaction was authorised by the payer or that the payer was grossly negligent. The provider must supply evidence to prove fraud or gross negligence.

The court applies these provisions rigorously. Where a payment instrument comes with personalised security credentials, such as a PIN or a one-time code sent by SMS, Article L. 133-19 IV requires the bank to establish beforehand that the transaction was authenticated, duly recorded and accounted for, and that it was not affected by a technical deficiency. Without this proof, the bank cannot make the customer bear the loss.

In this case, the bank gave no explanation of the authentication method applicable to the disputed transactions. It showed neither how the payments had been authenticated, nor whether their nature required enhanced authentication. The general terms and conditions it produced provided that procedures vary according to the merchants and the types of payment, without the bank establishing which procedure had been followed for each transaction.

To explore further the question of proof of authentication and of the validation of transactions, the recent case law of the French Supreme Court (Cour de cassation) offers several markers, in particular on the question of consent to card payments.

Is authenticating a transaction the same as authorising it?

No, and the court says so expressly. The point deserves emphasis, because banks often reason as if the validation of a transaction by a code were enough to establish the account holder’s consent.

The court makes two complementary statements. The mere disclosure of the password allows the beneficiary to initiate a payment order, but it is not enough to establish the payer’s consent. Moreover, authenticating a transaction cannot be equated with authorising it.

The practical consequences are considerable. An enhanced validation system, whether a code received by SMS or a validation in an app, does not win the case for the bank as a matter of principle. It must demonstrate that the process worked for the specific transaction, that the code or validation was actually used, and that no technical failure occurred. A simple statement or a generic list of transactions is not enough to establish these points.

On how strong authentication is assessed in fraud disputes, see also a French Supreme Court judgment devoted to strong authentication, which illustrates the same requirement of proof.

Could the bank rely on its customer’s gross negligence?

The bank argued that the customer had been grossly negligent, giving rise to her own loss, which should have deprived her of any reimbursement. The court rejects this argument for a simple reason: the bank had not first demonstrated the authentication of the transactions. Without this proof, it could not benefit from the gross negligence exemption and had to accept the strict application of the protective regime.

The court goes further in its analysis, and its observations are interesting. It notes that the bank did not establish that the customer had disclosed her PIN to anyone. The record of the fraudster’s interview, which merely mentioned orders placed on the internet, did not describe the payment method used for all the purchases either. The criminal judgment gave no further detail on this point.

Moreover, the mere use of the code, where established, is not always enough to establish negligence: the French Supreme Court has already held that use of the code cannot, on its own, lead to that characterisation, as shown by its judgment of 26 March 2025 on gross negligence in relation to bank cards.

The only precise element concerned the €28.50 SNCF purchase, for which the bank asserted that the PIN had been entered. The court notes that the institution produced nothing to corroborate this assertion, in particular as to the fraudster’s knowledge of the code. The assertion was therefore not established.

What difference does it make that the customer kept her card?

The customer stated that she had remained in possession of her card throughout the period. The bank could have used this point to argue negligence in safeguarding the payment instrument. The bank did not raise it, and the court’s reasoning does not rest on this question.

The judge notes that the transactions were carried out using, if not physically the card, data associated with that payment instrument. The judge finds that the bank does not demonstrate the process that made each of the transactions possible. In other words, what the bank lacks is not proof of possession of the card, but proof of authentication and of the use of personalised security credentials.

This approach avoids a common trap: the debate over safekeeping of the card must not obscure the central question, that of proof of the payment process. The customer does not have to demonstrate that she did nothing wrong; the bank must demonstrate what it asserts.

What do contactless and remote payments tell us?

The court examines the methods of the transactions in detail. It notes that, according to the card’s pre-contractual information sheet, the contactless function is available without use of the personalised security credentials for payments of €30 or less. The general terms and conditions also provide for a maximum cumulative amount, beyond which entry of the PIN is required to reset the limit.

The amounts of the disputed transactions, ranging from €1.07 to €219.98, show that the fraudster was able to make low-value contactless payments, but also remote payments on websites, using the data shown on the card. The court also notes so-called recurring payments to the same merchants, which presuppose a first remote transaction validated by the disclosure of the card data.

These observations are not enough, however, to relieve the bank of its own burden of proof. For remote payments, the general terms and conditions refer to the merchants’ procedures, which may impose additional requirements beyond the verification of the data shown on the card. The bank did not indicate whether these requirements applied to the transactions in question, or how they had been met. Without this explanation, proof of authentication was not provided.

For the practitioner, the lesson is twofold. On the one hand, low-value contactless payments can be made without a code, which makes an argument of gross negligence relating to the code harder to sustain. On the other hand, remote payments call for a transaction-by-transaction analysis, which cannot be replaced by a generalisation.

Was the customer’s report late?

No. Article L. 133-24 requires the user to report an unauthorised transaction to their provider without delay, and at the latest within thirteen months of the debit date, on pain of being time-barred. The court finds that the customer complied with this obligation in good time by completing a claim form detailing the disputed transactions.

The calculation of the time limit is a point to watch. It runs from the debit date of each transaction, not from the overall discovery of the fraud. For the oldest transactions, dating from the end of April 2018, the thirteen-month period expired at the end of May 2019. The claim of November 2018 was therefore well within the time limit.

This point is, however, secondary in the scheme of the judgment. It was dealt with quickly, as the bank did not seriously contest it. Victims should nonetheless bear in mind that a late report can be raised against them and that a precise, dated claim is the best proof that the time limit was met.

Why did the claim for abusive resistance fail?

The customer claimed €4,000 in damages for abusive resistance, arguing that the bank had known since November 2018 that the transactions were fraudulent and had issued unjustified refusals, forcing her to take legal action. The court rejects this claim.

The reasoning is classic. It was not shown that the bank’s opposition to reimbursement amounted to a distinct, established fault, separate from the mere refusal to refund. The bank justified its refusal by the gross negligence it attributed to its customer, and the court does not hold that this refusal was abusive. The customer also did not substantiate her financial situation, which made it impossible to assess a separate loss.

The lesson for victims is clear: succeeding on the merits, that is, on reimbursement, does not automatically entitle you to damages. You must demonstrate an independent fault on the part of the bank and a separate loss, often linked to particularly dilatory refusals or unjustified pressure.

What does this mean for fraud victims?

This judgment should be read with caution. It comes from a court of appeal, has no normative value for other courts, and is classified as unreported. It does not change the law as it stands and creates no new rule. It applies the provisions of the Order of 9 August 2017, which transposed into French law Directive 2015/2366/EU, known as PSD2, to transactions carried out between April and September 2018.

Its contribution lies in its method. The court applies the rules of proof laid down by the Monetary and Financial Code in a demanding way. It refuses to presume authentication from the mere use of the card, and it refuses to presume negligence from the mere absence of proof of theft. The bank must demonstrate what it asserts, transaction by transaction.

This decision remains based on the exhibits in the file. A bank that produces detailed authentication logs, transaction by transaction, and that establishes the authentication method applicable to each payment, could obtain a different outcome. The scope of the judgment therefore depends on the quality of the evidence provided, which must be examined in each case.

An unreported decision: how can it be used in practice?

An unreported judgment can be cited in argument, provided that its reasoning is presented accurately and that it is not given a general scope it does not have. It is useful for recalling the structure of the burden of proof, the distinction between authentication and authorisation, and the requirement of a concrete explanation of the authentication method. It is less useful for establishing a general rule on the amount or the methods of contactless payments.

The sequel should also be watched. An appeal on points of law (pourvoi en cassation) remains possible within the statutory time limits, and any change in the French Supreme Court’s position on these questions should be followed. On the time limits to be observed, you can also read the French Supreme Court’s judgment of 2 July 2025 on the thirteen-month reporting period and the limitation period for bringing an action.

What should you do in practice if you are in the same situation?

Several practical lessons emerge from this case. The first concerns the report: it must be written, dated and detailed, with the precise list of disputed transactions, their dates, their amounts and their beneficiaries. In practice, it is this claim that fixes the start date for interest and proves compliance with the thirteen-month time limit.

The second concerns the request for an explanation. The victim can ask their bank, in writing, to specify the authentication method applied to each transaction, and to produce the evidence that demonstrates it. An evasive reply, or a mere reference to the general terms and conditions, is a clue to be exploited.

The third concerns statements. What is said to the bank and in a complaint must be accurate, consistent and complete, because it will be compared with the exhibits in the file. On how to present the facts to your bank and in a complaint without harming yourself, the firm has published a guide on bank fraud: what to say and not to say to your bank and in your complaint.

Finally, a criminal complaint is useful for identifying the perpetrator, but it does not dispense with proving the payment process before the civil judge. The criminal judgment here did not specify how the payments had been made. A distinction must therefore be drawn between the criminal finding of guilt against the fraudster and the civil proof of authentication.

What should be taken from this judgment?

The Angers Court of Appeal’s judgment of 29 September 2026 is a reminder that the protection of account holders against unauthorised transactions rests on a precise allocation of the burden of proof. The bank must establish authentication, recording and the absence of technical deficiency. It must also demonstrate the fraud or gross negligence that it raises against the customer, and it cannot do so by mere assertion.

For victims, the judgment offers a solid argument, provided that the claim is well documented and that the bank is asked for precise proof of the authentication method. For institutions, it is a reminder that an effective security system is not enough if it cannot be demonstrated to the judge, transaction by transaction.

Beyond the solution in this case, it is a lesson in method: in bank fraud matters, the question is never only who had access to the card, but how each payment was validated, and who must prove it.

FAQ: Unauthorised Bank Card Transactions