Bank Card Fraud in France: How to Get Your Money Back

Discovering an unknown debit on your bank statement or receiving a payment notification for a purchase you never made is a stressful experience that thousands of people in France go through every year. Faced with this situation, banks can sometimes be reluctant to help, trying to shift the blame onto an alleged negligence of their client to avoid paying. However, French and European law is particularly protective: in the event of bank card fraud, reimbursement by the banking institution is, except under very specific exceptions, strictly mandatory and immediate. This comprehensive guide explains your rights in detail, the traps to avoid, and the steps to recover your money down to the very last cent.

---

The Legal Framework: A Principle of Quasi-Absolute Liability for the Bank

When it comes to banking fraud, the legislator has established a simple principle: it is the payment service provider (the bank) that bears the financial risk associated with the unauthorized use of the payment instruments it provides.

The Obligation of Immediate Reimbursement (Article L. 133-18 of the Monetary and Financial Code)

The founding text on this matter is *Article L. 133-18 of the Code monétaire et financier (French Monetary and Financial Code)*. This article stipulates that in the event of an unauthorized payment transaction reported by the user, the bank must refund the payer the amount of the unauthorized transaction immediately after becoming aware of the transaction or being informed of it, and in any event no later than the end of the first following business day.

Furthermore, the bank must restore the debited account to the state it would have been in had the unauthorized transaction not taken place (which includes reimbursing agios [overdraft interest], overdraft fees, or direct debit rejection fees generated by the fraud).

The Burden of Proof Lies with the Bank (Article L. 133-23)

This is a crucial point that often works to the consumer's advantage: *Article L. 133-23 of the Code monétaire et financier*** specifies that the recording of a payment transaction by the bank is not sufficient to prove that the transaction was authorized by the client, nor that the client acted fraudulently or failed to fulfill their obligations through gross negligence.

In plain English, it is not up to you to prove that you did not make the purchase, but it is up to the bank to prove that you authorized it or that you were guilty of characterized negligence.

The Major Distinction: With or Without a Secret Code (or Two-Factor Authentication)

The law distinguishes between two main situations that impact your level of financial liability:

• Fraud without the use of personalized security data (without PIN code, without validation SMS, without "3D Secure"): If your card was cloned (skimming) or your numbers were used online without validation by two-factor authentication, your liability is €0. The bank must refund the entirety of the debited amounts, without any deductible.
• Fraud with the use of security data (theft of the physical card with the PIN, or validation via a banking app): If the fraud took place before you blocked your card, a legal deductible of a maximum of €50 can be left to your charge (Article L. 133-19 of the Code monétaire et financier). However, this deductible does not apply if the loss or theft of the card could not be detected by you before the payment, or if the loss is due to a bank employee. Once the card has been blocked, no further sums can be left to your charge.

---

Concrete Examples of Fraud and Refund Calculations

To better understand how these rules apply, here are two practical situations frequently encountered by users.

Example 1: Hacking of Bank Card Details on the Internet (Phishing)

> The Situation: Thomas notices two suspicious debits on his banking app for computer equipment purchases on a foreign website, totaling €1,200. His bank card is still in his possession in his wallet. He received no validation SMS for these purchases, as the hackers managed to bypass the merchant website's security system.

>

> The Application of the Law: This is a fraudulent use of card data without physical presentation and without strong authentication. Under Article L. 133-19, Thomas's liability is completely cleared. The bank must refund him €1,200 as well as any associated processing or overdraft fees. The €50 deductible does not apply here.

Example 2: Theft of a Wallet with the Secret Code Obtained

> The Situation: Sarah has her handbag stolen in the metro. Unfortunately, she had written her PIN code in a notebook located in the same bag. Before she notices and blocks the card, the thief withdraws €400 from an ATM.

>

> The Application of the Law: Here, there was a theft of the physical instrument and use of the secret code.

> Scenario A (Simple negligence):* The bank considers that Sarah was imprudent but cannot prove gross negligence (for example, if the code was not directly identifiable). The bank applies the legal deductible. Sarah remains responsible for €50. The bank must refund her €350.

> Scenario B (Proven gross negligence):* If the bank manages to prove that Sarah clearly wrote "BANK CARD CODE" in the notebook or that she took 4 days to block the card even though she knew her bag had been stolen, the bank can invoke "gross negligence" (Article L. 133-16). In this case, the bank can refuse any refund, and the €400 remains Sarah's responsibility.

---

Step-by-Step Practical Steps to Get Your Refund

If you are a victim of fraud, you must act methodically and quickly. Carefully follow these 5 steps:

Step 1: Immediately Block Your Card (Mise en opposition)

As soon as you notice the loss, theft, or fraudulent use of your data, you must block your card.

• Call the interbank card blocking server at 0892 705 705 (available 24/7).
• Or do it directly from your bank's mobile application (often the fastest and free option).
• Carefully note down the registration number of the blocking request and the exact time.

Step 2: Report the Fraud on the Government Platform "Perceval"

Even before going to the police station, log on to the official public administration website to use the Perceval online service (available on the Service-Public.fr website). This system allows you to report bank card fraud online.

• You will need your bank card number and the statement showing the fraudulent transactions.
• At the end of the process, you will receive an official receipt of your report (récépissé). This document is essential evidence to provide to your bank to speed up the refund.

Step 3: File a Complaint (If Necessary)

Filing a formal complaint (déposer plainte) with the gendarmerie (national military police) or the national police is highly recommended, and becomes mandatory if your physical card was stolen or if your bank explicitly requires it (although, legally, the bank cannot condition the refund on filing a complaint for simple internet fraud). Bring your Perceval receipt to facilitate the investigators' work.

Step 4: Send the Formal Refund Request to the Bank

Send a lettre recommandée avec accusé de réception (LRAR - registered letter with acknowledgement of receipt) to your bank branch. Your letter must contain:

• The detailed list of the disputed transactions (dates, amounts, beneficiaries).
• A copy of the Perceval report receipt or the police complaint.
• A reminder of *Article L. 133-18 of the Code monétaire et financier*** requiring immediate reimbursement.
• A request for the return of associated fees (blocking fees, agios).

Step 5: Contact the Banking Ombudsman in Case of Refusal

If the bank refuses to refund you, ignores your request beyond 15 business days (the legal deadline to respond to a written complaint according to Article L. 133-45), or maintains that you were "grossly negligent" without providing material proof, you must contact your bank's Médiateur (Ombudsman) free of charge. Their contact details can be found on your bank statements and on your institution's website.

---

Deadlines, Amounts, and Key Figures to Remember

To assert your rights effectively, you must keep in mind the deadlines and limits set by French law:

• 13 months: This is the maximum period you have to report an unauthorized transaction to your bank (Article L. 133-24 of the Code monétaire et financier). This period runs from the date the account was debited. If the payment service provider's establishment is outside the European Union or the European Economic Area, this period is reduced to 70 days.
• 1 business day: This is the maximum time the bank has to refund you after receiving your report (Article L. 133-18).
• €50: This is the maximum amount of the deductible remaining your responsibility in the event of loss or theft of the physical card before blocking, only if the secret code was used without gross negligence on your part.
• €0: Your mandatory remaining liability if the fraud took place online without strong authentication, or if your card was counterfeited.
• 15 business days: The maximum time allowed for the bank to respond to a written complaint regarding a dispute over payment services.

---

Mistakes to Avoid at All Costs

To avoid giving your bank arguments to reject your refund request, absolutely avoid these behaviors:

• Do not delay in blocking your card: Waiting several days after discovering the theft of your card or a suspicious debit is qualified as negligence by the courts. Block your card within minutes or hours of discovering the anomaly.
• Never disclose your security codes (SMS or app): If you receive a call from a bank advisor (who is actually a fraudster practicing phone spoofing) asking you to validate a transaction on your app "to cancel a fraud," do not do it. Case law from the Cour de cassation (French Supreme Court) now considers that the active validation of a transaction by the client via their two-factor authentication app, even under the influence of a manipulative third party, can be qualified as gross negligence, depriving the victim of their right to a refund.
• Do not automatically accept card re-issuance fees: If you are a victim of fraud without loss or theft of your card (data hacking), the bank must replace your card free of charge. Refuse any fees for manufacturing a new card that might be unduly charged to you.
• Do not give in to bank blackmail demanding a police complaint for online fraud: The law is clear: reporting on the Perceval platform is more than enough for "contactless" or "internet purchase" type fraud. Do not waste hours at the police station if the police refuse to take your complaint for this reason; the Perceval receipt has the same legal value with banks.

---

FAQ: Frequently Asked Questions About Fraud Refunds

My bank refuses to refund me because I validated the payment via my mobile app (3D Secure). Do they have the right?

Yes and no, it depends on the circumstances. The Cour de cassation has recently hardened its position: if you voluntarily validated a transaction on your mobile banking app (strong authentication) thinking, for example, that you were cancelling a hack while speaking to a fake advisor, the judges may consider that you showed "gross negligence." However, the bank must provide irrefutable technical proof that it was indeed your registered device that validated the transaction and that you were alerted to the suspicious nature of the transaction. If it was a simple validation SMS intercepted by hackers, the bank must refund you.

What should I do if my bank delays refunding me and leaves me overdrawn?

The law imposes a refund no later than the business day following the report. If the bank delays, it is at fault. You must send them a formal notice (mise en demeure) by registered letter demanding immediate reimbursement increased by late-payment interest at the legal rate, as well as the immediate cancellation of all overdraft fees (agios, intervention commissions) generated by the fraud.

I live abroad but have a bank account in France. Am I protected in the same way?

Yes, absolutely. The French Code monétaire et financier applies to all accounts opened with banking institutions located on French territory, regardless of the nationality or place of residence of the account holder. You have the same rights and the same 13-month period to contest fraud. You can also make your report on the Perceval platform remotely using your FranceConnect credentials.

Can the bank charge me card blocking fees or fraud file processing fees?

No. Article L. 133-26 of the Code monétaire et financier expressly prohibits banks from charging fees for reporting an unauthorized transaction or for blocking a bank card. Any such fees appearing on your statement must be fully refunded to you.

---

In Summary

• Reimbursement is mandatory and immediate: Unless the bank provides proof of fraud or gross negligence on your part, it must credit your account no later than the business day following your report.
• Zero remaining liability for online fraud: If your bank details were hacked on the internet without physical theft of your card, you do not have to pay any deductible.
• A maximum deductible of €50: This amount can be retained by the bank only in the event of the use of your lost or stolen physical card before you blocked it.
• Act within 13 months: This is the strict legal timeframe to contest a fraudulent debit on your bank account.
• Report on Perceval: This official state service generates a receipt which is your best weapon to compel the bank to refund you quickly.

---

Legal information for guidance only, not personalised legal advice. For your specific situation, ask your question free of charge on AvocatAI — answers based on French law, in your language.