Unauthorised Transfer: It Is for the Bank to Prove, Not the Customer (Paris Court for Economic Activities, 1 April 2025, No. 2023067456)

What happened in this case?

A training company, holding a business account with BRED Banque Populaire, discovers that an online transfer of €14,901 was executed from its account on 6 January 2022, to an account located in Italy. The company states that it never ordered this transfer. As early as 11 January 2022, it filed a criminal complaint for misappropriation of funds.

The bank, after “analysing the file”, replied on 15 February 2022 that the transactions had been issued from the BREDConnect personal area, protected by “strictly personal” codes, and that it therefore could not reimburse. The complaint was dismissed on 14 April 2022, as the perpetrator could not be identified. On 28 June 2022, BRED confirmed its refusal. After a formal notice that went unanswered, the company summoned the bank by writ dated 8 November 2023.

Before the court, the company sought reimbursement of the €14,901 with interest at the increased statutory rate, €1,000 in damages for non-material loss and €3,000 in respect of legal costs. The bank, for its part, argued that the transaction had been “properly authenticated and therefore authorised” and could only have been carried out because of the customer’s “gross negligence”.

Please note: a new kind of court. The judgment comes from the Paris Court for Economic Activities, and not from a traditional “commercial court” (tribunal de commerce). Since 1 January 2025, twelve courts have been trialling this new name and an extended jurisdiction. On the merits, the reasoning applied to the banking dispute is the same as that which the commercial court would have followed.

Who must prove that a transfer was authorised?

This is the heart of the case, and the answer is unambiguous: the bank. Article L. 133-23 of the Monetary and Financial Code provides that “where a payment service user denies having authorised a payment transaction that has been executed […], it is for their payment service provider to prove that the transaction in question was authenticated, duly recorded and accounted for and that it was not affected by a technical or other deficiency”.

This provision goes even further, and this is decisive: “the use of the payment instrument as recorded by the payment service provider is not necessarily sufficient in itself to prove that the transaction was authorised by the payer or that the payer failed […] through gross negligence to fulfil their obligations”. In other words, the mere fact that the customer’s codes “worked” proves nothing: a full technical demonstration is required.

The court draws a logical consequence: the bank is “the only one holding the technical evidence” of the transaction. Placing the burden on the customer would amount to asking them for impossible proof. The customer therefore has nothing else to do but dispute the transaction; it is then for the bank to justify itself.

Can a clause in the general terms and conditions reverse the burden of proof?

BRED argued that its general terms and conditions contained a clause “providing for a presumption that the transaction was authorised by the payer as soon as their personal data has been used”. According to the bank, this clause shifted the burden of proof onto the customer.

The court firmly rejects this argument for two cumulative reasons, each sufficient on its own.

First, a reason of principle: it is “not possible to contractually introduce a presumption of regularity of the payment transaction that would have the effect of exempting the service provider […] from having to prove that the transaction was duly recorded and accounted for”. The rule in Article L. 133-23 is a matter of public policy (ordre public): it cannot be neutralised by a clause. A stipulation that would relieve the bank of its burden of proof is deprived of effect.

Second, a reason of fact: the bank “does not provide proof of the signature” of the general terms and conditions by the company. Yet general terms and conditions that the customer never accepted, and which the bank does not show were brought to its attention before the contract was concluded, are quite simply unenforceable against it (inopposables).

Is “strong authentication” enough to exonerate the bank?

This is the central argument of the banking defence in all these cases: “the transfer was subject to strong authentication, therefore it is authorised”. The court methodically dismantles this reasoning.

Strong authentication (or two-factor authentication) derives from the European PSD2 Directive (No. 2015/2366) and its delegated Regulation 2018/389, transposed in Articles L. 133-4 and L. 133-44 of the Monetary and Financial Code. It requires the combination of at least two elements from three categories: knowledge (a code, a password), possession (a phone, a card) and inherence (a biometric characteristic). For remote payments, an additional factor is required: a dynamic link between the generated code and the specific transaction (amount and payee), so that any change invalidates the code.

But it must also be proven. And this is where the bank fails. At the hearing, the judge questioned BRED’s representative on the scope of its exhibit No. 2, a “compilation of tables” supposed to establish authentication. The court finds that this document:

• is “a single document without title, signature or letterhead“, a simple compilation of tables that the bank “could very well have drawn up for the purposes of the case”;
• is not certified by an IT expert, even though it claims to be “the exact transcription of the technical traces”;
• does not demonstrate the enrolment of the devices used or their certain identification through technical data (IMEI number, IP address);
• gives “no indication of the identity of the beneficiary bank account details” nor of the conditions of its creation and authorisation;
• does not prove the absence of any technical deficiency in the bank’s system, in the absence of an expert certificate on its reliability during the relevant period.

The court here applies a fundamental evidentiary maxim: “one cannot create evidence for oneself“. A table produced unilaterally by the bank, without external verification, has no probative force against the legal requirement. The conclusion follows: BRED “does not provide proof that the transfer and the creation of the beneficiary were subject to strong authentication”.

An essential legal point stressed by the decision: even if strong authentication had been proven, that would not have been enough to exonerate the bank. As the company pointed out, “the fact that a disputed transaction was subject to strong authentication in no way relieves the bank of having to prove that the payer was grossly negligent”. The two demonstrations are distinct and must be carried out separately.

Can the bank invoke the customer’s gross negligence without proving it?

BRED claimed that the transfer “was only possible because of the gross negligence” of the company, the fraudster having necessarily obtained the holder’s “strictly personal” user ID and password. A seductive argument on its face, but ineffective.

Article L. 133-19, IV of the Monetary and Financial Code makes the payer bear the losses only if they “failed intentionally or through gross negligence” to fulfil their security obligations. Yet, in accordance with Article L. 133-23, it is again for the bank to prove this gross negligence. And the court finds that it “provides no evidence” to that effect, the criminal complaint providing none either: “these are therefore mere allegations whose truth is not proven”.

The lesson is clear: the bank cannot infer gross negligence from the mere fact that the fraud took place. This circular reasoning (“there was fraud, so the customer must have been negligent”) is precisely what the law prohibits. Gross negligence is a positive fact that must be proven, for example by showing that the customer disclosed their codes in response to a manifestly fraudulent message. In the absence of such proof, the customer is fully protected.

What must the bank reimburse, and with what interest?

As the transaction was unauthorised and no ground of exoneration was proven, Article L. 133-18 of the Monetary and Financial Code requires the bank to reimburse “immediately […] and in any event no later than the end of the following business day”. As the company reported the transaction within the thirteen-month period of Article L. 133-24, its rights are intact.

The court therefore orders BRED to pay the €14,901. But the most dissuasive aspect lies in the late-payment interest. Article L. 133-18 provides for a progressive increase of the statutory rate that penalises the bank’s inaction:

• + 5 points from the first day of delay (i.e. 8.13% from 15 to 21 February 2022);
• + 10 points after 7 days of delay (i.e. 13.13% from 22 February to 15 March 2022);
• + 15 points after 30 days of delay (i.e. 18.13% from 16 March 2022 until full payment).

Over more than three years of proceedings, this mechanism turns a refusal to reimburse into a debt that swells considerably. The bank is also ordered to pay the costs and €3,000 under Article 700 of the Code of Civil Procedure (code de procédure civile).

Only the claim for damages for non-material loss (€1,000) is rejected, as the company failed to show a loss distinct from that already compensated by the principal award and the procedural costs award. This is the only concession made to the bank, on the ancillary issue, never on the principal one.

Does the dismissal of the criminal complaint change anything?

BRED attempted one last argument: the company “does not communicate on the outcome of its criminal complaint” and could be compensated “in the context of a possible criminal procedure”. The underlying idea: to send the victim off to the criminal trial in order to avoid the civil reimbursement.

The court sweeps the argument aside: the complaint was dismissed (classée sans suite), and the bank “provides no evidence” justifying its refusal on that ground. Above all, the reasoning is legally futile. The right to reimbursement under Article L. 133-18 is autonomous: it depends neither on the identification of the fraudster nor on the outcome of the criminal proceedings. The victim does not have to wait for a culprit to be found in order to be reimbursed by their bank. This is a crucial point, because the vast majority of complaints for bank fraud are dismissed for lack of an identified perpetrator.

What is the practical impact for victims of fraudulent transfers?

This judgment, although it comes from a court of first instance and is unpublished, illustrates with great clarity the state of the law favourable to customers (individuals and businesses alike) who are victims of unauthorised payment transactions. It follows in the wake of settled French Supreme Court (Cour de cassation) case law, which requires banks to provide serious technical proof and prohibits them from sheltering behind presumptions.

Three practical lessons are worth remembering.

First, never be intimidated by the “strong authentication” argument. Asserting that a transaction was authenticated is not proof. The bank must produce verifiable technical evidence (device enrolment logs, IP addresses, IMEI, dynamic link with the transaction, identity of the beneficiary created), ideally backed by expert evidence. An internal table, even if titled “exact transcription of the technical traces”, does not clear the evidentiary threshold.

Second, demand that the bank prove gross negligence rather than presume it. The customer does not have to demonstrate that they were prudent; it is for the bank to demonstrate that they were grossly imprudent. As long as this proof is not provided, reimbursement is due.

Third, do not wait for the outcome of the criminal case. The dismissal of the complaint does not extinguish the right to civil reimbursement. On the contrary, the passage of time makes the increased interest run in the victim’s favour.

On this last point, a still under-exploited angle deserves attention. Beyond the burden of proof alone, banks are bound by the regulatory technical standards (RTS) supplementing the PSD2 Directive (precisely Delegated Regulation 2018/389 on which the court relies) to enhanced obligations of authentication and transaction monitoring. Questioning the bank’s actual compliance of its security system with these requirements is a complementary line of argument, distinct from reports made under anti-money laundering rules, which are not intended to serve as a basis for compensation.

Ultimately, this decision supports a simple position: faced with a disputed transfer, the customer disputes, and the bank proves. When it cannot, it pays: principal, increased interest and costs included.

Frequently Asked Questions

My bank refuses to reimburse a transfer that I did not make. Is that normal?

No, unless the bank proves that you authorised the transaction, or that you committed fraud or gross negligence. Under Article L. 133-23 of the Monetary and Financial Code, it is for the bank to provide this proof. As long as it does not, reimbursement under Article L. 133-18 is due. A refusal based solely on the fact that your codes were used is insufficient.

The bank says there was “strong authentication”. Have I lost?

Not at all. Asserting that there was strong authentication is not enough: the bank must prove it through verifiable technical evidence (device enrolment, IP, IMEI, dynamic link with the amount and the payee). In the case decided on 1 April 2025, an uncertified internal table was held to have no probative value. Moreover, even if proven, strong authentication does not automatically exonerate the bank: it must also demonstrate your gross negligence.

What is “gross negligence” and who must prove it?

It is particularly imprudent behaviour in protecting your security data, for example disclosing your codes in response to a manifestly fraudulent message. It is for the bank to prove it, with concrete evidence. The mere fact that a third party used your credentials does not, in itself, constitute gross negligence.

Do I have to wait for the end of the criminal investigation to be reimbursed?

No. The right to civil reimbursement is independent of the criminal proceedings. The court reiterated this: even though the complaint had been dismissed for lack of an identified perpetrator, the bank remained bound to reimburse. The dismissal of the complaint does not deprive you of any right.

What is the time limit for disputing an unauthorised transfer?

You must report the transaction to your bank “without undue delay” and at the latest within thirteen months of the debit date (Art. L. 133-24 of the Monetary and Financial Code), failing which the claim is time-barred. In the case discussed, this period had been complied with. It is therefore essential to react quickly as soon as you discover the debit.

What interest must the bank pay in case of delay?

Article L. 133-18 provides for a progressive increase of the statutory rate: + 5 points from the first day, + 10 points after 7 days, + 15 points after 30 days of delay. In this case, that meant rates of 8.13%, 13.13% and then 18.13% on the amount reimbursed, until full payment.

Does this decision also apply to individuals?

Yes. Although the case concerns a company, Articles L. 133-18 to L. 133-24 of the Monetary and Financial Code apply to payment transactions generally, and the protection is even stronger for individuals acting for non-professional purposes. The reasoning on the burden of proof and gross negligence is identical.