How a SIM Swap Drained Nearly €17,000 From an 82-Year-Old Customer's Account

On 5 December 2022, an 82-year-old BNP Paribas customer received a letter saying her SFR mobile subscription had been cancelled and her phone number transferred to Free Mobile. She had not requested the change. It was the first sign of a “SIM swapping” attack, in which fraudsters move a victim’s number to a SIM card they control so they can intercept security codes sent by text message.

The customer reacted the next day, filing a complaint for identity theft and alerting SFR, Free and BNP Paribas. She also asked her bank to block her Visa card. Despite those alerts, four transfers left her account between 7 and 13 December and went to a third party, for a total of €16,964.

BNP Paribas refused to return the money, arguing the transactions were validated with a digital key and therefore authorised. The customer died in 2025, and her heirs continued the case. On 25 November 2025, the Paris judicial court ruled against BNP Paribas and Free Mobile.

The court found BNP Paribas had not shown it took the necessary measures to stop the fraudulent operations after being alerted, nor that the victim had shared her personal data. It ordered BNP Paribas to repay €16,964 plus €2,500 in legal costs. Free Mobile, which had transferred the number without sufficiently verifying the requester's identity, must bear half of the amount BNP Paribas has to restore.

Advertisement

Why the Paris Court Blamed Both BNP Paribas and Free Mobile

BNP Paribas Could Not Overcome the Prior-Alert Problem

Banks are not automatically liable for every fraud, but the timing of the customer’s warning was central. BNP Paribas knew of the identity theft before the transfers on 7–13 December, yet the court found no evidence that the bank had taken adequate steps to block the account or the digital-key channel. The bank’s argument that the operations were authorised because they used a digital key failed because it did not prove the customer had shared the data needed to create or use that key. In legal terms, the bank carried the burden of showing customer negligence and did not meet it.

Free Mobile’s Identity Check Became the Second Point of Failure

The court also held Free Mobile responsible for the original compromise. The operator had transferred the customer’s number to a new SIM card without sufficiently checking the identity of the person requesting the transfer. That failure created the fraud condition: once the fraudsters controlled the number, they could receive authentication messages tied to the bank account. By ordering Free to cover half of the refund, the judges treated the SIM transfer and the bank’s later inaction as connected points of failure rather than separate episodes.

What This Signals for Similar Cases

The judgment does not mean banks and operators are automatically liable in every SIM-swap case, but it strengthens the position of victims who can show they alerted both parties promptly. In this case, the customer did everything the system expects: she notified the bank, the old operator and the new operator, filed a complaint, and requested a card block. The court’s message is that early warnings create a duty to act, and silence or reliance on “digital key” technicalities is not enough to shift the loss back to the customer.

What the Ruling Means for Bank and Mobile Customers

  • Treat an unexpected porting notice as active fraud. The victim received the letter on 5 December, yet transfers still occurred from 7–13 December. Immediately contact both the old operator and the new operator in writing and keep proof.
  • Notify your bank in writing and ask it to block more than the card. The customer asked BNP Paribas to block her Visa card, but the fraud went through a digital-key channel. Ask specifically for the blocking of digital-banking access, new payees and outgoing transfers.
  • File a criminal complaint early. The victim filed for identity theft the day after discovery. That timeline helped show she had not been negligent, which was decisive in the court’s rejection of the bank’s defence.
  • Ask your mobile operator to lock SIM transfers. Free Mobile was held liable for transferring the number without adequate identity verification. Customers can ask about porting locks or enhanced identity checks; a written request creates a record if something goes wrong.