Background
M. [W] [D] said he had been the victim of bank-card fraud between March 20 and 23, 2018. By an application dated March 23, 2021, he brought the matter before a victim-compensation commission. The dispute ultimately concerned compensation from the Fonds de garantie des victimes des actes de terrorisme et d’autres infractions, the French guarantee fund for victims of terrorism and other offenses.
The Lyon Court of Appeal, Sixth Chamber, issued the challenged judgment on January 16, 2025. M. [D] appealed to the Court of Cassation in case No. F 25-12.778, advancing a single ground of cassation. He complained that the appeal court had found him guilty of fault excluding his right to compensation and had declared his compensation claim against the guarantee fund inadmissible. That description formed part of his pleaded grievance; the Court of Cassation’s own analysis addressed whether the appeal court could infer compensation-defeating fault from its factual findings.
The case was communicated to the prosecutor general. Following the report of Mme Salomon, conseillère rapporteure, and submissions from counsel for both parties, the appeal was argued at a public hearing on September 23, 2026. Those present were Mme Martinel, présidente; Mme Salomon; Mme Isola, conseillère doyenne; and Mme Cathala, greffière de chambre. The Second Civil Chamber, composed of the president and the two aforementioned conseillères, deliberated and issued judgment No. 1121 F-B.
The Court’s Holding
The Court rejected the appeal. It explained that Article 706-14 of the Code of Criminal Procedure permits a victim of specified offenses, including fraud, to obtain compensation when the victim cannot obtain effective and sufficient reparation or compensation from any source, consequently faces serious material or psychological circumstances, and satisfies the applicable means condition. Compensation is governed by Articles 706-3 through 706-12. Under the final paragraph of Article 706-3, reparation may be refused or reduced because of the victim’s fault.
The Court then reviewed the findings supporting the Lyon judgment. M. [D] received an email on March 20, 2018 bearing a logo similar to that of the health-insurance authority and stating that he was eligible for a reimbursement. The email did not identify its sender and contained two spelling errors. The appeal court first found that he lacked vigilance by clicking its hyperlink.
The appeal court next found that M. [D] entered his social-security number, password, and bank-card number in his personal account area. He subsequently received two text messages supplying two single-use security codes and telling him to call his bank if he had not initiated the banking transactions. Finally, although he said he expected a reimbursement of approximately €88, the messages expressly informed him that the transactions were disproportionate to that amount, involved payments he was making rather than reimbursements, and that the first payment transaction was expressed in a foreign language.
On those findings, the Court held that the appeal court “could,” without incurring the alleged errors, infer fault by the direct victim having a “certain and direct causal link” with the damage. The appeal court had sovereignly assessed that this fault excluded any right to compensation. The Court therefore concluded that the single ground was unfounded. It did not independently recharacterize the victim’s conduct or announce that every phishing victim who discloses credentials necessarily forfeits compensation.
The Court dismissed the appeal, left costs to the Public Treasury, and rejected the applications made under Article 700 of the Code of Civil Procedure. The judgment was publicly pronounced on November 5, 2026 by being made available at the Court’s registry, after the parties had received the notice required by the second paragraph of Article 450.
Key Takeaways
- The Court upheld the result on the particular findings: an unidentified sender, spelling errors, entry of sensitive credentials, disregard of security-code warnings, and express payment information inconsistent with the expected €88 reimbursement.
- Its holding was that the Lyon court could infer direct-victim fault with a certain and direct causal link to the loss; the exclusion of all compensation rested on the lower court’s sovereign assessment.
- The decision applies the statutory possibility of refusing or reducing reparation for victim fault, but does not establish a universal rule denying compensation to phishing victims.
Why It Matters
The judgment illustrates the fact-sensitive boundary between victim compensation and victim fault in a phishing case. The statutory scheme can compensate fraud victims who lack effective and sufficient recovery and meet the other conditions, yet Article 706-3 permits fault to affect that relief.
For practitioners, the decisive point is the Court’s limited formulation: the accumulated findings permitted the appeal court’s inference and its sovereign assessment. The judgment should therefore not be read as a categorical rule that clicking a fraudulent link, entering security information, or overlooking warnings automatically eliminates compensation in every case.