France recently adopted the Law on Daily Security (2001/1062). This law introduces new rules requiring card issuers to reimburse cardholders if fraudulent payments are made without their cards being physically used. These provisions are principally designed to protect French consumers against credit and debit card fraud in the event of distance sales and, in particular, online non-secured sales where payment is made merely by providing the card number and expiry date.

Before this law came into force the rules on fraudulent card payments were primarily set forth in the agreements between the card issuers and cardholders. These agreements provided that the cardholder was liable for payments made before he or she had reported the card's loss or theft. Such liability was limited to €457.35 for payments made using the personal identification number (PIN), and €91.47 for payments made without the PIN. However, the limitation did not apply in case of late notification (ie, a few days after the theft or loss), fault, lack of care or use by a family member.

However, a cardholder is generally unaware of fraudulent card use until discovering it on a bank statement, which can take place weeks after the event. It is then too late to oppose the fraudulent use and benefit from the limitation, so a cardholder often had to bear the entire charge of the fraudulent payments. The only recourse was to take action against the party who committed the fraud, a difficult task with little chance of success.

The Law on Daily Security extends the period in which cardholders can contest payments. The law provides that in the event of fraudulent payment (i) made at a distance without the physical use of the card, or (ii) made using a counterfeit card where the cardholder physically possessed the card at the time of the contested charge, the cardholder may contest such payment within 70 days (this can be extended contractually to 120 days) by contacting the card issuer in writing. The card issuer must recredit or return the entire contested amount without charge within one month of receiving the objection, as well as any financial fees incurred by the cardholder as a result of the fraudulent use. This means that the victim now has all the time necessary to read his or her bank statement, and discover and contest fraudulent payments made with his or her card. Moreover, if the cardholder respects this procedure, he or she will not be liable for any portion of the fraudulent use of his or her card.

French law is now in line with the Distance Contracts Directive (97/7/EC), which requires that member states ensure that the consumer be allowed "to request cancellation of a payment where fraudulent use has been made of his payment card [and] . . . be recredited with the sums paid or have them returned".

The Law on Daily Security sets out criminal penalties for the manufacture, purchase, possession, sale, offer or making available of card falsification equipment or information.

It also sets forth uniform limitations on the maximum amount of charges to be borne by the cardholder in the event of loss or theft of the card (€275 as of January 1 2002 and €150 as of January 1 2003), regardless of whether the transaction was made using the PIN. Before the new law's enactment such limitations were provided in the agreements between banks and their clients. These limitations do not apply, and the cardholder continues to be liable for all amounts charged before the report of the card loss or theft, in the event of gross negligence (eg, writing the PIN on the card) or in the event of late report of the card loss or theft. Although the time limit for reporting card loss or theft continues to be governed by the agreement between the card issuer and cardholder, the law provides that it may not be less than two full days (ie, 48 hours).

For further information on this topic please contact Bradley L Joslove at Franklin by telephone (+33 1 45 02 79 00) or by fax (+33 1 45 02 79 01) or by email ([email protected]).