Articles L.133-18 to L.133-23 of the Monetary and Financial Code (code monétaire et financier), illustrated by: TJ Toulouse, civil division, 14 November 2025, No. 23/00493.
🔑 Key Takeaways
- A payment made with card data stolen through web skimming is an unauthorised payment transaction: reimbursement is the rule (Art. L.133-18).
- Without strong authentication, only fraud by the customer exempts the bank (Art. L.133-19 V): gross negligence, even if proven, is not enough.
- With strong authentication, the bank may rely on gross negligence (Art. L.133-19 IV), but it must prove it.
- The burden of proof lies entirely on the bank (Art. L.133-23).
- Immediate reimbursement is required, failing which interest accrues at the statutory rate increased by 5, then 10, then 15 points.
- The Magecart campaign targeting six major card networks is still active in 2026.
Table of Contents ▼
- What Is Web Skimming (or Magecart)?
- Why Is This a Transaction You Never Authorised?
- Must the Bank Reimburse Me, and Within What Time?
- What Enhanced Protections Apply in Cases of Skimming?
- Can the Bank Escape Liability?
- What Does Case Law Say? The Toulouse Judgment as an Example
- How Do You Defend Yourself in Practice as a Victim?
- FAQ: Web Skimming and Bank Reimbursement
What Is Web Skimming (or Magecart)?
Web skimming (also called Magecart, after the criminal groups that popularised it) consists of injecting malicious JavaScript code into the payment page of an e-commerce site. The site remains authentic and functional: the customer sees nothing. But as the customer enters their card details, the script “skims” (to skim) in real time the card number, expiry date, security code (CVC) and billing data, then exfiltrates them to the fraudsters’ servers.
A fraud technique that involves inserting a spy script into the payment funnel of a legitimate merchant site, in order to capture the bank card data entered by customers, without their knowledge, at the time of purchase.
Several characteristics make this fraud particularly hard to detect: the code is heavily obfuscated and can self-destruct after execution to erase its traces; the attack takes place on the browser side, which allows it to bypass some of the anti-fraud controls installed on the server side; and the criminals rely on “bulletproof” hosting (bulletproof hosting) that deliberately ignores takedown requests.
The phenomenon is neither anecdotal nor a thing of the past. In January 2026, the cybersecurity company Silent Push revealed a Magecart campaign that is still active, operating continuously since early 2022, and specifically targeted the scripts of at least six major payment networks (American Express, Diners Club, Discover, JCB, Mastercard and UnionPay) by means of a vast network of fraudulent domains. Many merchant sites remain infected, and the researchers say they will keep tracking this campaign and its variants throughout 2026: it is therefore a current risk, not a past threat (see also the analysis by Malwarebytes and by The Hacker News).
Once stolen, card data is resold in batches on specialised forums (carding sites): “there were the 16 digits, the security code, the expiry date, the customer’s name”. This description is not theoretical: these are the words used by a fraudster himself before the Paris criminal court, as quoted in a decision discussed below.
The resale, on underground forums, of stolen bank card data (number, expiry date, security code, cardholder’s name), often in batches, to fraudsters who then use it for distance purchases.
The essential point to understand, legally, is this: in web skimming, your data is captured without any carelessness on your part. You keep your card, you disclose no code, you pay on a trusted site. It is precisely this finding that underpins your right to reimbursement.
Legitimate merchant site → malicious script injected into the payment page
↓
Customer enters their card → data captured (number + CVC + date)
↓
Exfiltration to the fraudsters’ servers → resale “in batches” (carding)
↓
Fraudulent distance purchases → unauthorised payment transaction
Why Is This a Transaction You Never Authorised?
Payment law rests on a simple notion: consent. A transaction is “authorised” only if the payer has consented to it, in the form agreed with their bank (Article L.133-3 of the Monetary and Financial Code and following). Without consent, the transaction is deemed unauthorised.
A payment made with card data stolen through web skimming falls squarely into this category: you never wanted that purchase, you never consented to it. You are therefore the holder of an unauthorised payment transaction, which triggers the whole protective regime of Articles L.133-18 et seq. of the Monetary and Financial Code.
Must the Bank Reimburse Me, and Within What Time?
Article L.133-18 of the Monetary and Financial Code is unambiguous. In the case of an unauthorised transaction reported by the customer, the bank must reimburse the amount debited immediately, and at the latest by the end of the following business day after the report. It must restore the account to the state it would have been in had the fraud not taken place.
The only exception: the bank may defer reimbursement if it has good reasons to suspect fraud by the customer themselves, and provided that it communicates those reasons in writing to the Banque de France. A mere suspicion stated in a letter of refusal is therefore not enough.
Above all, delay has a price. Article L.133-18 provides for interest at the increased statutory rate: + 5 points from the breach of the obligation to reimburse; + 10 points beyond seven days of delay; + 15 points beyond thirty days of delay. In other words, the longer the bank takes, the higher the bill climbs for it.
What Enhanced Protections Apply in Cases of Skimming?
Beyond the general principle, one provision works particularly in favour of the victim of web skimming: Article L.133-19 II. The payer’s liability is not engaged where the transaction was carried out by misappropriating, without the payer’s knowledge, the payment instrument or the data linked to it. That is the very definition of skimming: your card data is copied and replayed without your knowing, while you are still in possession of your card.
There remains a second protection, more powerful still, which depends on whether or not strong authentication was used. That is the whole subject of the next section.
Authentication based on at least two independent factors among “knowledge” (something only you know), “possession” (something only you hold) and “inherence” (something you are), designed to protect the confidentiality of the data (Article L.133-4 of the Monetary and Financial Code).
Can the Bank Escape Liability?
The customer’s gross negligence is often presented as “the” escape route for the bank. That is inaccurate. In reality, the institution’s room for manoeuvre (marge de manœuvre) depends on a decisive distinction: was the disputed transaction subject to strong authentication or not?
Without Strong Authentication: Only Your Fraud Exempts the Bank
Article L.133-19 V is highly protective here, and its terms must be read precisely: “Unless the payer has acted fraudulently, the payer bears no financial consequences if the unauthorised payment transaction was carried out without the payment service provider requiring strong authentication“. The text reserves only the payer’s fraudulent conduct, that is, their complicity in the fraud. It does not mention gross negligence.
The consequence is critical: where the bank did not require strong authentication, even perfectly established gross negligence does not exempt it. Only proof of fraud by the customer would allow it to avoid reimbursement. And since a large share of online payments made with skimmed data go through channels without strong authentication, this rule alone is enough to find against the bank in many cases.
With Strong Authentication: The Bank Must Prove Gross Negligence
Only in this scenario can the bank rely on the customer’s gross negligence (Article L.133-19 IV) to refuse reimbursement. But it must still prove it, and the bar is high.
This is because the burden of proof lies entirely on the bank. Article L.133-23 is drafted to that effect: when the customer disputes a transaction, it is for the bank to prove that the transaction was authenticated, duly recorded and accounted for, and that it was not affected by a technical or other deficiency. The text adds two decisive clarifications: the mere record of the use of the payment instrument “is not necessarily sufficient” to prove that the transaction was authorised or that the customer was grossly negligent; and it is for the bank to provide the evidence of the customer’s fraud or gross negligence.
In practical terms, the bank cannot simply assert that you “must have” disclosed your details. It must establish it. And in the case of web skimming, that is precisely what it is often unable to do, since the data may have leaked without any action on your part.
What Does Case Law Say? The Toulouse Judgment as an Example
A recent decision perfectly illustrates the strength of this argument. In a judgment of the Court of First Instance (tribunal judiciaire) of Toulouse of 14 November 2025 (No. 23/00493, unreported), a bank refused to reimburse a fraudulent debit of €10,600, arguing that its customer had “necessarily” disclosed her bank details, and had therefore been grossly negligent.
The court rejected that argument. It noted that the bank “merely asserts” the disclosure, without responding to the expert report which described large-scale Magecart-type hacks that “allow malicious persons to retrieve, from e-commerce sites, information associated with a bank card without the internet users’ knowledge”. The judge even noted the admissions of the fraudster in the criminal proceedings, who acknowledged buying the data “in batches” on carding sites.
The court’s conclusion: the bank details “may have been obtained by the fraudster independently of any careless act” by the customer. As the bank had failed to prove gross negligence, it was ordered to reimburse the €10,600, together with interest at the increased statutory rate (5, then 10, then 15 points), and to pay €4,000 in respect of legal costs.
In this case, the main modus operandi was actually telephone “spoofing”, and web skimming served only as an evidentiary argument to explain how the data could have leaked without fault on the customer’s part. That is the whole value of the decision: it shows how to set web skimming and carding against a bank that relies on gross negligence.
How Do You Defend Yourself in Practice as a Victim?
If you discover debits that you did not authorise, here is the procedure to follow.
1. Report without delay, and within the time limit. Notify your bank immediately to block your card and dispute the transactions. You have, in principle, thirteen months from the debit to report them (Article L.133-24), but act as quickly as possible: delay may be interpreted against you on the ground of diligence.
2. Make a written statement and keep everything. Send a written dispute (registered letter or message via your secure online area) listing the disputed transactions. Keep statements, screenshots and exchanges: these are your evidence. Beware: the wording of this dispute is decisive, because some clumsy phrases can be turned against you to establish alleged negligence. Before writing to your bank, be sure to read our guide: Bank Fraud: What to Say and Not to Say to Your Bank and in Your Complaint.
3. File a criminal complaint. A complaint for fraud or fraudulent use of bank data strengthens your case and demonstrates your good faith. A copy of any criminal conviction of the perpetrator is an asset, as the Toulouse case illustrates. Here again, the words used matter: to know what to mention and, above all, what it is better not to state, refer to our dedicated guide: Bank Fraud: What to Say and Not to Say to Your Bank and in Your Complaint.
4. Send the bank a formal notice. In the event of refusal, remind it in writing of the regime of Articles L.133-18, L.133-19 and L.133-23: depending on the case, the bank can escape liability only by proving your fraud (where there was no strong authentication) or your gross negligence (after demonstrating the absence of any technical deficiency). Demand reimbursement and the increased interest.
5. Bring legal proceedings if the refusal persists. An action before the Court of First Instance (tribunal judiciaire) frequently results in the bank being ordered to pay when it fails to discharge the burden of proof that lies on it. The assistance of a banking law attorney makes it possible to build the argument around the burden of proof, the angle that most often makes the difference.
In Summary: Who Must Prove What?
Faced with web skimming, the victim has no need to justify themselves: the burden of proof lies on the bank. If the transaction took place without strong authentication, only fraud by the customer can exempt the bank; gross negligence, even if proven, is not enough. And if strong authentication was required, the bank must then establish the customer’s gross negligence, after demonstrating the absence of any technical deficiency. As long as that proof is not provided (and it rarely is when data has leaked from a merchant site), full reimbursement, including increased interest, is required.
FAQ: Web Skimming and Bank Reimbursement
Does my bank have to reimburse me for web skimming?
Can the bank accuse me of having “necessarily” given out my card number?
What if the bank did not require strong authentication?
How long do I have to dispute the transaction?
What interest can I obtain if the bank is late?
Is the web skimming campaign still active in 2026?
This article is for general information purposes only and does not constitute legal advice. Every situation is different: for an analysis of your case, please contact an attorney.
