Civil Cassation: Bank Liability in SIM Swapping

1. The fact

   According to reports from outlets such as Altalex and Diritto Bancario, the case brought before the Cassation concerns a saver who suffered the theft of large sums from their bank account through the SIM Swapping technique. The mechanism, established in the lower courts, involved a fraudster illegally obtaining a duplicate of the customer's SIM at a telephone operator's retail outlet by presenting forged documents.

   The activation of the new card caused the immediate deactivation of the original SIM, preventing the customer from receiving calls and messages. During this interval, the attacker, already in possession of home banking access credentials obtained through a previous targeted attack, received on their device the OTP codes via SMS necessary to authorize wire transfers to foreign accounts.

   The procedural stage concluded with the ruling of the Court of Cassation, called to decide whether the bank could invoke the customer's gross negligence for failing to promptly report the telephone line malfunction. The lower courts had initially fluctuated on the assessment of the customer's diligence, considering the fraud a partially avoidable event with greater attention to the state of the mobile terminal.

2. 

   The rules in play

   The pivotal discipline is contained in Legislative Decree no. 11/2010, implementing the European Payment Services Directives (PSD2). Art. 10 establishes a strict distribution of the burden of proof: if the customer denies authorization, the bank must prove not only the authentication of the transaction but also the intent or gross negligence of the user.

   Art. 12 of the same decree limits the payer's liability to a minimum deductible, except in cases of gross negligence. Completing the framework is Art. 1176, paragraph 2, of the Civil Code, which imposes the professional diligence of the prudent banker on the bank. This rule raises the standard of protection required of the intermediary, who must adopt security measures appropriate to the technological state of the art to prevent known frauds such as SIM Swapping.

   Finally, Art. 1218 of the Civil Code frames the bank's liability as contractual, assuming that the failure to fulfill the obligation of custody and security of deposits entails the obligation of compensation, unless the institution proves that the event resulted from a cause not attributable to it.

3. What case law says

   The orientation of high court case law has clarified that the risk of evolving hacking techniques falls mainly on the bank, as it is the entity technically equipped to manage the so-called technological unknown. The judges specified that simply demonstrating that the OTP codes were correctly entered does not equate to proof of the customer's gross negligence.

   Regarding SIM Swapping, case law has established that an average user cannot be expected to maintain obsessive vigilance over the continuity of the telephone signal, especially if the outage can be mistaken for a trivial technical problem from the operator. The professional liability of the intermediary implies the obligation to set up monitoring systems capable of intercepting behavioral anomalies, such as a sudden password change followed by massive wire transfers.

   Furthermore, it has been stated that the use of SMS as a two-factor authentication tool, while widespread, presents known inherent vulnerabilities. Therefore, the bank's choice to rely on this technology shifts the business risk bar to the institution, making it very difficult to qualify the conduct of a customer who suffers identity theft via a third party (the telephone operator) without any control over it as negligent.

5. Analysis drafted and verified with edit.legal

   To verify the provisions cited in this article, we used edit.legal. Test our legal AI on official sources and apply it to your own matters.

   Try edit.legal AI

8. What it teaches professionals

   1. Verification of technical logs: During the investigation phase, it is essential to request not only the bank statement but also the complete authentication logs, including IP addresses and device identification codes used for the disputed transactions.
   2. Negligence analysis: The client's defense must insist on the distinction between the saver's distraction and the systemic flaw, proving that the user did not perform any acts disposing of their credentials.
   3. Telco involvement: Always evaluate the opportunity to take action or involve the telephone operator for the failure to identify the person requesting the new SIM, which constitutes the first link in the causal chain of damage.
   4. Security standards: Constantly monitor whether the credit institution had more secure technologies available (such as biometric authentication) and whether it negligently omitted them, preferring the cheaper but insecure SMS.

References: D.Lgs. 11/2010Art. 1176 c.c.Art. 1218 c.c.

Editorial oversight: Avv. Federico Papa·ICAMUpdated 15 October 2026Content drafted with AI support and subject to editorial source checks. Despite these controls, inaccuracies may remain: reports and rectification requests are welcome. Report a correction