1. Introduction

Digital fraud prevention banking systems refer to the legal, technological, and institutional mechanisms used to detect, prevent, investigate, and remedy fraudulent activities conducted through electronic banking services.

In Morocco, these systems are increasingly important because banking transactions are conducted through internet banking, mobile applications, electronic payments, card networks, online transfers, and other digital financial services.

Digital banking fraud may involve unauthorised account access, phishing, identity theft, fraudulent electronic transfers, payment-card misuse, SIM swapping, social engineering, and the manipulation of electronic banking records.

From a civil-law perspective, the central question is:

When a digital banking fraud occurs, who is legally responsible for the resulting financial loss—the customer, the bank, a payment intermediary, or another party?

The answer depends on the applicable legislation, the contractual relationship, the security measures adopted, the conduct of the parties, the evidence available, and the causal connection between the alleged wrongdoing and the loss.

Morocco's legal framework combines civil liability principles, banking legislation, personal-data protection, electronic-transactions rules, cybersecurity requirements, and criminal-law provisions addressing computer-related offences.

It is important to distinguish civil liability from criminal responsibility. Criminal proceedings may punish fraudsters, while civil proceedings may provide compensation or other appropriate remedies to an injured customer.

2. Principal legislation governing digital banking fraud in Morocco

A. Dahir of Obligations and Contracts

The Moroccan Dahir of Obligations and Contracts (DOC) provides the general framework for contractual and extra-contractual civil liability.

Its provisions are relevant where a bank fails to exercise appropriate care in executing transactions, protecting deposited funds, or complying with its contractual obligations.

Important provisions include:

• Article 230: Contracts validly formed are binding on the parties.
• Article 231: Obligations must be performed in good faith.
• Articles 77 and 78: Address liability arising from wrongful acts and conduct causing damage.
• Articles 268 and 269: Address force majeure and the circumstances in which an event may affect liability.

These provisions must be applied in light of the specific banking relationship and any applicable special legislation.

For example, if a bank executes a forged transfer instruction without taking reasonable steps to verify its authenticity, the customer may have grounds to claim contractual damages or repayment, depending on the facts.

B. Law No. 103-12 on credit institutions and similar bodies

Law No. 103-12 regulates credit institutions and other covered financial entities in Morocco.

Its relevance to digital fraud prevention includes the regulatory environment in which banks operate, their obligations as supervised financial institutions, and the role of Bank Al-Maghrib.

Banks must consider applicable banking rules and supervisory requirements when designing systems for transaction authentication, account security, fraud detection, and customer protection.

A breach of a regulatory requirement may be relevant to a civil claim, but it does not automatically establish every element of civil liability.

C. Law No. 09-08 on personal-data protection

Digital fraud prevention systems frequently process customers' names, account information, transaction histories, device identifiers, and other personal data.

Law No. 09-08 regulates the processing of personal data and is relevant to the lawful collection, use, disclosure, and security of such information.

Fraud prevention does not give banks unlimited authority to collect or share personal information. Data processing must comply with applicable legal requirements.

D. Law No. 53-05 on electronic transactions

Law No. 53-05 introduced rules concerning electronic data exchanged in legal transactions and amended the DOC to recognise electronic documents and signatures under specified conditions.

This framework is relevant when a dispute concerns:

• The authenticity of an electronic transfer instruction.
• The identity of the person who authorised a transaction.
• The integrity of an electronic banking record.
• The evidentiary value of electronic communications.
• The reliability of digital authentication procedures.

An electronic record is not necessarily conclusive proof that the account holder personally authorised a transaction. Its authenticity and evidentiary significance must be evaluated.

E. Law No. 05-20 on cybersecurity

Law No. 05-20 provides a cybersecurity framework applicable to the systems and entities covered by its provisions.

Its relevance includes the protection of information systems, management of cybersecurity risks, and applicable security obligations.

A cyberattack does not automatically absolve a bank of responsibility. The legal assessment must consider whether the bank fulfilled the duties applicable to it and whether the incident could reasonably have been prevented or contained.

F. Law No. 07-03 on offences involving automated data-processing systems

Law No. 07-03 amended the Moroccan Penal Code to address certain computer-related offences.

It is relevant where fraud involves unauthorised access to computer systems, interference with automated data processing, or other conduct covered by the applicable criminal provisions.

The same incident may lead to criminal proceedings against a fraudster and a separate civil claim concerning the loss suffered by the customer.

3. Common forms of digital banking fraud

A. Phishing and credential theft

Phishing involves deceptive messages or websites designed to obtain banking credentials, passwords, or verification codes.

A fraudster may impersonate a bank employee and persuade a customer to reveal confidential information.

Legal issue: Whether the transaction was authorised, whether the bank's security measures were adequate, and whether the customer's conduct contributed to the loss.

B. Unauthorised electronic transfers

A fraudster may obtain access to an online banking account and transfer funds without the customer's permission.

Potential issues include the bank's authentication procedures, transaction monitoring, account-security controls, and response after notification of the fraud.

C. Payment-card fraud

Fraudsters may use stolen card information, cloned cards, or compromised authentication credentials to conduct unauthorised withdrawals or purchases.

Relevant evidence may include transaction records, card possession, geographic information, authentication logs, and the timing of the customer's report.

D. Identity theft and fraudulent account opening

A fraudster may use forged identity documents to open an account or obtain credit in another person's name.

The legal issues may involve identity verification, banking vigilance, the authenticity of submitted documents, and the resulting financial or reputational damage.

E. SIM swapping and mobile-banking fraud

A fraudster may take control of a victim's telephone number and intercept messages used for account verification.

Responsibility may depend on the conduct of the telecommunications provider, the bank, and the fraudster, as well as the security measures applicable to each participant.

F. Forged payment instructions and business-email compromise

Fraudsters may impersonate a company director, supplier, or authorised representative and submit false payment instructions.

This form of fraud is particularly relevant to corporate banking because the bank may need to assess unusual transactions, suspicious signatures, and inconsistencies with established payment arrangements.

4. Case laws: Moroccan and comparative judicial authorities

Moroccan case law contains important decisions concerning fraudulent withdrawals, forged transfer instructions, identity verification, and bank security. These decisions are particularly valuable because they address the civil liability of banks under Moroccan law.

The following cases distinguish Moroccan judicial decisions, which are directly relevant to the domestic legal framework, from foreign comparative authorities, which may offer useful reasoning but are not binding Moroccan precedents.

Case 1. Moroccan Court of Cassation, Commercial Chamber — Decision No. 351/3 of 28 October 2015

File No.: 2014/1/3/1503

Subject: Execution of a forged bank-transfer instruction.

Facts

A company discovered that its bank account had been debited by approximately MAD 960,932.50 following a transfer that it denied authorising.

The company sought repayment and compensation, arguing that the bank had executed an unauthorised transfer.

Legal issue

Whether a bank could be held contractually liable for executing a forged transfer instruction without taking reasonable steps to verify its authenticity.

Judgment and principle

The Moroccan Court of Cassation upheld the reasoning that the bank had failed to exercise appropriate vigilance. The bank should have checked the signature against its records and, where doubt arose, contacted the customer before executing the transfer.

The failure to take those precautions constituted fault capable of engaging contractual liability.

Importance for digital fraud prevention

This decision establishes a valuable principle for analysing modern electronic transfers: a bank should not treat the mere presentation of a payment instruction as conclusive proof of authorisation when circumstances require further verification.

In a digital environment, analogous questions may arise concerning unusual payment patterns, authentication anomalies, changes to beneficiary details, or other warning signs.

Practical lesson: Banks should maintain reliable verification procedures for payment instructions and investigate relevant warning signs before executing suspicious transactions.

Case 2. Moroccan Court of Cassation, Commercial Chamber — Decision No. 372 of 27 July 2017

File No.: 1356/3/1/2016

Subject: Fraudulent card withdrawals and banking-system security.

Facts

A customer discovered unauthorised withdrawals from a bank account while the payment card remained in the customer's possession.

The customer reported the incident to the bank, but fraudulent transactions continued. The dispute included withdrawals carried out abroad and the bank's argument that the customer was responsible for safeguarding the confidential PIN.

Legal issue

Whether the bank could avoid responsibility by arguing that the card was protected by a PIN or that a cyberattack constituted force majeure.

Judgment and principle

The Court of Cassation rejected the bank's challenge to the ruling holding it responsible for the losses established in the proceedings.

The underlying court findings included evidence that fraudulent withdrawals had continued despite the customer's notification and that the bank's systems had not adequately prevented the unauthorised transactions.

The decision also rejected the bank's force-majeure argument in the circumstances of the case.

Importance for digital fraud prevention

The decision demonstrates that the presence of a PIN or other authentication mechanism does not, by itself, prove that every transaction was authorised by the account holder.

It also illustrates the importance of responding effectively when a customer reports compromised credentials or fraudulent withdrawals.

Practical lesson: Banks should investigate reported fraud promptly, apply appropriate security controls, and assess whether further transactions should be blocked.

The decision should not be interpreted as establishing that every cyberattack is foreseeable or that banks are automatically liable for every fraudulent transaction.

Case 3. Casablanca Commercial Court of Appeal — Decision No. 5424 of 11 November 2021

File No.: 2021/8220/603

Subject: Unauthorised online banking transactions and the burden of proof.

Facts

A customer challenged online transfers and bill payments that had caused substantial losses. The customer argued that the transactions had not been authorised and that the bank was responsible for protecting its online banking system.

The case involved competing expert assessments of the banking system and the customer's mobile device.

Legal issue

Whether the bank could be held liable where the evidence did not establish a defect in its information system or a fault attributable to the bank.

Judgment and principle

The Commercial Court of Appeal overturned the first-instance outcome and rejected the customer's claim.

It relied on a further technical assessment that found the banking system adequately secured. The court also considered the customer's failure to provide the mobile telephone used for the disputed transactions, which prevented examination of whether the device had been compromised.

The court concluded that the bank's fault had not been sufficiently established.

Importance for digital fraud prevention

This decision provides an important counterbalance to the previous cases.

A customer disputing a transaction does not automatically establish that the bank was negligent. Technical evidence, device examination, authentication records, and the circumstances of the transactions can be decisive.

Practical lesson: Both banks and customers should preserve relevant digital evidence. Courts may need specialist expertise to distinguish a bank-system failure from device compromise or other causes.

Case 4. Casablanca Commercial Court of Appeal — Decision No. 3113 of 14 June 2021

File No.: 2021/8220/1717

Subject: Identity verification and fraudulent account opening.

Facts

A banking dispute arose after an account had been opened and credit granted using documents later found to be falsified.

The proceedings examined whether the bank had fulfilled its duty of vigilance when verifying the customer's identity and supporting income documents.

Legal issue

Whether inadequate verification of apparently suspicious documents could constitute a civil fault.

Judgment and principle

The Commercial Court of Appeal upheld the significance of the bank's duty of vigilance and found that the institution had failed to carry out sufficient checks on documents that contained apparent irregularities.

Article 78 of the DOC was relevant to the civil-liability analysis.

Importance for digital fraud prevention

The decision is relevant to digital account opening and remote customer identification.

Electronic onboarding systems should not rely exclusively on automated document acceptance where discrepancies or other warning signs require additional verification.

Practical lesson: Banks should adopt risk-appropriate identity checks and establish procedures for escalating suspicious or inconsistent documents.

Case 5. Fez Commercial Court of Appeal — Decision No. 1033 of 30 June 2009

File No.: 1220/07

Subject: Contractual responsibility of banks for failures in banking operations.

Facts

A commercial customer challenged banking-account entries, including disputed amounts and interest calculations.

The court considered whether the bank had complied with its obligations towards the customer and whether its conduct had caused financial loss.

Legal issue

Whether a bank may incur contractual liability when it breaches legal requirements or recognised professional banking practices and causes demonstrable harm.

Judgment and principle

The court recognised that a bank may incur contractual liability where it fails to comply with obligations imposed by law or proper professional banking practice.

The court also considered the importance of establishing the amount of the loss and the causal connection between the bank's fault and that loss.

Importance for digital fraud prevention

Although this decision predates modern mobile-banking systems and does not directly concern a cyberattack, it illustrates the general civil-liability principles applicable to banking operations.

A bank's internal procedures and transaction records may be important when determining whether a failure occurred and what loss resulted.

Practical lesson: Banks should maintain accurate transaction records and effective reconciliation procedures. A customer claiming compensation must establish the relevant fault, damage, and causal relationship under the applicable legal framework.

Case 6. Barclays Bank plc v Quincecare Ltd — English Court of Appeal, 1992

Citation: [1992] 4 All ER 363.

Subject: Duty of care when executing suspicious payment instructions.

Facts

The dispute concerned payment instructions issued by an agent who was alleged to have acted fraudulently against the customer.

Legal issue

Whether a bank should refrain from executing an instruction where it has reasonable grounds to believe that the instruction may be an attempt to misappropriate the customer's funds.

Principle

The English Court of Appeal recognised a duty of care relevant to circumstances in which a bank has reasonable grounds to question the legitimacy of a payment instruction.

The scope of this duty was subsequently considered and clarified in later English cases.

Importance for Morocco

The decision offers a comparative perspective on fraud-prevention procedures, particularly for corporate transfers and suspicious instructions.

It may help frame questions about when a bank should investigate a transaction rather than execute it automatically.

Limitation: This is an English judgment, not Moroccan law. Its precise doctrinal test must not be presented as automatically governing Moroccan banks.

Case 7. Singularis Holdings Ltd v Daiwa Capital Markets Europe Ltd — UK Supreme Court, 2019

Citation: [2019] UKSC 50.

Subject: Bank responsibility for fraudulent transfers and internal controls.

Facts

A company suffered substantial losses when its sole shareholder and director caused funds to be transferred improperly from the company's account.

The company brought a claim against the bank, alleging failures in its systems and procedures.

Legal issue

Whether the bank had failed to exercise appropriate care in executing transactions in circumstances where warning signs should have prompted further inquiry.

Principle

The UK Supreme Court upheld the finding of negligence against the bank. The case illustrates the importance of appropriate safeguards and responding to circumstances that should raise concern about the legitimacy of transactions.

Importance for Morocco

The decision is relevant by analogy to corporate banking fraud, particularly where a single authorised person can initiate substantial transfers.

Banks should consider transaction patterns, authority limits, suspicious instructions, and the adequacy of internal controls.

Limitation: The case applies English law. It does not independently establish liability under the Moroccan DOC.

Case 8. Philipp v Barclays Bank UK plc — UK Supreme Court, 2023

Citation: [2023] UKSC 25.

Subject: Authorised push-payment fraud and the bank's duty to execute customer instructions.

Facts

A customer was deceived by fraudsters into instructing her bank to transfer money to accounts controlled by them.

Although the customer had been deceived, the payment instructions were given by the customer herself.

Legal issue

Whether the bank's duty of care required it to refuse or delay the customer's payment instructions.

Principle

The UK Supreme Court rejected the claim on the basis of the Quincecare duty as it had been framed. It distinguished cases involving instructions given by an agent acting against a customer's interests from transactions personally authorised by a deceived customer.

The judgment clarified the limits of the relevant common-law duty, without establishing that banks can never owe other duties in fraud cases.

Importance for Morocco

The decision illustrates the distinction between an unauthorised transaction and a transaction that the customer personally authorised after being deceived.

That distinction is critical when evaluating responsibility for phishing, impersonation, and social-engineering scams.

Limitation: Moroccan law must determine the applicable duties and allocation of loss. The English judgment does not decide whether a Moroccan bank must reimburse a customer in comparable circumstances.

Comparative assessment of the eight cases

The key distinction is that the first five decisions are Moroccan authorities, while the last three are comparative English authorities. The Moroccan decisions are particularly useful for analysing domestic civil liability. The English cases provide additional perspectives but do not replace Moroccan legislation or precedent.

5. Legal responsibility of banks in digital fraud cases

The responsibility of a bank depends on the circumstances of the fraud and the legal relationship between the bank and its customer.

A. Failure to maintain adequate security

A bank operating digital banking services must comply with the security obligations applicable to its systems and activities.

Potential deficiencies include:

• Weak transaction authentication.
• Failure to respond appropriately to reported account compromise.
• Inadequate controls over suspicious transactions.
• Failure to protect relevant banking information.
• Defective procedures for verifying payment instructions.

If a legally relevant failure causes a customer financial loss, the customer may have grounds for a civil claim.

However, the mere occurrence of fraud does not establish that the bank's systems were defective. Technical evidence and the applicable legal duties must be examined.

B. Failure to investigate suspicious transactions

Consider a company that normally transfers MAD 5,000–10,000 to established suppliers but suddenly receives a payment instruction for MAD 800,000 to an unfamiliar beneficiary.

If the instruction contains inconsistencies or other warning signs, the circumstances may justify additional verification under the applicable banking duties and contractual arrangements.

The legal assessment should consider:

1. Whether the instruction was authentic.
2. Whether the bank had grounds to question it.
3. Whether the bank followed its applicable procedures.
4. Whether further verification could have prevented the loss.
5. Whether the customer or another party contributed to the incident.

The Moroccan Court of Cassation's 2015 decision concerning a forged transfer instruction is particularly relevant to this analysis.

C. Failure to respond after notification

A bank may receive a customer's report that a card, account, or authentication credential has been compromised.

The bank's subsequent conduct can be important in determining liability.

For example, if further fraudulent withdrawals occur after the bank receives a sufficiently clear report and has a reasonable opportunity to intervene, the additional transactions may require separate examination.

The 2017 Moroccan Court of Cassation decision illustrates the significance of continued fraudulent withdrawals and the adequacy of the bank's security response.

D. Fraud resulting from customer conduct

A customer may disclose a verification code, approve a fraudulent payment, or install malicious software after being deceived.

These facts may be relevant to the allocation of responsibility, but they do not automatically settle the matter.

The court must consider the applicable law, the bank's obligations, the customer's conduct, and the causal relationship between that conduct and the loss.

In particular, a transaction recorded as authenticated should not automatically be equated with a transaction knowingly and freely authorised by the customer.

6. Civil liability of customers, fraudsters, and third parties

A. Liability of the fraudster

A person who unlawfully obtains or transfers another person's funds may face criminal proceedings and, where the applicable requirements are satisfied, civil liability.

A victim may seek compensation for proven financial loss and other legally recognised damage.

B. Liability of the customer

A customer's conduct may be relevant where the customer fails to take reasonable precautions or breaches applicable contractual obligations.

Nevertheless, the consequences depend on the facts and the governing rules. A bank cannot necessarily avoid responsibility simply by alleging that the customer disclosed a password.

C. Liability of telecommunications providers

SIM-swapping fraud may involve failures in telephone-number verification or account-security procedures.

Whether a telecommunications provider is liable depends on its applicable duties, its conduct, and the causal connection between any breach and the loss.

D. Liability of payment intermediaries

Payment services may involve several institutions, including the customer's bank, the beneficiary's bank, and other intermediaries.

The parties' responsibilities must be assessed separately. A payment intermediary is not automatically liable merely because it participated in processing a transaction.

E. Liability of technology vendors

A bank may rely on an external company for fraud-detection software, identity verification, or cybersecurity services.

The vendor may be contractually liable if it breaches its obligations and causes loss. The bank's own obligations must also be examined; outsourcing does not automatically eliminate them.

7. Electronic evidence in digital banking fraud litigation

Electronic evidence often determines whether a customer can establish that a transaction was fraudulent or that a bank failed to meet its obligations.

Relevant evidence includes:

• Bank statements showing the disputed transactions.
• Transaction timestamps and reference numbers.
• Authentication and access logs.
• Notifications sent to the customer.
• Records of fraud reports and account-blocking requests.
• Device and login information, where lawfully available.
• Relevant correspondence with the bank.
• Expert reports examining the banking system or device.
• Records showing when the beneficiary was added or changed.

Under the Moroccan legal framework governing electronic transactions and evidence, the authenticity, integrity, and evidentiary value of digital records must be evaluated according to the applicable rules.

A bank's records can be important evidence, but a successful login or valid verification code does not necessarily resolve every question concerning authorisation.

Importance of technical expertise

The Casablanca Commercial Court of Appeal's 2021 decision, No. 5424, demonstrates why technical expertise may be essential.

A specialist may need to examine whether:

• The bank's system was compromised.
• The customer's device was compromised.
• Authentication controls operated correctly.
• The disputed transaction followed the bank's normal process.
• The available evidence supports a particular explanation of the incident.

An expert report does not automatically determine the legal outcome. The court must assess the evidence and apply the relevant law.

8. Remedies available to victims of digital banking fraud in Morocco

The appropriate remedy depends on the type of transaction, the applicable contract, the relevant legislation, and the evidence.

A. Repayment of unauthorised withdrawals

Where a customer establishes that funds were withdrawn without authorisation and the applicable legal requirements for repayment are satisfied, the customer may seek restoration of the money.

The 2017 Court of Cassation decision is an important domestic authority concerning fraudulent card withdrawals.

B. Compensation for financial loss

A customer may claim damages where the relevant requirements of civil liability are established.

Depending on the facts, the claimed loss might include the amount improperly transferred, additional financial loss, or other legally recognised damage.

The court must determine the extent of recoverable loss and whether the defendant's conduct caused it.

C. Correction of banking records

If a fraud incident results in inaccurate account information or personal data, correction may be available under the applicable legal framework.

Law No. 09-08 may be relevant where the dispute concerns inaccurate personal data.

D. Preventive and interim measures

Depending on the procedural requirements, a customer may seek appropriate urgent measures to protect their interests.

Examples include requesting the bank to block compromised access, preserve relevant evidence, or take available steps concerning a disputed transfer.

Whether a court can order a particular measure depends on the circumstances and applicable procedural law.

E. Criminal complaints

Where the facts indicate criminal conduct, the victim may report the incident to the competent authorities.

Criminal proceedings against the fraudster and civil proceedings concerning the customer's loss serve different purposes, although they may interact.

F. Regulatory complaints

Depending on the issue, a complaint may be made to the relevant bank or competent supervisory authority.

A regulatory complaint is not necessarily a substitute for a civil claim seeking repayment or damages.

9. Institutional framework for banking fraud prevention in Morocco

Several institutions and legal frameworks are relevant to the prevention and investigation of digital banking fraud.

The precise allocation of responsibilities depends on the type of incident and the legislation governing the institution concerned.

Effective fraud prevention requires coordination between financial institutions, cybersecurity specialists, telecommunications providers, and law-enforcement authorities.

10. Recommended digital fraud prevention framework for Moroccan banks

A comprehensive prevention framework should combine technical safeguards, legal compliance, internal controls, and accessible customer remedies.

A. Strong authentication

Banks should implement authentication measures appropriate to the risks associated with the relevant service.

Controls may include multifactor authentication, device registration, transaction verification, and additional checks for high-risk activities.

The choice of measures should reflect applicable regulatory requirements and the institution's risk profile.

B. Real-time transaction monitoring

Fraud-detection systems can identify unusual transaction patterns, including:

• Sudden transfers to unfamiliar beneficiaries.
• Unusual transaction amounts.
• Multiple rapid transactions.
• Activity inconsistent with established account behaviour.
• Suspicious changes to account-access information.

Automated alerts should be supported by appropriate investigation and escalation procedures.

C. Beneficiary verification

Banks should maintain appropriate procedures for adding or changing payment beneficiaries.

For corporate accounts, these may include verification of authorised signatories and additional confirmation for unusual payment instructions.

This approach is consistent with the concerns examined in the Moroccan Court of Cassation's 2015 forged-transfer decision.

D. Rapid incident response

A bank should maintain a clear procedure for responding to reports of suspected fraud.

Depending on the circumstances, this may involve blocking compromised credentials, restricting suspicious transactions, investigating the incident, preserving evidence, and communicating with the customer.

The response should be prompt and proportionate to the identified risk.

E. Cybersecurity testing and monitoring

Banks should evaluate their information systems for vulnerabilities and maintain appropriate incident-management procedures.

Security testing should address relevant risks involving authentication, account access, transaction processing, third-party services, and data protection.

F. Customer education

Customers should receive understandable guidance about phishing, impersonation, suspicious links, verification codes, and fraudulent payment requests.

Education can reduce risk, but it should not be treated as a substitute for appropriate institutional safeguards.

G. Vendor governance

Banks using external fraud-prevention technologies should assess vendor security, contractual responsibilities, data-processing arrangements, and incident-reporting procedures.

The institution should retain sufficient oversight to investigate disputed transactions and demonstrate compliance with its applicable obligations.

H. Independent review and audit

Periodic audits can help identify weaknesses in fraud controls and transaction-monitoring processes.

The review should examine not only whether the software works as intended but also whether staff follow escalation procedures and whether customers can report fraud effectively.

11. Practical example: fraudulent transfer from a Moroccan bank account

Consider the following hypothetical situation.

A Moroccan business maintains an account with a bank. A fraudster sends a forged transfer instruction for MAD 450,000 to a third-party beneficiary.

The business denies authorising the transfer and demands repayment.

Legal analysis

Step 1: Establish the transaction

The business should obtain the relevant account statement, transaction details, and available payment records.

Step 2: Examine authenticity

The parties should investigate the origin of the instruction, the relevant authorisation procedures, and any inconsistencies in the documentation.

Step 3: Assess the bank's conduct

The court may examine whether the bank complied with its applicable duties and whether circumstances required further verification.

Step 4: Consider causation

The court must assess whether any established failure caused the loss and whether other conduct contributed to the incident.

Step 5: Determine the remedy

Depending on the evidence and applicable law, the business may seek repayment and compensation for proven loss.

The Moroccan Court of Cassation's 2015 decision concerning a forged transfer instruction provides a relevant domestic comparison.

However, the outcome would depend on the facts. If the transfer were properly authorised, or if the claimant failed to establish a relevant breach and causal connection, the claim could be decided differently.

12. Challenges in the Moroccan legal framework

Despite the existence of relevant legislation and judicial authorities, several issues remain important.

A. Rapid technological change

Fraudsters continually adapt their methods, making it difficult for institutions to rely solely on static security procedures.

B. Allocation of responsibility

Digital transactions may involve customers, banks, telecommunications providers, and technology vendors. Determining responsibility requires a careful assessment of each participant's conduct.

C. Unequal access to technical evidence

Banks may control much of the relevant system information, while customers may have only account statements and notifications.

Access to reliable evidence and appropriate expert examination can therefore be critical.

D. Social-engineering fraud

A customer may personally approve a payment after being deceived. Distinguishing this situation from a wholly unauthorised transaction can create difficult questions concerning consent, fault, and the allocation of loss.

E. Cross-border transactions

Fraudulent transfers may involve accounts and intermediaries in different countries. Recovering funds and obtaining evidence may consequently require cross-border cooperation.

F. Balancing security and privacy

Fraud-prevention systems process sensitive financial information. Banks must balance effective detection with the applicable rules governing personal-data processing and confidentiality.

13. Critical assessment

Morocco's legal framework provides several foundations for addressing digital banking fraud: the DOC's civil-liability provisions, banking legislation, electronic-evidence rules, personal-data protection, and cybersecurity requirements.

The Moroccan judicial decisions discussed above demonstrate two complementary principles.

First, banks may incur liability when they fail to take precautions required by their applicable duties, as illustrated by the decisions concerning forged transfer instructions and fraudulent card withdrawals.

Second, a disputed transaction does not automatically establish bank negligence. The 2021 Casablanca appellate decision concerning online transactions illustrates the importance of technical evidence and proof of fault.

A balanced legal approach should therefore avoid both extremes: automatically holding banks responsible for every fraud and automatically placing the entire loss on customers whenever their credentials were used.

The correct outcome requires examining the applicable legal obligations, the evidence, the parties' conduct, and the causal connection between any established breach and the loss.

14. Conclusion

Civil Law and Digital Fraud Prevention Banking Systems in Morocco concerns the legal responsibilities of banks and other participants in preventing, investigating, and responding to fraudulent electronic transactions.

The Moroccan Court of Cassation decisions of 2015 and 2017 are especially important for understanding banking vigilance, system security, and the consequences of unauthorised transfers. The Moroccan appellate decisions of 2021 further demonstrate the importance of identity verification and technical evidence.

The comparative English decisions in Barclays v Quincecare, Singularis v Daiwa, and Philipp v Barclays offer additional perspectives on suspicious payment instructions, internal controls, and customer-authorised payments induced by deception. They remain comparative authorities rather than binding Moroccan precedents.

Ultimately, effective digital fraud prevention requires reliable authentication, transaction monitoring, prompt incident response, accurate records, appropriate protection of personal data, and accessible remedies for customers.

The fundamental principle is that digital banking security and civil liability must operate together: banks should protect customers through appropriate safeguards, customers should take reasonable precautions, and courts should allocate responsibility according to the applicable law and the evidence established in each case.