Bank fraud lawyer in Paris: getting your bank to refund a fraudulent transfer.

Everything depends on who gave the order. Under Article L. 133-6 of the Monetary and Financial Code (Code monétaire et financier), the payer's consent is enough to make the transaction authorised. If the fraudster initiated the transfer from your online banking area, the transaction is not authorised: the bank must refund under Article L. 133-18, unless it establishes that the account holder acted fraudulently or was grossly negligent. If you yourself entered and validated the transfer because a fake supplier or a fake manager asked you to, the transaction remains authorised, even if your consent was obtained by a ruse. The Court of Cassation so held for transfers made by an employee “who thought she was acting on the instruction of one of the directors, using the secure payment system provided by the bank” (Cass. com., 30 April 2025, No. 24-11.255) (our translation), and the company's appeal to the Court of Cassation was dismissed. This distinction is not theoretical. It determines the provision relied on, the burden of proof and the chances of a refund. The fraudster's obtaining of validation for a transaction the fraudster initiated does not necessarily make it authorised, under Article L. 133-23: the Court of Cassation then examines the payer's gross negligence. A single case may therefore combine transfers ordered by the victim and transactions initiated by the fraudster.

In principle no, on the basis of the Monetary and Financial Code alone. Article L. 133-21 deems a transfer made in accordance with the IBAN supplied by the customer to have been correctly executed. In a case involving falsified bank details, the court of appeal had ordered the bank to pay, holding that the payers had consented only in respect of the true creditor. The Commercial Chamber quashed that decision “while it noted that the payment transactions had been executed in accordance with the unique identifiers supplied” by the customers (Cass. com., 1 July 2026, No. 25-15.283) (our translation). It recalls, following the Court of Justice, that the limitation of liability applies even where the IBAN does not match the name of the beneficiary indicated. This decision is unfavourable to victims, and you need to know that before writing to the bank. A claim remains possible on other grounds: failure to verify the beneficiary for a transfer made after 9 October 2025, a payment order drafted by the bank itself, or fault by the bank that holds the fraudster's account. The text also requires your bank to endeavour to recover the funds.

For a long time, the answer in principle was no for the payer's bank. European Union law holds that a bank which executes the transfer on the identifier supplied does not incur liability if the name on the order does not match the account holder. The Court of Cassation recalled this in holding that “the limitation of the payment service provider's liability, provided for by that provision, applies” in that situation (Cass. com., 1 July 2026, No. 25-15.283) (our translation). The landscape has changed for euro transfers. Since 9 October 2025, banks in the euro area must offer the beneficiary verification provided for by Article 5c of Regulation (EU) No 260/2012, inserted by Regulation (EU) 2024/886. Before you authorise the transfer, your bank queries the beneficiary's bank and alerts you to a lack of match or a close match. The check does not prevent you from paying, but it shifts the discussion: if the bank did not provide this service and the transaction is incorrectly executed for that reason, it must refund the amount transferred without delay. If you went ahead despite an alert, its liability is on the other hand harder to establish.

It creates a new argument for euro transfers ordered since 9 October 2025. Article 5c of Regulation (EU) No 260/2012 requires the payer's bank to check, before authorisation, that the IBAN and the name entered match, whichever channel is used: app, website or branch. For an order handed in on paper, the check takes place on receipt, unless you are not present at that moment. Where there is a discrepancy, it must inform you that the funds could be paid into an account that does not belong to the beneficiary indicated. Paragraph 8 of that article provides for two consequences. A bank that followed the procedure is not liable for a transfer executed to the wrong beneficiary on an inaccurate identifier. A bank that did not follow it, where that failure results in an incorrectly executed transaction, must refund the amount transferred to the payer without delay. The evidence therefore becomes concrete: a screenshot of the entry screen, the message received, the verification log that the bank must be able to produce. A company that sends its transfers in batches may have opted out of this service; this must be checked in its agreement before building the claim. For a transfer made before 9 October 2025, this obligation cannot be relied on.

Not necessarily. For an authorised transfer, the bank remains bound by a duty of vigilance, but it is also bound not to interfere in its customer's affairs. The Court of Cassation requires apparent anomalies that a normally diligent professional could easily detect. It quashed a judgment that had found fault in the execution of a transfer abroad ordered by a retired person of modest income, noting that the judges had ruled “on grounds unsuited to establishing the existence of apparent anomalies, the court of appeal did not give its decision a legal basis” (Cass. com., 4 February 2026, No. 24-19.196) (our translation). In another case of transfers to a fake investment, it approved the appeal judges who held that “the international nature of the transfers in dispute, their sometimes large amounts, their number and the short period over which they were executed do not constitute anomalies” (Cass. com., 25 March 2026, No. 24-18.093) (our translation). These decisions are unfavourable to victims. The amount or the unusual nature is not enough: there must be an objective inconsistency in the order itself, its medium or its circumstances. The firm looks for these specific elements before relying on vigilance, rather than arguing an unusual nature that the case law rejects.

CEO fraud most often leads to authorised transfers, since they are made by an authorised employee using the bank's tools. The automatic refund under Article L. 133-18 is then ruled out. The claim rests on the contractual duty of vigilance, and the Court of Cassation specifies that the special regime “applies only to unauthorised or incorrectly executed payment transactions” (Cass. com., 19 November 2025, No. 24-17.780) (our translation). In that case, which concerned a transfer of 231,078 euros ordered by a company to a Hungarian bank, it nonetheless quashed the judgment in the company's favour, because a large transfer abroad had already been ordered previously. The authorisations given to the accountant, the ceiling set by the remote banking agreement and the history of flows therefore weigh heavily. For a company, the agreement may also set a different reporting period and derogate from the rules on evidence and the sharing of losses (Article L. 133-24, Article L. 133-2). The situation is different if the order did not come from an authorised person. The Commercial Chamber held that, in the case of an unauthorised transaction, “only the liability regime of the payment service provider provided for by the Monetary and Financial Code applies, to the exclusion of the ordinary law of contractual liability” (Cass. com., 4 February 2026, No. 24-22.320) (our translation). The company's internal failings could then not be held against it on ordinary-law grounds.

Under Article L. 133-18, it refunds you as soon as it is informed, and before the end of the following business day, restoring the account to the state it would have been in had the transaction never taken place. It avoids this only if it has serious grounds to suspect that you yourself acted fraudulently, and if it sends those grounds in writing to the Banque de France. A late refund carries interest at the legal rate increased by five to fifteen points depending on the length of the delay. A refusal based on gross negligence does not relieve the bank of the need to produce evidence: under Article L. 133-23, it first establishes that the transaction was authenticated, recorded and accounted for, and then provides evidence of the alleged negligence, use of the instrument not being enough by itself. In practice, ask in writing for the connection logs, the date on which the beneficiary was added and the method of validation of each transaction. A reply that merely asserts that the transaction was validated with your credentials does not meet this requirement.

Only if it has serious grounds to suspect that the account holder acted fraudulently, and provided it sends those grounds in writing to the Banque de France. The fraud in question is that of the account holder, not that of the fraudster. In a case decided on 30 September 2026, a customer disputed a transfer executed on the strength of a false document produced by the beneficiary. The court of appeal had held her challenge to be fraudulent, on the ground that she had approved the method used by a text message. The Court of Cassation set aside that analysis, because the message validated the transfer to enforce a civil judgment and not to pay fees, “which ruled out the fraudulent nature of her request for the return of the funds” (Cass. com., 30 September 2026, No. 25-16.643) (our translation). This decision recalls that suspicion of fraud must rest on specific facts, and that a good-faith challenge cannot be recharacterised as fraud in order to avoid an immediate refund. If the bank relies on this ground, ask it on what evidence it is based and whether it was actually sent to the Banque de France.

Not automatically, but the answer is never settled in advance. Article L. 133-19 leaves all losses with the payer where they failed, deliberately or through gross negligence, in the duty to protect their security data provided for by Article L. 133-16. The same article reserves a protection: unless the payer acted fraudulently, they bear no financial consequences if their bank did not require the strong authentication provided for by Article L. 133-44. Trial courts sometimes rule out gross negligence as soon as the call appeared to come from the bank's number. The Court of Cassation rejects this shortcut. On 9 September 2026, it set aside a judgment in the customer's favour, made “on a peremptory ground ruling out the payer's gross negligence when approached by a telephone call” from a person presenting themselves as a bank employee (Cass. com., 9 September 2026, No. 25-15.038) (our translation). The judges must examine specifically whether the voluntary disclosure of the identifier and access code and the validation of transactions that the payer had not initiated amounted to gross negligence. This decision is unfavourable to victims in that it closes the door on an automatic principle. It also requires the bank to address the facts: what the fraudster already knew, the content of the messages received and the exact nature of the validations requested.

A recall of funds is a request that your bank sends to the beneficiary's bank to obtain the return of the transfer. It must be made the same day, in writing, with the amount, the date, the recipient IBAN and the receipt for the criminal complaint as soon as there is one. Article L. 133-21 requires the payer's bank to endeavour to recover the funds where the identifier supplied was inaccurate, and the beneficiary's bank to give it all useful information. If this fails, your bank must give you, on request, the information it holds in order to document a legal claim. This last point is often overlooked, although it makes it possible to identify the holder of the credited account. The return of the funds assumes that they are still available: the recipient bank cannot return a balance that has already been moved elsewhere. This is why the criminal complaint for fraud, within the meaning of Article 313-1 of the Criminal Code, must follow without delay, so that investigators can obtain information on the account and, where appropriate, have the sums still there seized.

Yes, but in tort under Article 1240 of the Civil Code, since the victim has no contract with that bank, and with demanding proof. The Paris Court of Appeal held an online bank liable after a transfer paid into an account that the fraudster presented as that of the owner of a property offered for rent, whose identity the fraudster had stolen, holding that “the bank would thus have opened an account on the strength of documents that are necessarily forgeries, which is enough to engage its liability unless it shows that those documents were absolutely beyond suspicion, which it does not do” (CA Paris, pôle 4, ch. 9-A, 14 March 2024, No. 22/10891) (our translation). It relied on the obligation to identify the customer before entering into a relationship, set out in Article R. 561-5 of the Monetary and Financial Code. This is a case-specific outcome. Another chamber of the Paris Court of Appeal rejected in 2025 the claim of a saver who was the victim of a fake investment, noting that “proof of fault by Société Générale in opening the account that received the funds has not been provided” (CA Paris, pôle 5, ch. 6, 19 November 2025, No. 24/04988) (our translation). It recalls that the obligations in Articles L. 561-5 to L. 561-22 “have the sole purpose of combating money laundering and the financing of terrorism, so that victims of fraudulent conduct cannot rely on them to claim damages from the financial institution” (CA Paris, pôle 5, ch. 6, 19 November 2025, No. 24/04988) (our translation). This action therefore requires information on the account, which often only the criminal investigation or a court measure can obtain.

No. Article L. 133-24 requires an unauthorised transaction to be reported promptly, within a maximum of thirteen months after the debit, failing which the right to a refund is lost, unless the bank did not make information on the transaction available to you. This period concerns the report, not the summons. The Court of Cassation so held on 1 July 2026: an account holder who reported within that period “may bring an action for a refund against the payment service provider within the ordinary-law period” (Cass. com., 1 July 2026, No. 25-16.495) (our translation). It quashed the judgment that had declared the action time-barred because the summons had been served more than thirteen months after the transfers. The ordinary-law period is in principle the five-year period in Article 2224 of the Civil Code, running from the day the account holder knew, or should have known, the facts. The rule protects a victim who reacted quickly but negotiated for a long time. It does not dispense with reporting promptly: the requirement of a report without delay remains in the text, and a late reaction weakens both the refund and the recovery of the funds.

Yes, and it is one of the few routes open for a transfer the customer consented to. Where the bank merely executes the order on the IBAN supplied, the special regime excludes ordinary law. The Court of Cassation again so held in a case where the IBANs supplied contained BIC codes of other banks: Article L. 133-5 “has neither the purpose nor the effect of allowing the payment service provider's liability to be engaged on the basis of national ordinary law” (Cass. com., 20 May 2026, No. 25-14.005) (our translation). This decision is unfavourable to the victim. The position is different where the bank drafted the order itself. In a judgment dismissing the appeal on 4 March 2026, the Commercial Chamber upheld the ruling against a bank that had drawn up the order submitted for its customers' signature, where the bank identification details showed “apparent and manifest inconsistencies that left no doubt, for a normally diligent professional, that the identifier was a crude forgery” (Cass. com., 4 March 2026, No. 25-11.959) (our translation). The branch's role in preparing the transfer must therefore be established precisely: printed document, entry by the adviser, retention of the original.