Background
SCI Ra-immo hired Hanny to construct a building. In January 2020, the property company sent Crédit lyonnais a certified progress-payment statement and an invoice for €189,893.14 identifying Hanny’s genuine account at Société générale. Two days later, SCI Ra-immo forwarded an email purportedly from Hanny stating that the original account was inactive and directing future payments, expressly including that invoice, to a different account at Bank Santander Totta. Crédit lyonnais made the transfer to the substituted account.
In February 2020, SCI Ra-immo sent the bank another certified progress-payment statement and an invoice for €175,404.11 that again listed Hanny’s genuine Société générale IBAN. Crédit lyonnais nevertheless transferred the money to the Santander Totta account. The following day, SCI Ra-immo notified the bank that Hanny had never changed accounts and that the earlier request was fraudulent. It sued Crédit lyonnais for reimbursement and damages, alleging a breach of the bank’s duty of vigilance. The Lyon Court of Appeal rejected the claims concerning both transfers.
The Court’s Holding
The Court of Cassation upheld the rejection of the claim concerning the first transfer. The lower court was entitled to find from the successive emails that SCI Ra-immo had instructed the bank to make that payment to the Santander Totta account. Because the bank executed the transfer in accordance with the unique identifier supplied by its customer, the exclusive liability regime under Article L. 133-21 of the Monetary and Financial Code applied, precluding a claim based on ordinary contractual liability and an asserted duty of vigilance.
The Court reached a different conclusion regarding the second transfer. Under Articles L. 133-6 and L. 133-7 of the Monetary and Financial Code, read with Article 1353 of the Civil Code, the payment service provider bears the burden of proving that the payer authorized the transaction, including its beneficiary, in the form agreed by the parties. Because the February transmission included an invoice bearing Hanny’s genuine IBAN, Crédit lyonnais—not SCI Ra-immo—had to produce the payment order establishing authorization to use the Santander Totta account. By requiring SCI Ra-immo to prove its specific instructions for the second payment, the Court of Appeal improperly reversed the burden of proof.
The Court therefore partially quashed the appellate judgment, leaving intact only the rejection of reimbursement for the first transfer. It remanded the remaining claims to a differently constituted panel of the Lyon Court of Appeal and ordered Crédit lyonnais to pay costs and €3,000 toward SCI Ra-immo’s legal expenses.
Key Takeaways
- A transfer is authorized when the payer consents to its execution in the form agreed with the payment service provider; that authorization may be inferred from the payer’s communications.
- When a bank executes an authorized payment using the unique identifier supplied by its customer, the statutory payment-services liability regime is exclusive and displaces ordinary contractual-liability claims.
- If the payer disputes authorization, the payment service provider bears the burden of proving authorization as to the beneficiary and may need to produce the relevant payment order.
Why It Matters
The decision distinguishes between a customer’s mistaken authorization of a fraudulently substituted account and a transfer for which the bank cannot prove authorization to use that account. Banks may rely on the statutory protection applicable to an incorrect unique identifier when the customer actually supplied and authorized it, but they cannot shift onto the customer the burden of proving what instructions accompanied a later disputed transfer.
For businesses and payment providers confronting invoice-redirection fraud, the ruling makes the transaction-specific authorization record decisive. An earlier instruction changing a beneficiary’s account details does not automatically relieve the bank of proving authorization for a subsequent payment, particularly when the later invoice identifies the beneficiary’s genuine account.