CJEU: A bank must immediately refund an unauthorized payment even if it alleges the customer’s gross negligence

The Court of Justice of the European Union has ruled that a bank cannot refuse to immediately reimburse an unauthorized transaction solely because it claims that the customer was grossly negligent. In a case stemming from a phishing attack in Poland, the Court separates the obligation to promptly return the money from the question of who ultimately bears the loss: the bank may subsequently seek the money back if it proves the customer’s gross negligence.

In principle, a bank must immediately reimburse the amount of an unauthorized payment transaction even if it considers that its own customer enabled the fraud through gross negligence, the Court of Justice of the European Union (CJEU) ruled on October 15. In Case C-70/25, Tukowiecka, the Court interprets the rules of the Payment Services Directive PSD2 so that prompt reimbursement and the final determination of who bears the loss are two distinct stages.

In brief

The payment service provider must reimburse the unauthorized transaction immediately and no later than the end of the next business day after becoming aware of the transaction or being notified of it.

Invoking the customer’s gross negligence does not allow the bank to postpone this reimbursement.

The express exception concerns situations in which the bank has reasonable grounds to suspect that the customer themselves committed fraud and communicates those grounds in writing to the competent national authority.

After reimbursement, the bank may require the customer to bear the loss if it proves that the customer intentionally or through gross negligence breached their obligations concerning the security of the payment instrument.

The ruling concerns unauthorized transactions. It does not mean that every payment made by a customer to a fraudulent merchant must automatically be reimbursed.

The dispute began after a customer of a Polish bank attempted to sell an item on an online platform. A person claiming to be a buyer sent her a fake link, apparently intended to confirm the sale. The link led her to a website imitating her bank’s page, where the woman entered her login details for online banking services. Using this information, the fraudster transferred approximately 3,000 Polish zlotys from the account, equivalent to around 700 euros.

The customer notified the bank and the police the following day. However, the bank refused to reimburse the amount, arguing that the woman had disclosed her banking details and had not properly protected her personalized security credentials. From the bank’s perspective, the conduct constituted gross negligence and entitled it to refuse reimbursement.

The customer challenged this interpretation before a Polish court. Sąd Rejonowy w Koszalinie, the District Court in Koszalin, asked the CJEU to determine whether Articles 73 and 74 of Directive (EU) 2015/2366 allow a bank to refuse immediate reimbursement when it considers that the loss occurred because the customer negligently breached their security obligations.

The Court’s answer is negative. Article 73 of PSD2 provides that, in the case of an unauthorized transaction, the payment service provider must refund the amount immediately and, in any event, no later than the end of the next business day after becoming aware of the transaction or receiving notification of it. Where necessary, the account must be restored to the position it would have been in had the transaction not been executed.

The Court interprets this obligation as separate from the rules determining who must ultimately bear the loss. In other words, the bank cannot first resolve the dispute concerning the customer’s conduct and meanwhile retain the disputed amount. The mechanism chosen by European legislation reverses the order: the money is refunded first under Article 73, and any disputes concerning gross negligence are resolved afterward.

PSD2 provides an explicit exception to immediate reimbursement. If the provider has reasonable grounds to suspect that the customer themselves committed fraud, it may refrain from immediately reimbursing the amount, but it must communicate the grounds for suspicion in writing to the competent national authority. The Court points out that European legislation does not allow this exception to be extended to a mere suspicion of gross negligence.

The difference between fraud and negligence is essential to the solution. If the bank asserts that a customer imprudently disclosed passwords, codes, or other authentication credentials, this may become relevant to the final allocation of the loss, but it does not turn the customer into the perpetrator of the fraud. Only a reasonable suspicion that the payer themselves acted fraudulently activates the specific exception to immediate reimbursement provided for in Article 73.

This does not mean that gross negligence no longer has consequences. Article 74 of PSD2 allows a customer to bear losses resulting from unauthorized transactions if they were caused by fraud or by the intentional or grossly negligent breach of the customer’s obligations, including the obligation to protect personalized security credentials. The CJEU nevertheless states that this liability must be assessed after the initial reimbursement.

In such a situation, the bank may subsequently attempt to recover the amount. To do so, it must prove the customer’s relevant conduct and the link between that conduct and the loss. Under the PSD2 framework, the burden of proving fraud or gross negligence by the payment service user lies with the provider.

If the bank subsequently proves that the loss resulted from the customer’s gross negligence and the customer refuses to repay the amount, the provider may resort to the legal procedures available for recovering the money. The ruling thus moves the dispute concerning the customer’s liability to after the reimbursement stage, rather than allowing the bank to retain the money until responsibility has been definitively clarified.

The Court links this structure to the objective of protecting payment service users. If a bank could suspend reimbursement whenever it invoked gross negligence, the customer would have to initiate proceedings themselves to recover the amount withdrawn from the account. The interpretation adopted by the CJEU places on the provider the obligation to promptly return the money and, if it considers that its own customer should bear the loss, to prove this subsequently.

The ruling does not establish that every victim of online fraud automatically gets their money back. In Tukowiecka, the national court had established that the transfer was an unauthorized transaction. This classification is important. A situation in which a criminal obtains the customer’s data and initiates the transfer themselves is legally different from one in which the customer personally authorizes the payment or transfer, even if they do so after being deceived by a fraudster.

This distinction matters for numerous forms of digital fraud. Phishing may produce different legal outcomes depending on the mechanism: in one case, the criminal steals the authentication credentials and executes the transaction without the customer’s authorization, while in another, the victim is persuaded to confirm a transfer themselves. Judgment C-70/25 addresses the first issue and cannot automatically be extended to all forms of banking fraud or to every dispute concerning a payment.

The framework interpreted by the Court derives from Directive (EU) 2015/2366 on payment services in the internal market, known as PSD2, adopted by the European Parliament and the Council of the European Union. The directive harmonizes an important part of the rules concerning payment services, transaction security, and liability for unauthorized transactions in the Member States.

The CJEU ruling does not create a new directive or a new reimbursement system. It clarifies how Articles 73 and 74 of the existing framework must be interpreted by national courts. The District Court in Koszalin will now resolve the specific dispute in light of the binding interpretation of EU law given by the Court of Justice.

https://2eu.brussels/ro/news/cjue-banca-trebuie-sa-ramburseze-imediat-o-plata-neautorizata-chiar-daca-invoca-neglijenta-grava-a-clientului