Gross negligence on the part of the account holder means that they bear all losses arising from unauthorised payment transactions. The commercial chamber requires the judge to examine whether the confirmation message sent by the bank, stating that a payment had been validated and not cancelled, enabled the payer to suspect the fraud. A breach of anti-money laundering vigilance obligations, by contrast, grounds no reimbursement.
The essentials
- The customer due diligence obligations imposed on financial institutions pursue a single aim: combating money laundering and terrorist financing.
- A victim of fraudulent conduct cannot rely on a failure to comply with those vigilance obligations in order to claim damages from their bank.
- The payer bears all losses arising from unauthorised payment transactions where they have failed, intentionally or through gross negligence, to comply with their security obligations. Two obligations are concerned: keeping their personalised security credentials safe, and using the payment instrument in accordance with the conditions governing its use.
- The fact that the fraudulent call came from the branch's official number, during opening hours, is not enough to rule out gross negligence on the part of the payer.
- The wording of the confirmation message received before validation, where it refers to a payment and not to a cancellation, must be examined by the judge.
A fake bank adviser and two payments debited
The commercial chamber quashes in its entirety the judgment which had ordered the bank to reimburse the customer who fell victim to a fake adviser. The decision under review (Com., 4 March 2026, No. 24-19.588) rules out the basis drawn from anti-money laundering vigilance, sets aside the assessment made of the payer's gross negligence and remits the case to the tribunal judiciaire (first-instance civil court) of Brest.
The holder of an account finds that two remote payment transactions have been debited. They alert their bank: two days earlier, a person posing as an employee of the institution had called them. That person had asked them to log into their app in order to cancel allegedly fraudulent transactions. The call came from the official number of their branch, during opening hours. The customer brought proceedings against the bank seeking reimbursement of the sums debited.
The tribunal de proximité (local first-instance court), ruling at last instance (Tprox Morlaix, 18 June 2024, No. 23/00061), ordered the bank to pay a sum of money. The judgment found a breach of the duty of monitoring and vigilance under Article L. 561-6 of the French Monetary and Financial Code, giving rise to the institution's contractual liability. The commercial chamber holds that this basis does not apply (free translation).
The customer due diligence obligation imposed on financial institutions under Articles L. 561-4-1 to L. 561-14-2 of the French Monetary and Financial Code pursues the sole aim of combating money laundering and terrorist financing. Consequently, a victim of fraudulent conduct cannot rely on a failure to comply with it in order to claim damages from the financial institution.
On the ground of Articles L. 133-19 and L. 133-16 of the French Monetary and Financial Code, the commercial chamber criticises the court for stopping at the apparent origin of the call. The judges had inferred from the official number and the opening hours that a reasonable person could be convinced of the caller's legitimacy. The Cour de cassation (France's highest civil court) quashes that reasoning for lack of legal basis, without ruling on the other complaints.
In so deciding, without examining, as it had been invited to do, whether, on receipt of the confirmation message sent by the bank stating that the disputed transactions were payment validation transactions and not cancellation transactions, [the customer] was not in a position to suspect that those transactions were fraudulent, the court did not provide a legal basis for its decision.
What bases can support reimbursement after bank fraud?
The victim of payment fraud cannot rely on anti-money laundering vigilance obligations in order to obtain compensation. Customer due diligence obligations pursue a single aim, combating money laundering and terrorist financing. A customer whose account is debited following a fraudulent scheme cannot therefore complain of a failure of monitoring drawn from those provisions in order to obtain compensation. A claim built on that basis is bound to fail, whatever the reality of the breach.
The debate shifts to the payer's conduct. The payer bears all losses caused by unauthorised payment transactions where they have failed, intentionally or through gross negligence, to comply with two obligations. They must keep their personalised security credentials safe. They must also use the payment instrument in accordance with the conditions governing its use. Assessing that gross negligence is a matter for the lower court judges, in the light of the specific circumstances of the disputed transaction.
How the judge assesses gross negligence
The decision excludes anti-money laundering obligations from the scope of compensation and sets aside an incomplete assessment of gross negligence. The sophistication of the scheme does not relieve the judge of the duty to examine all the evidence put forward by the institution. The spoofing of the branch's number, during opening hours, is a circumstance favouring the customer. That circumstance does not close the analysis: the content of the confirmation message received before validation must be compared with the transaction the customer believed they were carrying out.
The commercial chamber does not hold that the customer committed gross negligence. It penalises incomplete reasoning and remits the examination to the tribunal judiciaire of Brest, which will take up the case in its entirety. The gap between the cancellation request presented by the fake adviser and the wording of the message announcing a payment becomes the central point of the discussion. The other arguments relied on by the bank, drawn from its regular warnings, were not ruled upon.
What steps should the bank and the customer take?
The decision invites both parties to document precisely how the disputed transaction unfolded. For the institution: keep the exact wording of the authentication messages sent, proof that they were sent, the general terms and conditions relating to phishing and the alerts circulated to customers. For the account holder: report the transaction without delay, keep the messages received, the log of calls and the details of the instructions followed.
One point of caution emerges clearly from the decision. Basing a reimbursement claim on anti-money laundering vigilance obligations exposes the claimant to dismissal, including where the bank's security system appears defective. Conversely, the bank has an interest in putting before the judge the evidence it relies on, starting with the wording of the confirmation messages. The judge expects a comparison between the message actually displayed and the understanding the payer could have had of it at the moment of validation.
Checks to carry out after a disputed debit
- Re-read the exact wording of the message received before validation: did it refer to a payment, a refund or a cancellation?
- Gather the traces of the fraudulent approach: calling number, time, content of the instructions given by the supposed adviser.
- Identify the basis of the claim: the regime governing unauthorised payment transactions, and not anti-money laundering vigilance obligations.
- Anticipate the discussion on gross negligence by gathering the warnings received and the general terms applicable to the payment instrument.
Frequently Asked Questions
My bank breached its vigilance obligations: can I claim damages from it?
No, not where the alleged breach concerns the customer due diligence obligations set out in the French Monetary and Financial Code. On 4 March 2026 the commercial chamber recalled that those obligations pursue a single aim, combating money laundering and terrorist financing. A victim of fraudulent conduct cannot rely on a failure to comply with them in order to obtain compensation from the financial institution. The claim must be built on another basis.
The fraudster called me from my branch's number: is that enough to rule out gross negligence?
No, that circumstance is not sufficient on its own. The judge may treat it as a factor favouring the customer, but must examine all the evidence put forward by the bank. In the case decided on 4 March 2026, the court stopped at the official origin of the call and the branch opening hours. The Cour de cassation criticised it for failing to examine whether the confirmation message received made it possible to suspect the fraud.
Does a text message announcing a payment, when I was promised a cancellation, change my position?
Yes, that discrepancy is a decisive part of the debate. The commercial chamber requires the judge to examine whether, on receiving a message stating that a payment had been validated rather than cancelled, the customer was in a position to suspect that the transactions were fraudulent. The answer depends on the specific circumstances and remains in the hands of the lower court judges, here the tribunal judiciaire hearing the case after quashing.
What documents should I keep after falling victim to a fake bank adviser?
Keep everything that reconstructs how the transaction unfolded: authentication messages received on the phone, screenshots of the app, a log of incoming calls with times, emails exchanged and bank statements. Also note the date and time of the report made to the bank. These items allow a proper discussion of the conduct adopted at the moment of validation, which lies at the heart of any disputed payment case.
Can a company that suffers payment fraud bring a claim against its bank?
A company may dispute with its bank the transactions it did not authorise, then apply to the court if reimbursement is refused. The discussion will focus mainly on the conduct of the person who validated the transaction and on compliance with the conditions governing use of the payment instrument. Being a professional does not bar the claim, but it weighs on the assessment of the level of vigilance expected. Preserving evidence remains decisive.