A company that falls victim to internal misappropriation may bring a claim against the bank that received the transfers, but on the ground of tortious liability. It must then establish an apparent anomaly that was easily detectable. The commercial chamber reiterates that the bank, bound by a duty of non-interference, is not required to investigate the origin and size of the funds paid into its client's accounts, nor to question the client about large-scale movements (Com., 14 January 2026, No. 24-19.102).
Key points
- A bank receiving a transfer is not required to investigate the origin and size of the funds paid into its client's accounts, as long as the transactions appear regular and no indication of falsification is detectable.
- A company defrauded by transfers diverted to an employee's personal account may seek to hold the receiving bank liable under Article 1382, now Article 1240, of the French Civil Code, as a third party to the banking contract.
- The volume of the transactions is not enough: 58 transfers received in barely thirteen months, for €260,210.24, from legal entities unconnected with the account holder, do not in themselves establish an apparent anomaly that was easily detectable.
- The burden of proof lies with the company claiming compensation: it must identify an apparent anomaly, easily detectable, that affected the transfers executed.
What did the company hold against the banks that received the transfers?
The company complained that the two banks had credited its employee's personal accounts without questioning funds bearing no relation to the usual operation of those accounts. Between November 2015 and December 2016, an employee of a transport company misappropriated transfers made by suppliers. They substituted the details of their own personal accounts, held with two separate institutions, for the suppliers' bank details. The employer company brought proceedings against the employee and the two banks for damages, on the ground of tortious liability.
The decision under appeal (CA Toulouse, 18 June 2024, No. 21/04745) had ordered one of the banks to compensate the company. The lower court judges had noted that the employee's accounts, regularly debited with substantial monthly instalments, had received €260,210.24 through 58 transfers in barely thirteen months, from legal entities that had until then no connection with them. They inferred fault from this, in the absence of any further checks or request for explanations from the beneficiary.
The commercial chamber quashes in part: that reasoning does not establish the apparent anomaly which alone could render the bank liable to a third party. Ruling under Article 1382, now Article 1240, of the French Civil Code, it sets out the applicable rule.
The bank, which is bound by a duty of non-interference in its client's affairs, is not required to carry out investigations into the origin and size of the funds paid into the client's accounts, nor even to question the client about the existence of large-scale movements, provided that those transactions appear regular and that no indication of falsification can be detected.
The Court criticises the court of appeal for ruling "on reasoning incapable of establishing the existence of apparent anomalies, easily detectable, affecting the transfers executed on the account opened in the books of [the bank], such as to render the latter liable to a third party to the contract binding it to its client". Under Article 624 of the French Code of Civil Procedure, the quashing of the order against the bank entails that of the head of the judgment holding that the employee was to bear it. The case is remitted to the Toulouse court of appeal, differently constituted.
What recourse against the bank after misappropriated transfers?
Recourse against the receiving bank remains open to the defrauded company, but it requires proof of an apparent anomaly, easily detectable, affecting the transfers. The company is not a customer of the bank that received the funds: it acts as a third party to the banking contract, on the ground of tortious liability. It cannot therefore simply invoke a general duty of vigilance. It must establish a specific fault, related to the disputed transactions themselves.
The rule stated by the commercial chamber protects the bank on two cumulative conditions: the transactions must appear regular, and no indication of falsification must be detectable. As long as both conditions are met, the bank need not investigate the origin of the funds, nor be surprised by their size, nor question its client about large-scale movements. The claimant company must show that one of those two conditions was not met.
The practical consequence is direct for any company that falls victim to internal misappropriation. The cumulative amount of the sums received, their frequency, their disproportion with the known income of the account holder: those factors, accepted by the lower court judges, were not enough. A company that builds its case on the statistical profile of the flows alone risks having its claim dismissed, even where the fraud is established and its perpetrator convicted.
Duty of non-interference: what the decision confirms
The decision confirms the primacy of the duty of non-interference and tightens the requirement that the apparent anomaly be established, without closing off the defrauded third party's claim. The commercial chamber does not say that a bank can never be answerable to a third party for transfers received by its client. It requires the anomaly to be apparent and easily detectable, and to have affected the transfers executed on the account concerned.
The court of appeal had been careful to distinguish two grounds. In its view, the special regime of Article L. 133-21 of the French Monetary and Financial Code may be relied on only by the payment services user, which left open the defrauded third party's claim under the general law. That distinction is not contradicted by the decision under discussion, which itself proceeds on tortious grounds.
What remains open falls to the remittal. The Toulouse court of appeal, differently constituted, will have to rule again on the bank's liability and, where appropriate, on the contribution to the debt between co-obligors. As the case law stood on 14 January 2026, no numerical criterion defines the apparent anomaly: the assessment remains concrete, transaction by transaction.
Steps to take after discovering an internal misappropriation
After an internal misappropriation, the company must document the indications of falsification and the loss of apparent regularity before relying on a claim against the bank. The useful documents are those showing what the bank could see: falsified documents, inconsistent account names, material contradicting the apparent regularity of the transactions. A table of flows, however striking, is no substitute for that demonstration.
The claim against the perpetrator of the misappropriation retains its full place. In the present case, the employee had been convicted in criminal proceedings, and the civil liability incurred towards the employer rested on those same facts. The perpetrator's solvency does, however, limit the practical value of that claim, which explains the search for a bank as debtor.
Finally, prevention weighs more heavily than litigation. Changes of bank details notified by customers or suppliers, the internal validation of those changes and cross-checks on credit notes and invoices are the friction points that fraud exploits. An organisation that keeps a record of those operations reduces its exposure and, in the event of a dispute, has verifiable evidence.
Checks to carry out before bringing proceedings against the receiving bank
- Identify precisely the apparent anomalies, easily detectable, that affected each disputed transfer, bank account by bank account.
- Gather evidence of a detectable indication of falsification or of a loss of apparent regularity, both of which condition the bank's liability to a third party.
- Quantify the damage institution by institution, distinguishing the sums received on each account.
- Preserve and secure the evidence of the internal fraud: falsified documents, accounting entries used to conceal it, correspondence.
- Assess the value of a parallel claim against the perpetrator of the misappropriation, whose fault remains the primary cause of the damage.
Frequently Asked Questions
Can a company defrauded by an employee sue the bank that received the funds?
Yes. A defrauded company may seek to hold the receiving bank liable under Article 1382, now Article 1240, of the French Civil Code, as a third party to the banking contract. It must, however, prove a specific fault: apparent anomalies, easily detectable, that affected the transfers executed. Failing that, the banker's duty of non-interference in the client's affairs prevents any award against the bank.
What counts as an apparent anomaly for a bank receiving a transfer?
An apparent anomaly is one the bank can detect easily, without investigation. According to the commercial chamber decision of 14 January 2026, the bank need not investigate the origin and size of the funds paid into its client's accounts, nor question the client about large-scale movements, provided the transactions appear regular and no indication of falsification is detectable. No list and no monetary threshold is laid down.
Are transfers out of all proportion to the account holder's income enough to make the bank liable?
No, disproportion alone is not enough. In the case decided on 14 January 2026 by the commercial chamber, an employee's personal accounts had received €260,210.24 through 58 transfers in barely thirteen months, from legal entities unconnected with them, while substantial monthly instalments were being debited. Those findings were held incapable of establishing an apparent anomaly that was easily detectable.
Can a bank rely on the employer's weak internal controls to reduce compensation?
A bank may invoke the victim's own fault to limit its liability, but it must prove it. In the case decided, the court of appeal rejected that argument: the banks proceeded by mere assertion, whereas the employee had concealed the misappropriations through false credit notes and false invoices. The Cour de cassation did not have to rule on that point, since the order against the bank was quashed on another ground.
Must the employee who misappropriated the funds indemnify the bank ordered to compensate the employer?
The Toulouse court of appeal held that, as between co-obligors, the employee had to bear in full the orders made against the banks, given the criminal nature of their fault. Applying Article 624 of the French Code of Civil Procedure, the commercial chamber quashed, as a consequence, only the head of the judgment relating to the bank whose order to pay was quashed. That point will be reheard by the court of appeal on remittal.