EU Court Says Banks Must Refund Phishing Losses First, Then Prove Negligence
The Court of Justice of the European Union ruled that a bank must refund money taken in an unauthorized payment by the end of the next business day, and may try to recover it later only if it proves the customer was grossly negligent.
The Court of Justice of the European Union, the EU's highest court, ruled that a bank must refund an unauthorized payment immediately, and no later than the end of the next business day, once the customer reports it without undue delay. The bank may not refuse on the grounds that the customer was grossly negligent, for example by typing banking login details into a fake website.
The case came from Poland. A woman selling an item online received a link that looked like it came from the sales platform. It led to a copy of her bank's website, where she entered her login details. About €700 was then moved out of her account. She reported it the next day; her bank refused to refund her, saying she had failed to keep her credentials safe.
The court said refunding the money and deciding who finally bears the loss are separate questions. The bank refunds first. Afterwards it may seek the money back from the customer, but only if it proves gross negligence or intent. The only exception to the immediate refund is when the bank has reasonable grounds to suspect fraud by the customer and reports them to the national authority.
Luxembourg — The Court of Justice of the European Union ruled that a bank must immediately refund a customer for a payment the customer did not authorize, even if the bank believes the customer's gross negligence made the theft possible.
The case, C-70/25, applies the EU's Payment Services Directive (Directive 2015/2366), the law that sets the rules for payments and banking services across the bloc. "Phishing" is a scam in which a fraudster sends a fake message or link to trick someone into handing over passwords or other login details.
The case
A customer of a Polish bank was selling an item on an online sales platform. Someone posing as a buyer sent her a link presented as coming from the platform to confirm the sale. The link led to a website imitating her bank's site, where she entered her online banking login details. Using them, the third party transferred about €700 from her account to its own.
She reported the transaction to her bank the next day. The bank refused to refund it, saying she had been grossly negligent by not keeping her security credentials safe. She sued in a Polish court, which asked the Court of Justice whether EU law requires an immediate refund even when the bank considers the customer grossly negligent.
What the court held
The court said yes. When a payment is unauthorized and the customer reports it without undue delay, the bank must refund it immediately and in any event by the end of the business day after it learns of the transaction. The only exception is when the bank has reasonable grounds to suspect fraud by the customer and communicates those grounds to the competent national authority.
The court separated two questions: refunding the money, and deciding who ultimately bears the loss. The bank refunds first. It may then seek reimbursement from the customer if it establishes that the losses resulted from the customer's intentional or grossly negligent failure to protect his or her credentials. The burden of proving that negligence is on the bank.
The court said letting banks refuse refunds from the outset would make the immediate-refund rule ineffective and would force customers to go to court themselves to assert their rights, with the cost that brings.
What happens next
The Court of Justice does not decide the Polish dispute. The Polish court will decide it in line with the ruling, which binds courts in every EU member state facing the same question.