A payment is only authorised if you consented to its execution (Monetary and Financial Code, article L133-6): validating a login, a new payee or a so-called cancellation is not consenting to the payment itself.

For an unauthorised payment reported in time, the bank refunds it by the end of the next business day at the latest, unless it suspects your fraud and tells the Banque de France in writing; if it is late, the sums bear interest at the legal rate plus 5 points, 10 beyond 7 days and 15 beyond 30 days (article L133-18).

If you validated the payment amount and payee, establish what you actually consented to: fraud does not automatically make the transfer unauthorised. Keep screens, messages and call evidence. Card use without your consent belongs to the card fraud guide in French.

Sources: CMF L133-6 · CMF L133-18

What counts as gross negligence with a fake bank adviser?

You bear all the losses if they result from your fraud or from an intentional or grossly negligent breach of your security and alert duties (article L133-19, IV). The record of the payment does not prove it by itself: the bank must bring the evidence (article L133-23).

The Cour de cassation upheld the absence of gross negligence (négligence grave) where the number displayed was the adviser’s own and this “spoofing” had lowered the client’s guard (23 October 2024, no. 23-16.267), then where a so-called technician called from a spoofed bank number (12 June 2025, no. 24-13.777).

Sources: CMF L133-19 · CMF L133-23 · Cass. com. 23 Oct. 2024 · Cass. com. 12 June 2025

Does strong authentication prove that you accepted the payment?

Not by itself: the use of the instrument recorded by the bank does not necessarily prove authorisation or gross negligence (article L133-23). For a remote payment, strong authentication must link the transaction to a given amount and payee (article L133-44).

For an unauthorised payment, if the bank did not require strong authentication, you bear no financial consequence, unless you acted fraudulently (article L133-19, V).

Sources: CMF L133-23 · CMF L133-44 · CMF L133-19

How long do you have to dispute, and with whom?

Report the payment without delay, and at the latest 13 months after the debit or the claim is time-barred (forclusion), unless the bank neither provided nor made available the payment information; for a business account, the agreement may set another time limit (article L133-24).

The 13-month limit is not universal: unauthorised card payments with a payee provider outside the EEA can fall under 70 days, contractually extended up to 120; Saint-Pierre-et-Miquelon and Saint-Barthélemy also have specific scope (articles L133-1 and L133-1-1). Check those territories before using the ordinary tool.

The bank answers a written complaint within 15 business days, 35 at most in exceptional cases (article L133-45). An individual can then refer the dispute to the mediator free of charge, at the latest 1 year after the written complaint (Consumer Code, articles L612-1 and L612-2).

Sources: CMF L133-24 · CMF L133-45 · C. consom. L612-1 · C. consom. L612-2 · CMF L133-1-1 · CMF L133-1

Which time limits run after a fake bank adviser fraud?

From the report to the bank to the mediator, the time limits of the Monetary and Financial Code and the Consumer Code.

Fake bank adviser fraud: legal time limits in force on 26 September 2026
Step	Time limit	Text
Report the payment to the bank	Without delay, within 13 months of debit unless information was neither provided nor made available	Art. L133-24 CMF
Refund an unauthorised payment	By the end of the next business day after a report complying with L133-24, unless suspected payer fraud is reported in writing to the Banque de France	Art. L133-18 CMF
Interest if the refund is late	Legal rate + 5 points; + 10 points after 7 days; + 15 points after 30 days	Art. L133-18 CMF
Answer the written complaint	15 business days, 35 at most in exceptional cases	Art. L133-45 CMF
Refer to the mediator, for an individual	At the latest 1 year after the written complaint	Art. L612-2 Consumer Code
Close the mediation	90 days after the referral is notified, extendable for a complex dispute	Art. R612-5 Consumer Code

For a business account, the agreement may set another reporting time limit (article L133-24) and set aside the rules on sharing losses and on proof (article L133-2).

Sources: CMF L133-24 · CMF L133-18 · CMF L133-45 · C. consom. L612-2 · C. consom. R612-5 · CMF L133-2

Say what you validated during the call, the authentication requested, whether payment information was provided or made available and the dates of the debit, the report and the complaint: the brief ends with its reasons. The example: an individual who validated a so-called new payee, a debit and a report on 2 June 2026, a complaint on 10 June 2026, then a refusal.

What did the Cour de cassation decide in 2024 and 2025?

Two rulings of the commercial chamber on the gross negligence the bank raised against the victim.

23 October 2024
The number displayed was the adviser’s own and the client believed they were re-registering payees: the “spoofing” won their trust and lowered their guard, so gross negligence is not established. The bank’s appeal is dismissed and the order to pay €54,500 upheld (no. 23-16.267).
Source: Cass. com. 23 Oct. 2024
12 June 2025
An employee believed the caller, who used a spoofed bank number, was a bank technician: the bank had to prove the gross negligence of its client, a company, and did not. Appeal dismissed, refund of €98,000 upheld (no. 24-13.777).
Source: Cass. com. 12 June 2025

What does article L133-23 of the Monetary and Financial Code say?

The text that puts the burden of proof on the bank when you deny having authorised the payment.

Lorsqu’un utilisateur de services de paiement nie avoir autorisé une opération de paiement qui a été exécutée, ou affirme que l’opération de paiement n’a pas été exécutée correctement, il incombe à son prestataire de services de paiement de prouver que l’opération en question a été authentifiée, dûment enregistrée et comptabilisée et qu’elle n’a pas été affectée par une déficience technique ou autre. L’utilisation de l’instrument de paiement telle qu’enregistrée par le prestataire de services de paiement ne suffit pas nécessairement en tant que telle à prouver que l’opération a été autorisée par le payeur ou que celui-ci n’a pas satisfait intentionnellement ou par négligence grave aux obligations lui incombant en la matière. Le prestataire de services de paiement, y compris, le cas échéant, le prestataire de services de paiement fournissant un service d’initiation de paiement, fournit des éléments afin de prouver la fraude ou la négligence grave commise par l’utilisateur de services de paiement.

Article L133-23 of the Monetary and Financial Code (in French)Version in force on 26 September 2026 (in force since 13 January 2018)Read the article on Légifrance (in French)

In English, briefly (our summary, not an official translation): When a user denies having authorised an executed payment, the bank must prove that it was authenticated, duly recorded and entered in the accounts, and not affected by a technical or other breakdown. The use of the instrument as recorded by the bank does not necessarily prove on its own that the payer authorised it or was grossly negligent: the bank must bring evidence of the fraud or gross negligence. For a business account, the agreement may set this article aside (article L133-2).

Which evidence should you attach to your complaint?

What shows that you did not consent to the payment and that the call was credible.

Document 1
Bank statements
Each disputed payment, with its debit date, amount and payee.
Document 2
Call log
A screenshot of the number displayed during the call, to show the bank’s number was spoofed.
Document 3
Messages and screens
The texts, emails and notifications received during the call, and the wording of the screens you validated.
Document 4
Written timeline
The time of the call, what the caller knew about you and what they made you do, step by step.
Document 5
Police complaint receipt
A complaint for fraud (escroquerie) at the police, the gendarmerie or in writing to the public prosecutor; the bank may ask for a copy.

What do victims of a fake bank adviser ask?

Do you need a police complaint to be refunded?

Article L133-18 makes the refund depend on reporting to the bank, not on a complaint. File a complaint for fraud anyway (Penal Code, article 313-1): the bank may ask for a copy to process your claim, according to Cybermalveillance.

What should you do right after the call?

Call your bank back through its usual channels, block the card if it was used, report each payment and ask for the refund, suspension or return of the funds. According to Cybermalveillance, a real adviser will never ask you to validate or cancel transactions in your banking app.

Can the bank refuse by claiming gross negligence?

It must then prove it (article L133-23), and the 2024 and 2025 rulings assess specific facts: validation requested by a credible fraudster did not establish gross negligence in those cases. Ask in writing for the evidence it relies on.

What if you followed the caller’s instructions in your online banking?

You must protect your security credentials (article L133-16), but the bank must prove gross negligence, judged by how credible the call was: in 2025 a refund was upheld where the employee had logged in with the security device and made changes at the fraudster’s request, the fraudster reading out the code shown on the screen.

Is a business account protected in the same way?

Not necessarily: the agreement may set aside articles L133-19 and L133-23 (article L133-2) and fix a time limit other than 13 months (article L133-24), and the consumer mediator is for individuals only.

Which guides should you read after a banking fraud in France?

Consumer and banking law in France: every English guide
The index of this domain’s English pages, by question.
Unauthorised SEPA direct debit in France
Disputing a debit you never agreed to.
Identity theft in France
The steps when a fraudster uses your details.
Car garage dispute in France
The arguments and the texts to rely on.
Cold calling in France
What changed, and since when.

Which texts is this brief based on?

Monetary and Financial Code, article L133-6 (consent to the payment)Légifrance, in French
Monetary and Financial Code, article L133-18 (refund)Légifrance, in French
Monetary and Financial Code, article L133-19 (losses and gross negligence)Légifrance, in French
Monetary and Financial Code, article L133-23 (proof)Légifrance, in French
Monetary and Financial Code, article L133-44 (strong authentication)Légifrance, in French
Monetary and Financial Code, article L133-24 (reporting within 13 months)Légifrance, in French
Monetary and Financial Code, article L133-45 (answering complaints)Légifrance, in French
Cour de cassation, commercial chamber, 23 October 2024, no. 23-16.267Légifrance, in French
Cour de cassation, commercial chamber, 12 June 2025, no. 24-13.777Légifrance, in French
Consumer Code, article L612-2 (admissibility before the mediator)Légifrance, in French
Consumer Code, article L612-1 (free mediation)Légifrance, in French
Consumer Code, article R612-5 (length of the mediation)Légifrance, in French
Monetary and Financial Code, article L133-16 (security of credentials)Légifrance, in French
Monetary and Financial Code, article L133-17 (informing without delay)Légifrance, in French
What to do after a fake bank adviser fraudCybermalveillance.gouv.fr, in French · updated on 7 May 2026
Penal Code, article 313-1 (fraud)Légifrance, in French
Monetary and Financial Code, article L133-2 (exceptions for professionals)Légifrance, in French
Monetary and Financial Code, article L133-1-1 (specific territorial card scope)Légifrance, in French
Monetary and Financial Code, article L133-1 (territorial scope)Légifrance, in French

Texts cited last checked: 26 September 2026

Did you consent to the payment itself or to a preparatory operation?