Background
On December 16, 2019, an administrative assistant to the president of Eleco Panacol, later renamed Hoenle Eleco, was contacted by someone impersonating the company’s lawyer. The assistant faxed HSBC Continental Europe an international transfer order bearing a forged imitation of the president’s signature, purportedly to finance a transaction through a Hungarian bank, and confirmed the instruction by email. HSBC executed the transfer the following day.
Hoenle Eleco, alleging that it had fallen victim to “CEO fraud,” sued HSBC for reimbursement of the unauthorized transfer and damages. Although fax-confirmed transfer orders had been used under a 2009 agreement, the company had switched in March 2017 to HSBC Connect under the secure EBICS TS protocol, which used Exabanque software and a 3S Key digital security device. The Paris Court of Appeal found that the fax was no longer the agreed payment instrument and that the transfer was unauthorized, but nevertheless rejected the company’s claims on the ground that HSBC had established gross negligence by its customer.
The Court’s Holding
The Court of Cassation held that, under Articles L. 133-16 and L. 133-19(IV) of the Monetary and Financial Code, interpreted in light of Articles 69 and 74 of Directive (EU) 2015/2366, a payment-service provider may avoid liability for an unauthorized payment only where the user, through gross negligence, fails to use the payment instrument supplied to it in accordance with the governing conditions or fails to take reasonable measures to protect personalized security credentials.
Because the Court of Appeal had found that fax was no longer the payment instrument agreed between the parties, HSBC could not accept and execute an instruction sent through that obsolete method and then fault Hoenle Eleco for gross negligence in using it. The Court therefore quashed the appellate judgment in full and remanded the case to a differently constituted panel of the Paris Court of Appeal. It did not itself enter judgment awarding reimbursement or damages.
Key Takeaways
- A bank cannot rely on a customer’s supposed gross negligence concerning a method that was no longer the contractually agreed payment instrument.
- The statutory gross-negligence defense for unauthorized payments is tied to the user’s obligations concerning the payment instrument actually supplied and its personalized security credentials.
- The decision reverses the rejection of Hoenle Eleco’s claims but leaves the reimbursement and damages issues for determination on remand.
Why It Matters
The ruling limits banks’ ability to shift losses from impersonation fraud to corporate customers when the bank processes an instruction outside the parties’ agreed secure-payment channel. A provider that accepts an obsolete or unauthorized transmission method cannot use alleged carelessness in that method as the basis for its statutory defense.
For businesses and payment providers, the decision underscores the importance of clearly defined authorization procedures—and of banks adhering to them when handling unusual or high-risk transfer requests.