For several years now, scams and fraud involving bank cards and accounts have continued to increase, both in number and in the sophistication of the methods used by cybercriminals to carry them out.
The aim of these criminals is simple: by any means possible, they seek to obtain confidential information and security codes voluntarily provided by victims, allowing them to steal funds — sometimes right in front of their victims, who only realise the deception later.
To obtain this valuable confidential information, cybercriminals use every possible method. Today, these scams have become highly organised processes, carefully planned and executed by their perpetrators.
One of the most recent methods, which is currently causing significant damage, is known as “spoofing”. Derived from the verb “to spoof”, meaning “to impersonate” or “to parody someone”, this technique involves cybercriminals pretending to be banking institutions in order to steal customers’ banking details.
Through the cases reported and complaints filed, a clear pattern has emerged. From start to finish, the operation is a role-playing exercise in which the cybercriminal adopts the identity of a helpful and attentive bank adviser assisting a customer who has supposedly been the victim of fraud.
1) The victim receives a call from what appears to be the bank’s fraud department or their personal adviser, as the displayed phone number is the usual and recognised number of the bank.
2) The “fake adviser” immediately creates a sense of urgency and panic by informing the victim that fraudulent activity has taken place or is currently occurring on their bank account. As a result, the victim loses their usual caution and security reflexes.
3) Once anxiety has been created, the cybercriminal provides personal information about the victim to make them believe they are genuinely speaking with a bank employee (customer identification details, phone number, last digits of the bank card, date of birth or postal address), thereby creating a false sense of trust and reassurance.
4) The cybercriminal then reassures the customer by offering immediate solutions (blocking fraudulent transfers, cancelling the bank card, securing the account), which require actions or confirmations from the victim.
5) To do so, SMS messages and sometimes secure notifications are sent simultaneously to the victim, apparently coming from the impersonated bank. By approving these supposed “security” operations at the request of the caller or by providing instant confirmation codes, the victim actually enables the cybercriminal to transfer funds under the appearance of legitimate authorisation.
This is precisely the difficulty faced by victims: by providing these validation codes, they are often — far too often — denied reimbursement following the fraud.
Article 1937 of the French Civil Code provides:
“The depositary must return the deposited item only to the person who entrusted it to them, or to the person on whose behalf the deposit was made, or to the person designated to receive it.”
The French Monetary and Financial Code, particularly Articles L.133-17 to L.133-18, L.133-19, L.133-23 and L.133-24, in their wording resulting from the transposition of Directive (EU) 2015/2366 of 25 November 2015 on payment services through Ordinance no. 2017-1252 of 9 August 2017, establishes the rules applicable to fraudulent use of payment instruments.
These provisions establish that, as a general rule, fraudulent transactions carried out on a customer’s account without their authorisation and which are not the result of their gross negligence must be reimbursed by the banking institution holding the account.
The burden of proving that the transaction was properly authorised lies with the banking institution.
Unfortunately, banks frequently refuse to reimburse stolen amounts by claiming that their customers were guilty of gross negligence because they voluntarily disclosed confidential codes or login information.
This widespread practice of refusing reimbursement was also the subject of a complaint filed by UFC-Que Choisir against 12 banks, leading to the introduction of new consumer protection measures under the law of 16 August 2022 on purchasing power, including penalties for late reimbursement of fraud victims.
Following this consumer protection development, case law has also evolved.
In a judgment dated 28 March 2023, the Court of Appeal of Versailles overturned the initial decision and granted the claim of an individual who had fallen victim to a spoofing scam, resulting in the hacking of her accounts for the considerable amount of €54,500. Unsurprisingly, the bank had refused reimbursement, arguing that the customer had acted negligently by approving the transactions through secure authentication on her personal banking application.
To reject the claim of gross negligence, the Court of Appeal of Versailles considered that the customer had a legitimate belief that she was receiving a call from her bank, supported by the fact that the displayed number corresponded to her previously saved adviser’s number and that her adviser’s name appeared on her phone.
The judges therefore took into account the particularly sophisticated nature of spoofing techniques, which can effectively undermine customers’ ability to distinguish between genuine and fraudulent communications.
It would be desirable for all courts to continue this development in banking fraud cases. Faced with increasingly sophisticated techniques, legal rules and banking practices cannot remain frozen in time.
This is essential to ensuring legal certainty for individuals.
The first step is, of course, to remain increasingly cautious when using payment methods and when faced with the many phishing attempts occurring every day.
However, if your bank account has been defrauded and your bank refuses to reimburse you, do not hesitate to contact us.
Thanks to its expertise, LEXSTONE AVOCATS, located in Puget-sur-Argens and Rocbaron, assists you throughout the entire procedure to ensure it is as efficient, affordable and swift as possible. The firm has recently successfully represented one of its clients who was the victim of this type of fraud.
If you wish to carefully review your case and obtain compensation for your losses, seeking assistance from a lawyer remains the best option.
