Facing Evolution of Banking Fraud Techniques: Are Victims Truly Protected Under European Law?

The Evolution of Banking Fraud Techniques: Are Victims Truly Protected Under European Law?

Banking fraud techniques have undergone profound transformation, while the law has struggled to keep pace with these developments.

Until recently, fraud followed a relatively straightforward pattern: a stolen card, a compromised account, or a transaction carried out without the customer’s consent, automatically triggering the bank’s obligation to reimburse the victim. The simple distinction between “authorised” and “unauthorised” transactions was sufficient to determine the bank’s liability.

This binary framework is now being tested by increasingly sophisticated methods employed by fraudsters.

When the Victim Initiates the Transaction

Modern fraud schemes (including spoofing, CEO fraud, falsified bank details, and fake suppliers) are all based on manipulation: the fraudster induces the victim to carry out the transaction themselves.

The victim validates a transfer, confirms a payment, or uses their own authentication tools, believing they are securing their assets or issuing a legitimate instruction.

From a technical standpoint, the transaction appears regular, save for one critical detail: consent has been obtained through deception and is therefore vitiated.

The central question is thus whether it is truly possible to speak of “consent” where payment has been procured through manipulation.

A Dichotomy No Longer Fit for Purpose

Payment services law traditionally distinguishes between “authorised transactions” (in principle non-refundable) and “unauthorised transactions” (refundable).

However, this distinction becomes fragile where a customer, having been misled, personally initiates a transfer within a complex fraud scenario.

Thus, an unauthorised transfer (compromised account leading to reimbursement) is replaced by an authorised transfer (manipulated customer leading to disputed reimbursement), despite an identical economic outcome.

Paradoxically, the more sophisticated the fraud, the less protection the victim may enjoy, raising serious concerns as to the coherence of the legal framework.

Towards a Qualitative Assessment of Consent

The issue is no longer limited to the formal validity of a click or authentication code, but rather concerns the genuine intention of the payer.

The victim acts voluntarily, but on the basis of an error induced by a carefully constructed scenario: purported safeguarding of funds, instructions allegedly issued by a superior, or dealings with a fictitious supplier.

Under French civil law, consent obtained through deception constitutes dol and must be regarded as defective.

Banking law can no longer rely solely on a purely technical conception of authorisation.

Enhanced Duties of Vigilance and Burden of Proof

Recent case law has strengthened banks’ duty of vigilance, including in respect of transactions that appear to have been authorised.

Banks are expected to react where there are apparent anomalies: unusual transactions, abnormal amounts or frequency, atypical destination countries, or the addition of a new beneficiary in a high-risk context.

At the same time, the burden of proof has shifted. Where a customer disputes a transaction, it falls to the bank to demonstrate that authentication and security measures were properly implemented and that no technical failure occurred.

It is no longer for the customer to prove an absence of fault; rather, the bank must establish the reliability of its systems and the absence of irregularities.

Customer Negligence: A Relative Obstacle

Banks frequently invoke “gross negligence” on the part of the customer to refuse reimbursement.

However, recent case law has clarified that this notion cannot be equated with mere inattention or simple imprudence. It must be assessed in light of warnings provided, red flags present, and the bank’s overall conduct.

Customer negligence is therefore not, in itself, an automatic bar to reimbursement or to establishing the bank’s liability.

It remains necessary to determine whether the bank has complied with its own obligations of vigilance and security, and whether it can demonstrate the robustness of its systems.

A Shifting Fault Line

The key issue is no longer who entered the code or validated the transaction, but whether the customer genuinely intended to make the payment or was induced to do so by deception.

As fraud becomes increasingly psychological rather than technical, the allocation of risk between banks and customers is being fundamentally reshaped.

In this context, it is essential for both individuals and businesses to be aware of their rights, to challenge disputed transactions, and to scrutinise the conduct of their bank.

WEST AVOCATS  assist victims of fraud, assess their prospects of reimbursement, and, where appropriate, pursue claims against their banking institution.

Thierry Ygouf de Varese

French & Swiss (as UE mbr) Attorney at Law

thierry.ygouf@west-avocats.fr (or .ch)