We all regularly have the unpleasant experience of receiving a call from an unknown number, a suspicious message or a fraudulent email. Most of the time, mistrust stops us from responding. Now imagine that the number displayed is that of our bank adviser, or that the fake email comes from an address that is, if not known, at least expected. Caution fades, and our bank balance with it. Calls, messages and emails are therefore not merely irritating: they can give rise to large-scale fraud. Gone are the days of mundane swindles and absent-minded oversights: today, fraudsters are ever more ingenious, even as providers raise their security requirements. For users, the threat of fraud is ever greater and more complex. This proliferation of fraud cases is further aggravated by the complexity of the legal protection which, however effective, is sometimes difficult to grasp as a whole.
Indeed, the law governing what may be termed unauthorised payment transactions is a technical and opaque body of law, rooted in European texts which have themselves been transposed into the Monetary and Financial Code (code monétaire et financier), which must sometimes be reconciled with the general law of obligations. The growth in litigation has, moreover, given rise to an abundant body of case law from the French Supreme Court (Cour de cassation) and the CJEU, which regularly provides clarification or settles certain points of the regime that require interpretation. As a result, it is difficult for users to know their rights and duties in this area.
First, let us try to see more clearly from the standpoint of the legislation.
The law on payment instruments stems from the transposition of two directives (PSD1 and PSD2). The first, dated 13 November 2007, was transposed by the ordinance of 15 July 2009. It created a single legal regime applicable to all payment services and transactions (with the exception of cheques, which remain the monopoly of credit institutions). It was more recently repealed and replaced by the ordinance of 9 August 2017, transposing Directive 2015/2366 of 25 November 2015 (PSD2). The new regulations placed the emphasis on consumer protection and on combating fraud, abuse and payment incidents, while seeking to foster the emergence of innovative payment methods. Most of the provisions are found in Articles L.133-1 et seq. of the Monetary and Financial Code (CMF).
Next, let us outline the regime.
The legislature has put in place a regime that protects users, in that it requires the payment service provider to reimburse losses provided the user has acted diligently (L.133-18, CMF). Thus, where an unauthorised payment transaction follows the loss or theft of the payment instrument, the user must report it to the provider without delay. This report may not be made more than thirteen months after the event (L.133-24, CMF). In everyday language, this is known as stopping the payment. By way of exception, and in all cases, the user bears all losses incurred if those losses result from fraudulent conduct or if the user has committed an act of gross negligence (L.133-19, CMF). The question of what constitutes an act of gross negligence regularly comes before the French Supreme Court (Cour de cassation), which has, for example, recently held that a particularly well-crafted bank adviser scam could escape characterisation as gross negligence[1] but that clicking on a run-of-the-mill phishing link could amount to it[2].
Against this background, the legislature and the courts have had to dwell on several aspects of the regime at the end of 2025 and the beginning of 2026. First, the question of greatest practical interest concerns the treatment of psychological fraud in the field of bank transfers, whereby a user is deceived as to the bank details (RIB) to which funds are to be transferred. We will see that protection has come more from the legislature than from the courts (I). The other fundamental question concerns how the time limits for reporting an unauthorised transaction fit together, a matter that had been in limbo since 2023, awaiting a clear interpretation from the European judges. A judgment of 14 January 2026 has settled the question definitively (II).
I. The payment service provider must verify the payee of a bank transfer
The most widespread and dangerous fraud of recent times consists in catching the user of a payment service off guard by sending them false bank details, using techniques that are particularly difficult to counter. All sectors are affected and suffer from increasingly sophisticated practices that defy the vigilance of even the most wary. Legally, however, the transaction thus carried out is not, strictly speaking, unauthorised, since the user gave the instruction and authorised the transaction.
That is why the French Supreme Court (Cour de cassation) refuses to apply the statutory protection where such fraud is involved. In four cases[3] in which, among other things, emails had impersonated company chairmen (CEO fraud) and employees had made substantial transfers to fraudulent accounts, the Court held that the payment service provider liability regime applied only to unauthorised or incorrectly executed payment transactions. In other words, the special regime applicable to unauthorised payments could not be applied, since the payment had been authorised in the legal and banking sense of the term.
If the special law on payment instruments could not be relied upon, the remaining option was to rely on the general law of obligations, where Article 1231-1 of the Civil Code, the basis of contractual liability, could allow the provider to be held liable for breach of its duty of vigilance. But here too, the French Supreme Court (Cour de cassation) has proved uncompromising: the bank’s liability in respect of its duty of vigilance remains conditional on proof of an apparent anomaly, the only thing capable of establishing a breach of that duty, and one that is rare in this type of fraud. The solution is hardly favourable to payers, who found themselves defenceless in the face of ever more serious fraud and of case law that refused to treat the bank as an insurer. In other words, for a breach of the duty of vigilance to be established, the legislature had to step in.
In the meantime, the European legislature, aware of this gap, adopted Regulation (EU) No 2024/886 of 13 March 2024, which has applied since 9 October 2025. This regulation requires all payment service providers to check that the payee’s identifier (IBAN) matches the name entered by the payer. This mechanism, known as Verification of Payee (VoP), places a new form of vigilance requirement on providers and brings into their checks, beyond apparent anomalies alone, the matching of identities. In most cases, the false bank details still contain the payee’s identity; only the IBAN is changed. From now on, the provider will therefore have to check whether the payee’s identity matches that of the IBAN. Only where the user, despite the bank’s warning, persists in the error will they lose their right to reimbursement. In any event, the victim of “CEO fraud” is no longer defenceless!
II. How the time limits for reporting an unauthorised payment transaction fit together
Another major issue in recent years concerned the question, essential for providers and users alike, of how the time limits laid down in Article L.133-24 of the Monetary and Financial Code fit together. As a reminder, that article provides that the payment service user must report an unauthorised payment transaction to their payment service provider “without delay” and no later than thirteen months after the debit date, failing which the claim is time-barred. In everyday language, this is known as “stopping the payment”. Two interpretations of this article were possible. The first was that the user has thirteen months to contest a transaction, regardless of when they react. The second distinguished the reporting period from the time bar, interpreting the text as meaning that the notification period runs from a floating starting point and cannot exceed an absolute time bar of thirteen months. Faced with these questions, the French Supreme Court (Cour de cassation)[4] decided to refer several questions to the CJEU for a preliminary ruling; the CJEU answered them in a judgment of 1 August 2025[5], and those answers were definitively settled by a judgment of 14 January 2026[6] handed down by the Commercial Chamber of the Cour de cassation.
The judgment of 14 January 2026, which adopts the CJEU’s answers, thus holds that the first period is a notification period that starts to run from the moment the user became aware of the unauthorised transaction. This notification period, with its floating starting point, may not exceed a time bar of thirteen months. Beyond that, it is therefore impossible to report the unauthorised payment transaction. Finally, it should be noted that the French Supreme Court (Cour de cassation) has also held that the period in Article L.133-24 is not a period for bringing proceedings but a notification period[7]. Accordingly, once the transaction has been reported, the user is entirely free to bring an action against the payment service provider within the ordinary limitation period.
On the evidential side, the French Supreme Court (Cour de cassation) has finally held that the absence of proof of the date on which an unauthorised payment transaction was reported to the bank in itself amounts to gross negligence[8]. In other words, the report (the act of stopping the payment) is fundamental, since it alone determines the rest of the court’s reasoning. A user unable to prove the report therefore cannot obtain reimbursement of the sums in dispute.
To sum up, at the beginning of 2026, the regime for contesting unauthorised payment transactions can be summarised as follows:
In principle, the user is entitled to reimbursement of losses provided that:
They reported the unauthorised payment transaction without delay to their provider once they became aware of it, a report that may not be made beyond a time bar of thirteen months (L.133-24, CMF).
- Proof of this report is essential.
- They have not engaged in fraudulent conduct or committed an act of gross negligence (L.133-19, CMF).
This regime does not apply to “CEO fraud”, psychological fraud that leads the user to authorise a transfer to a fraudulent third party.
- The payment service provider’s liability can be assessed only in terms of its contractual liability and in the light of its duty of vigilance, which presupposes an apparent anomaly.
- European Regulation No 2024/886 of 13 March 2024, which has applied since 9 October 2025, now requires the provider to check the payee’s identifier against the payee identity entered. Since then, the provider may incur liability in this type of fraud.
[1] Com., 23 October 2024, No. 23-16.267
[2] Com., 28 March 2018, No. 16-200.18.
[3] Com., 19 November 2025, Nos. 24-19.776, 24-17.780, 24-17.056, 24-18.534; Com., 15 January 2025, No. 23-13.579; Com., 23 May 2024, No. 22-18.098.
[4] Com., 8 November 2023, No. 22-14.822
[5] CJEU, 1st August 2025, Case C-665/23
[6] Com., 14 January 2026, No. 22-14.822
[7] Com., 2 July 2025, No. 24-16.590.
[8] Com., 6 February 2026, No. 22-22.609
