Banking fraud: how far does the victim’s liability extend?
Written by Nathalie Dreyfus27/09/2018 Introduction
The decision rendered by the French Supreme Court on March 28, 2018 (n°16-20.018) constitutes a significant milestone in assessing victim liability in cases of banking fraud. While the legal framework had traditionally favored strong customer protection, this ruling introduces a rebalancing by placing the concept of gross negligence at the forefront, now interpreted more rigorously.
Under Article L.133-18 of the French Monetary and Financial Code, the principle remains that unauthorized transactions must be reimbursed immediately to the customer. However, the bank may avoid reimbursement if it can demonstrate fraud attributable to the customer or, more commonly, a serious breach of the customer’s duty of care. The central challenge therefore lies in identifying such negligence, the scope of which has been significantly broadened by recent case law.
A structured analysis of fraud scenarios to determine liability
Assessing the respective liability of the bank and the account holder requires a precise qualification of the factual circumstances. Traditionally, fraud cases fall into three distinct categories, each governed by a specific legal regime.
The first scenario concerns the interception of a bank card during delivery. In such cases, liability lies with the bank. Under Article L.133-15 of the French Monetary and Financial Code, payment service providers must ensure the confidentiality of security data associated with payment instruments. This obligation is reinforced by data protection law, particularly the GDPR, which requires appropriate technical and organizational safeguards. Where fraud results from deficiencies in these systems, the bank bears full responsibility, without any fault attributable to the customer.
The second scenario involves the loss or theft of a bank card. Here, the legislator has adopted a balanced mechanism. Under Article L.133-19 of the French Monetary and Financial Code, the customer may bear a limited loss capped at €50 at most, provided no gross negligence is established. However, this cap does not apply in certain situations provided for by the statute, and the payer shall bear the full amount of the losses in the event of fraudulent conduct or where the losses result from intentional misconduct or gross negligence in complying with their obligations. In practice, when the customer acts diligently, particularly by promptly reporting the incident, the bank remains liable for nearly the entire loss.
The third and most frequent scenario involves the misappropriation of banking data while the card remains in the customer’s possession. This includes various techniques such as card cloning, system intrusions, and, most commonly, phishing (fraudulent practice whereby an individual is deceived into disclosing sensitive information (such as login credentials, passwords, or banking details) by an impersonator posing as a trusted entity, such as a bank, public authority, or legitimate business). It is within this category that legal disputes are most complex, as the line between victimhood and fault becomes particularly blurred.
Phishing: a progressive reclassification of customer liability in case law
Phishing-related litigation clearly illustrates the evolution of judicial reasoning. Initially, the French Supreme Court adopted a protective stance, holding that the mere fact of being deceived by a fraudulent scheme was insufficient to establish gross negligence. The decision of January 18, 2017 (No. 15-18102) reflected this approach, requiring banks to prove manifestly imprudent behavior on the part of the customer.
However, the French Supreme Court decision of March 28, 2018 (No. 16-20.018) decision marks a turning point. The Court now accepts that gross negligence may arise from a failure to detect obvious signs of fraud, such as inconsistencies in website addresses, spelling errors, or unusual requests.
This shift introduces a heightened standard of vigilance, requiring customers to exercise critical judgment when confronted with suspicious communications. The assessment is now conducted in concreto, taking into account factors such as the apparent credibility of the fraudulent message, the context in which it was received, and the profile of the victim.
Key contribution of the decision: the decisive role of security systems in assessing fault
One of the most significant contributions of the March 28, 2018 ruling lies in the importance given to banking security mechanisms. The Court considers that the use of strong authentication systems, such as 3D Secure, may indicate that confidential data was compromised due to the customer’s conduct.
In practical terms, when a transaction requires the entry of a code sent personally to the account holder, it becomes more difficult for the customer to deny involvement in the fraudulent operation. Although this constitutes a rebuttable presumption, it significantly strengthens the bank’s position by providing technical evidence of insufficient vigilance.
This development reflects a shift in the allocation of responsibility. As security systems become more sophisticated, the level of care expected from customers increases accordingly. Technology, initially designed to protect users, thus becomes a key factor in assessing their potential fault.
Conclusion
The decision of March 28, 2018 marks a significant evolution in the legal treatment of banking fraud in France, introducing a rebalancing between customer protection and the customer’s own duty of vigilance. While the principle of immediate reimbursement of unauthorized transactions remains intact, its effectiveness now depends closely on the absence of gross negligence, which is assessed more rigorously and contextually.
Case law thus promotes a more accountable approach for account holders, particularly in response to modern fraud techniques such as phishing. At the same time, it fully integrates technological developments, especially strong authentication mechanisms, into the evaluation of customer behavior.
Dreyfus Law Firm . assists its clients in managing complex intellectual property matters by providing tailored advice and comprehensive operational support to ensure the full protection of intellectual property rights.
Dreyfus Law Firm works in partnership with a global network of intellectual property attorneys.
Nathalie Dreyfus, with the assistance of the entire Dreyfus team.
FAQ
How is the burden of proof allocated in banking fraud cases?
The principle remains favorable to the customer: the bank must demonstrate that the transaction was properly authenticated and executed. However, to avoid reimbursement, it must also prove fraud or gross negligence by the customer, often relying on technical evidence such as strong authentication and transaction traceability.
Does disclosing banking data automatically constitute fault?
No. Case law adopts a nuanced approach. The disclosure of banking data does not automatically amount to gross negligence. Courts assess the specific circumstances, including the sophistication and credibility of the fraud. However, since 2018, a higher level of vigilance is expected when clear warning signs are present.
Does the customer’s reaction time affect liability?
Yes. Prompt action, particularly reporting the fraud without delay, is a key factor. A diligent response may exclude gross negligence and preserve the right to reimbursement. Conversely, delayed action may be interpreted as a failure to exercise due care.
Do banking security systems automatically exempt banks from liability?
No, but they play a crucial role. Strong authentication mechanisms, such as 3D Secure, may indicate that the transaction was validated using the customer’s credentials, creating a presumption of negligence. This presumption can, however, be rebutted in cases of sophisticated fraud.
Do new technologies increase customer responsibility?
Indirectly, yes. As security systems become more advanced, expectations regarding user vigilance rise accordingly. Customers are presumed to understand authentication processes and act cautiously. Technology thus becomes a key factor in assessing customer behavior.
