Fraud shifts to victim manipulation

The strengthening of strong authentication has reduced card payment fraud on the internet, but has not eliminated scams: these have shifted to direct manipulation of victims.

Customer responsibility remains high

According to ACPR data, in 2024, 38% of the amount of disputed transactions remained the responsibility of the customers.

European court rules on bank liability

A CJUE ruling from October 15, 2026, reminds that a bank cannot refuse immediate reimbursement of an unauthorized transaction solely on the grounds of a serious negligence by its customer.

Historical fraud methods

For a long time, payment method fraud was relatively simple. The main modus operandi of scammers involved stealing their victims' bank card numbers and using them to make online purchases.

Strong authentication reduces fraud

To counter this pattern, banks and other payment service providers (PSPs) strengthened their defenses at the request of European authorities. Since 2021, strong authentication has been generalized for internet card payments.

Fraudsters adapt to new defenses

With success: since that date, the fraud rate on this type of payment has decreased by nearly 40%. However, this advancement has not dissuaded fraudsters, but forced them to find new strategies.

New fraud tactics target victims

These often have a common point: they involve direct manipulation of the victim, in order to lead them to validate, or even to carry out themselves, fraudulent debits on their bank accounts.

Rise in manipulation fraud

This type of fraud has exploded in recent years, with stolen amounts almost doubling since 2021.

Legal challenges increase

These manipulation frauds, sophisticated and varied, have had a consequence: they complicate the analysis of the victims' responsibility, and therefore their right to be reimbursed for the damage suffered.

Bank of France sets guidelines

Their growth has thus been accompanied by an explosion of legal disputes between victims, demanding compensation, and their banks opposing a refusal.

Guidelines on reimbursement rights

It is in this context that the Bank of France tried to set rules, by publishing a series of recommendations in May 2023. Their objective notably: to provide clarifications on the right to reimbursement provided for by the regulation in case of fraud.

Two scenarios for reimbursement

In this user manual, the institution, guarantor of the security of payment methods, distinguishes two scenarios. The first is simple: if the disputed transaction has not undergone strong authentication, the bank is required to reimburse immediately.

Complex cases involve negligence

The second scenario concerns more directly manipulation frauds, whose object is precisely to lead the victim, through trickery and psychological pressure, to authenticate fraudulent debits.

Banks analyze for negligence

In case of a disputed transaction with strong authentication, the Bank of France asks banks to analyze the transaction in order to search for "sufficient elements to justify the authorized nature of the transaction or to demonstrate a serious negligence of the user."

Victims bear financial burden

If these elements exist, the victim loses their right to reimbursement. In short, the framework set by the Bank of France allows banks to invoke the serious negligence of the victim to avoid the obligation to reimburse immediately, provided that the disputed transaction has undergone strong authentication.

Banks use negligence argument

Without surprise, banks have largely seized on this argument, all the more easily since it allows them to be both debtors and judges of their own debt.

Reimbursement rate declines

According to figures published by the ACPR, the financial sector regulator for the year 2024, the reimbursement rate for unauthorized transactions, which would entitle to immediate reimbursement, was only 62% in amount, a rate "reduced over the last two years," that is, in 2023 and 2024.

Unclear 2025 figures

Requested by MoneyVox, the Bank of France was not able to provide us with the reimbursement rate for the year 2025.

Victims face legal hurdles

In short, the serious negligence argument allowed in 2024 to transfer 38% of the fraud burden onto the victims, leaving them with only the horizon of suing their bank in court to obtain compensation.

European court challenges framework

A recent event, however, calls into question the framework set by the Bank of France, on which banks rely to justify their doctrine.

CJUE clarifies bank liability

Asked by a Polish court on the way to interpret the directive, the Court of Justice of the European Union, the jurisdiction responsible for the interpretation and application of European law, has ruled.

Immediate reimbursement required

In a recent ruling, it explains that "the customer's serious negligence does not exempt the payment service provider from the immediate reimbursement of the amount of an unauthorized payment transaction."

Banks must reimburse first

In other words, whether or not the unauthorized transaction was strongly authenticated, the bank must reimburse first, then "request the customer to reimburse the losses incurred" if it has elements establishing that the customer "intentionally or through serious negligence failed to meet the obligations that apply to them (...)."

Bank of France remains silent

Asked about its intention, or not, to update its doctrine following this publication, the Bank of France indicated to MoneyVox that it "does not [want] to comment, at this stage, on the CJUE decision."