In cases of banking fraud, the speed of the victim’s reaction is often crucial, and it is indeed required by European legislation to dispute unauthorized transactions with the bank. But how far does this requirement of speed extend? Must it apply to the filing of legal proceedings, as banks would prefer, or does it only concern the notification of the incident to your bank? The Cour de cassation recently provided a clear and long-awaited answer, putting an end to a case law uncertainty that was detrimental to consumers, initiated by banks in recent months before numerous courts.
Com. July 2, 2025, No. 24-16.590
The Facts: Immediate Reporting of Unauthorized Transactions
The case that led to this major clarification highlights the experience of Mr. [J] [W]. In March 2019, his bank account, held at the Caisse de Credit Mutuel de [Localite 6], was the subject of two unauthorized payments totaling EUR 7,314.00 and EUR 3,717.00, carried out during the night of March 5 to 6, 2019. Mr. [W] reacted immediately, filing an objection and requesting reimbursement as early as March 7, 2019, declaring that he was not the originator of these payments.
However, the bank refused reimbursement, arguing that the transactions had been carried out using Mr. [W]’s personal data and authorizations. Faced with this refusal, Mr. [W] summoned the Caisse de Credit Mutuel de [Localite 6] before the Tribunal judiciaire de Lille on December 21, 2021.
The Decision of the Lower Courts: A Disputed Time Bar
The Caisse de Credit Mutuel raised a plea of inadmissibility, invoking time-barring (forclusion). The pre-trial judge of the Tribunal judiciaire de Lille, by an order dated May 5, 2023, declared Mr. [J] [W]’s action inadmissible. This decision was upheld by the Cour d’appel de Douai on March 21, 2024.
According to these courts, Mr. [W]’s action was time-barred because the summons had been served more than 13 months after the disputed transactions. They relied on Article L. 133-24 of the Monetary and Financial Code, considering that this special time-bar period took precedence over the general provisions of Article 2224 of the Civil Code. The Cour d’appel concluded that the 13-month period under Article L. 133-24 of the CMF was a special time-bar period that was intended to apply to the legal proceedings themselves.
The Core Issue: Article L133-24 of the CMF
Article L. 133-24 of the Monetary and Financial Code provides that: “The payment service user shall report, without delay, to his payment service provider any unauthorized or incorrectly executed payment transaction and no later than thirteen months following the debit date, failing which the claim shall be time-barred (…)”.
The divergence in interpretation had long persisted:
- The restrictive interpretation (that of banks and the Cour d’appel): The 13-month period would apply not only to reporting to the bank, but also to the filing of legal proceedings. Beyond this period, any action would be time-barred. Certain lower courts, relying on a particularly broad, and erroneous, reading of a CJEU judgment of September 2, 2021 (Case C-337/20), had adopted this position, holding that the user had to initiate legal proceedings within 13 months.
- The interpretation of users (and now of the Cour de cassation): The 13-month period only concerns the obligation to report (or notify/dispute) the unauthorized transaction to the bank. Once this report is made within the prescribed time, the user retains the right to bring legal proceedings, which is subject to the general limitation period of five years (Article 2224 of the Civil Code). The text is considered perfectly clear in this regard.
The Clarification by the Cour de Cassation: The 13-Month Period Is a Reporting Deadline, Not a Deadline for Legal Action
In response to Mr. [W]’s appeal, the Cour de cassation, in its judgment of July 2, 2025 (Com. July 2, 2025, No. 24-16.590), quashed the decision of the Cour d’appel de Douai.
The highest court recalled that Mr. [W] had indeed reported the fraudulent transfers as early as March 7, 2019, well within the thirteen-month period following the transactions. It thus held that the Cour d’appel had misapplied the statutory provision by declaring the action time-barred.
The Cour de cassation clearly established that Article L. 133-24 of the Monetary and Financial Code imposes a 13-month period solely for reporting (or notifying/disputing) the unauthorized transaction to the payment service provider, and not for the filing of legal proceedings.
A Logical Solution Consistent with European Law
This decision puts an end to hesitations and divergent interpretations by certain lower courts. From a legal standpoint, it is perfectly logical and consistent.
- The clear wording of the statute: Article L. 133-24 refers to “reporting,” not “bringing legal proceedings.” The court cannot rewrite the law under the guise of interpretation, especially when the meaning of the law is clear, pursuant to the principle interpretatio cessat in claris.
- The purpose of the European directives (PSD1 and PSD2): Article L. 133-24 of the CMF derives from the transposition of Directive 2007/64/EC (PSD1), replaced by Directive 2015/2366/EU (PSD2). Recital 70 of PSD2 is explicit: “If the payment service user complies with the notification deadline, he should be able to pursue such claims subject to national limitation periods“. The interpretation in conformity with European law confirms that this is indeed a reporting deadline. The Court of Justice of the European Union itself, in its judgment of September 2, 2021 (CRCAM, C-337/20), recalled that the obligation to notify unauthorized transactions is distinct from the liability action and is set at a maximum period of thirteen months. Banks have sometimes cited this judgment in a truncated manner to suggest that the 13-month period applied to legal proceedings, when in fact it concerned the consequences of the user’s failure to notify.
- Consistency with its own case law: The Cour de cassation has already affirmed the exclusivity of the CMF liability regime (Articles L. 133-18 to L. 133-24) for unauthorized or incorrectly executed transactions, to the exclusion of any other regime. However, this concerns the legal basis of the action, not the time limit for bringing it, which falls under general law. Indeed, the decision of July 2, 2025 does not constitute a novelty. It follows in the wake of previous decisions by the Cour de cassation which recalled that the 13-month period was a reporting deadline (Cass. com., May 2, 2024, No. 22-18.074, Published in the Bulletin; Cour de cassation, Commercial Chamber, November 8, 2023, 22-14.822, Unpublished; Cass. com., June 1, 2023, No. 21-19.289, Published in the Bulletin; Cass. com., February 9, 2022, No. 17-19.441, Published in the Bulletin; Cass. com., July 16, 2020 (referral decision leading to CJEU judgment C-337/20 of September 2, 2021); Cass. com., January 24, 2018, No. 16-26.188, Bull. 2018, IV, No. 6).
Accordingly, this decision should be commended for its clarity, its consistency, and the legal certainty it provides to payment service users. In accordance with the directive, it guarantees fraud victims the ability to assert their rights within a reasonable period (5 years), provided they have alerted their bank within 13 months of the debit.
Point of Caution: The Obligation to Report “Without Delay”
It is nevertheless crucial to note that Article L. 133-24 maintains the obligation to report the transaction “without delay.” While this “without delay” period is not precisely defined, exceeding the maximum 13-month period is the sole ground for time-barring related to reporting. However, a late report, even within 13 months, could potentially be held against the user if the bank can prove fraudulent conduct or gross negligence on their part. The burden of this proof lies with the payment service provider. The Cour de cassation has previously referred preliminary questions to the CJEU regarding the consequences of a late report made within the 13-month period (Cass. com. November 8, 2023, No. 22-14.822 F-D).
An Essential Clarification for Professionals
Furthermore, for professionals, it is important to highlight a nuance introduced by Article L. 133-24, paragraph 2 of the CMF, which was not at the heart of Mr. [W]’s dispute, but is fundamental in banking law. While the 13-month reporting period is mandatory and cannot be shortened by contract for natural persons acting for non-professional purposes (consumers), the situation is different for other users, in particular professionals or legal entities acting in the course of their professional activities.
For the latter, the law expressly allows the parties to contractually set a different period, which may be shorter than 13 months.
In Summary: A Victory for Consumers
The judgment of July 2, 2025 by the Cour de cassation is excellent news for consumer protection. It definitively clarifies the relationship between the reporting deadline and the deadline for legal action:
- Reporting Deadline: Maximum 13 months from the debit date of the unauthorized transactions. This is a mandatory obligation, failure to comply resulting in the claim being time-barred.
- Deadline for Legal Action: 5 years from the report (or from the date of knowledge of the transaction), in accordance with the general limitation period (Article 2224 of the Civil Code).
In practice, this means that if you are the victim of a fraudulent transaction, your first reflex must be to report the incident to your bank as quickly as possible and imperatively within 13 months. Once this step has been completed, you have a period of 5 years to initiate legal proceedings if the situation is not resolved amicably.
This solution, balanced and consistent with the spirit of European law, secures the applicable regime and effectively protects the user, while requiring vigilance regarding account monitoring and the speed of reporting.
It is regrettable that banks saw fit to advance such specious arguments before so many courts. Unfortunately, given the volume that banking fraud currently represents in general litigation, it appears that they have opted to use every possible argument to discourage victims from taking action, even if it means basing their arguments on, to say the least, “creative” interpretations of certain CJEU decisions. It goes without saying that this litigation strategy, which has extended the duration of numerous proceedings, does not contribute to reducing the backlog of the courts…
Do not hesitate to consult the firm if you are facing banking fraud. Being assisted by a lawyer who has thorough knowledge of banking law is essential to obtaining a favorable outcome, recovering your losses, and obtaining compensation for your damages.
FAQ: Banking Fraud and Deadlines for Action – What You Need to Know
What is an unauthorized banking transaction?
An unauthorized banking transaction is a payment (such as a transfer or debit) that was made on your bank account without your consent. This most often involves situations of banking fraud.
I am a victim of banking fraud. What should my first reflex be?
Your first reflex should be to report the incident to your bank as quickly as possible. The law (Article L. 133-24 of the Monetary and Financial Code, or CMF) requires you to notify the transaction “without delay” to your payment service provider.
What is the maximum deadline for reporting an unauthorized transaction to my bank?
You must imperatively report any unauthorized transaction to your bank no later than thirteen months following the debit date of that transaction.
If you do not comply with this maximum 13-month deadline, you risk time-barring (forclusion). Time-barring means that you lose your right to dispute the transaction and, consequently, to request reimbursement.
What does the obligation to “report without delay” mean?
Article L. 133-24 of the CMF requires reporting “without delay” in addition to the maximum 13-month period. Although “without delay” is not precisely defined, failure to comply with the maximum 13-month period is the sole ground for time-barring related to reporting.
However, a late report (even if made within 13 months) could potentially be used against you by the bank if it can prove fraudulent conduct on your part or gross negligence. It is the bank’s responsibility to provide this proof.
My bank refuses to reimburse me. How long do I have to take legal action?
Once you have reported the unauthorized transaction to your bank within the 13-month period, you have a five-year period to initiate legal proceedings if the situation is not resolved amicably.
This 5-year period is the general limitation period (Article 2224 of the Civil Code). It begins to run from the report (or from the date on which you became aware of the transaction).
Can banks require me to initiate legal proceedings within 13 months?
No. The Cour de cassation, France’s highest court, provided a major clarification with its judgment of July 2, 2025 (Case No. 24-16.590).
Prior to this decision, certain banks and first-instance courts had been broadly interpreting the law, arguing that the 13-month period applied not only to reporting to the bank but also to the filing of legal proceedings. This interpretation was often based on an incomplete or “distorted” reading of a judgment by the Court of Justice of the European Union (CJEU).
The Cour de cassation clearly established that the 13-month period provided for by Article L. 133-24 of the CMF solely concerns the obligation to report (or dispute) the unauthorized transaction to your bank, and not the deadline for bringing legal proceedings.
Why is this clarification important for consumers?
This decision by the Cour de cassation is excellent news for consumer protection.
It provides a definitive clarification and much-needed legal certainty, putting an end to divergent interpretations that were detrimental to consumers. This solution is logical and consistent with European law (the PSD1 and PSD2 Directives). Indeed, the court cannot “rewrite the law” when its meaning is clear.
In practice, this means that if you are a victim of fraud, you have the ability to assert your rights within a reasonable period (5 years), provided you have alerted your bank within 13 months of the debit.
Do these deadlines apply in the same way to professionals?
No, there is an important distinction for professionals.
For individuals acting for their personal needs (consumers), the 13-month reporting period is mandatory and cannot be shortened by contract.
However, for other users, such as professionals or businesses acting in the course of their activities, the law (Article L. 133-24, paragraph 2 of the CMF) expressly allows the parties to contractually set a different period, which may be shorter than 13 months.
What happens if I fail to report the transaction within 13 months?
If you do not report the unauthorized transaction to your bank within the maximum thirteen-month period following the debit date, you will be subject to time-barring (forclusion).
As previously mentioned, time-barring is a civil sanction that results in the extinction of your right to bring proceedings regarding that transaction, and therefore the loss of your ability to obtain reimbursement.
Should I retain a lawyer for these steps?
If you are a victim of banking fraud, and particularly if your bank refuses reimbursement, it is strongly recommended to be assisted by a lawyer specializing in banking law.
A lawyer with thorough knowledge of this field can help you obtain a favorable outcome, recover the lost funds, and obtain compensation for your damages, especially in the face of complex legal arguments that banks may advance.
