--- title: "Bank-impersonation fraud: must your bank refund you?" url: https://gautelier-avocats.com/en/news/bank-impersonation-fraud lang: en description: "The bank’s number appears, the urgency is manufactured, and confirmations on a phone are not always enough for the bank to refuse a refund. Authentication is not authorisation." --- # Bank-impersonation fraud: must your bank refund you? *Litigation · Analysis · 3 November 2026 · Maëva Gautelier* **The bank’s number appears, the urgency is manufactured, and confirmations on a phone are not always enough for the bank to refuse a refund. Authentication is not authorisation.** Your bank’s number appears on the screen. The caller announces a fraud and guides you to “secure” your account. A few minutes later the money is gone, and the bank relies on the confirmations made on your phone to refuse a refund. Those confirmations are not always enough: the law requires a more precise analysis. ## The trap: a sign of trust The fraudster does not ask you for money: they claim to be helping you protect it. The number displayed, spoofed, and personal information they already know make the call credible. Then comes the urgency: an attack under way, transactions to cancel. You are asked to add a payee, to give a code or to confirm a notification. You think you are stopping a payment, while your actions allow it to go through. ## Authentication is not authorisation Authentication checks an identity or the use of a payment instrument. Consent relates to the transaction itself: under articles L. 133-6 and L. 133-7 of the Monetary and Financial Code, a transaction is authorised when the payer has consented to it in the form agreed with their bank. The act actually performed therefore has to be identified: logging in, adding a payee, or confirming a specific transfer. Approving a payee is not, on its own, consent to later transfers. Conversely, a transfer personally ordered to an account presented as “secure” does not automatically become unauthorised because its author was deceived. ## What the bank must prove Article L. 133-23 places the burden of proof on the bank: authentication, recording, booking and the absence of a technical or other deficiency. Recorded use of the instrument is not necessarily enough to establish authorisation, or gross negligence, which must be proved by further evidence. ## The refund rules **Immediate refund.** For an unauthorised transaction duly reported, the bank must refund by the end of the first business day after the report and, if necessary, restore the account (article L. 133-18). The only exception requires good reason to suspect fraud by the user, notified in writing to the Banque de France: a bare allegation of gross negligence is not enough. Delay is sanctioned by increased interest. **Final allocation of the loss.** Under article L. 133-19, fraud, an intentional breach or the customer’s gross negligence can leave the loss with them. Except in cases of fraud, the customer is in particular protected where the bank did not require strong authentication. **Time limit.** Report without delay, and at the latest thirteen months after the debit, or the claim is time-barred (article L. 133-24). **Business account.** The contract may depart from some rules (liability, proof, reporting deadline), but not from the refund obligation in article L. 133-18. ## Cour de cassation, 23 October 2024 (no. 23-16.267) A customer had lost €54,500 after following a caller who presented herself as an employee of his bank and had him re-register payees to “foil an attack”. The bank relied on the confirmations made with his PIN. The Court dismissed the appeal: it is for the bank to prove gross negligence. The adviser’s number displayed, trust in the caller, a manipulation presented as a security step: gross negligence was not made out. Vigilance is assessed in the concrete circumstances of the fraud. The judgment does not say that every spoofed call excludes gross negligence, nor that every confirmation obtained by deception makes the payment unauthorised. ## Everything turns on the facts Did the texts and notifications announce a payment, its amount, its payee? Did they contain a warning? What was the fraudster saying at the same moment? Those elements are read together with the length of the call and the sequence of the manipulations. Conversely, the absence of number spoofing does not, on its own, prove gross negligence. ## The right reflexes - Alert your bank through a verified channel, have the payment instruments blocked and dispute each transaction in writing. Keep the acknowledgement of receipt. - File a criminal complaint, without waiting before warning the bank: the refund does not depend on a criminal conviction. - Rebuild the timeline: call log, screenshots, texts, notifications, statements and exchanges with the bank. - Ask the bank for its technical evidence: the nature of the confirmations, the times, the wording displayed. - If the bank refuses, a reasoned complaint, then mediation or court proceedings, can be considered depending on the situation. GAUTELIER AVOCATS assists you in reviewing your file and pursuing your claim for a refund. [Contact the firm](/en/contact) to take stock. *General information, not legal advice. The rules apply in the version in force on the date of the transactions.* --- ## Contact details - **Salon-de-Provence** (Head office) : 109, avenue Gaston Cabrier, 13300 Salon-de-Provence - **Paris** (Paris office) : 22, rue Bréguet, 75011 Paris — By appointment only - Phone : +33 (0)4 90 50 41 58 - Email : contact@gautelier-avocat.com - Hours : Monday to Friday, 9 am – 12 pm / 2 pm – 6 pm - [Contact form](https://gautelier-avocats.com/en/contact) *Source : https://gautelier-avocats.com/en/news/bank-impersonation-fraud*