A French court ruled in favor of a client who lost 54,500 euros to fraud, rejecting the bank's claim of negligence.
Client reports fraudulent transfers
On 31 May 2019, a client discovered unauthorized transfers totaling 54,500 euros from his account. He claimed to have been contacted by someone posing as his bank advisor’s assistant, whose phone number appeared on his device.Client validates transfers on phone
The caller informed the client that some transfer beneficiaries had been deleted due to a cyberattack and needed to be re-registered. The client validated the operation using his confidential code on his phone and alerted his bank the same day, requesting reimbursement.Court rules in favor of client
On 28 March 2023, the Versailles Court of Appeal ruled that the bank must reimburse the client 54,500 euros and pay 1,500 euros for moral damages. The bank appealed, arguing the client was negligent by validating the operation remotely without verifying it.Legal framework protects payment service users
The Monetary and Financial Code establishes a regime favoring users of payment services who are victims of unauthorized operations. It requires providers to reimburse users immediately unless they have valid reasons to suspect fraud and communicate them to the Bank of France.Court rejects bank's appeal
The Court of Cassation rejected the bank’s appeal on 23 October 2024, stating that the Court of Appeal correctly determined the burden of proof lies with the payment service provider to show serious negligence by the client. The court emphasized the client believed he was speaking to a bank employee.Ruling sets a general precedent
The ruling applies broadly, stating that no serious negligence can be attributed to an account holder who, called by someone posing as a bank employee whose number is displayed, uses a personalized security device to delete and re-enter transfer beneficiaries. The impersonation of the bank’s number is considered in assessing the client’s behavior.Key distinction in client's actions
The ruling notes that the situation differs if the client, believing he is protecting his funds, enters and issues a transfer to an account indicated by the scammer. In such cases, the operation may be considered authorized, excluding the liability regime outlined in the law.New verification requirements
Since 9 October 2025, payment service providers must verify the consistency between the beneficiary’s name and the IBAN entered before any euro transfer. This could influence future assessments of serious negligence and potential liability.Client's actions shape dispute outcome
For clients who are victims, timely reporting of the operation, within the thirteen-month deadline set by the law, and requesting reimbursement in writing are crucial. Keeping all evidence of the interaction, such as call logs and SMS messages, can also affect the outcome.
