EUB: a bank must immediately reimburse an unauthorized payment even if it alleges gross negligence by the customer

The Court of Justice of the European Union ruled that a bank may not refuse to immediately reimburse an unauthorized transaction solely because it claims that the customer acted with gross negligence. In a case stemming from a phishing attack in Poland, the Court distinguishes between the obligation to promptly return the money and the question of who ultimately bears the loss: the bank may subsequently seek repayment if it proves the customer’s gross negligence.

A bank must, in principle, immediately reimburse the amount of an unauthorized payment transaction even if it considers that its own customer enabled the fraud through gross negligence, the Court of Justice of the European Union (CJEU) ruled on 15 October. In Case C-70/25, Tukowiecka, the Court interprets the rules of the Payment Services Directive, PSD2, so that prompt reimbursement and the final determination of who bears the loss are two distinct stages.

In brief

The payment service provider must reimburse the unauthorized transaction immediately and, at the latest, by the end of the following business day after becoming aware of the transaction or being notified of it.

Invoking the customer’s gross negligence does not allow the bank to postpone this reimbursement.

The express exception concerns situations in which the bank has reasonable grounds to suspect that the customer themselves committed fraud and communicates those grounds in writing to the competent national authority.

After reimbursement, the bank may require the customer to bear the loss if it proves that the customer intentionally or through gross negligence breached their obligations concerning the security of the payment instrument.

The judgment concerns unauthorized transactions. It does not mean that every payment made by a customer to a fraudulent merchant must automatically be reimbursed.

The dispute began after a customer of a Polish bank attempted to sell an item on an online platform. A person claiming to be a buyer sent her a fake link, apparently intended to confirm the sale. The link led her to a website imitating her bank’s page, where the woman entered her login details for online banking services. Using this information, the fraudster transferred approximately 3,000 Polish zlotys from the account, equivalent to around 700 euros.

The customer notified the bank and the police the following day. However, the bank refused to reimburse the amount, arguing that the woman had disclosed her banking details and had not properly protected her personalized security credentials. In the bank’s view, this conduct constituted gross negligence and entitled it to refuse reimbursement.

The customer challenged this interpretation before a Polish court. Sąd Rejonowy w Koszalinie, the District Court in Koszalin, asked the CJEU to determine whether Articles 73 and 74 of Directive (EU) 2015/2366 allow a bank to refuse immediate reimbursement when it considers that the loss occurred because the customer breached their security obligations through gross negligence.

The Court’s answer is negative. Article 73 of PSD2 provides that, in the case of an unauthorized transaction, the payment service provider must refund the amount immediately and, in any event, no later than the end of the following business day after identifying the transaction or receiving notification of it. Where necessary, the account must be restored to the state it would have been in had the transaction not been executed.

The Court interprets this obligation as separate from the rules determining who must ultimately bear the loss. In other words, the bank may not first resolve the dispute concerning the customer’s conduct and meanwhile retain the disputed amount. The mechanism chosen by EU legislation reverses the order: the money is first refunded under Article 73, and any subsequent disputes concerning gross negligence are resolved later.

PSD2 provides for an explicit exception to immediate reimbursement. If the provider has reasonable grounds to suspect that the customer themselves committed fraud, it may refrain from immediately reimbursing the amount, but it must communicate the reasons for the suspicion in writing to the competent national authority. The Court states that EU law does not allow this exception to be extended to a mere suspicion of gross negligence.

The distinction between fraud and negligence is essential to the ruling. If the bank claims that a customer imprudently disclosed passwords, codes or other authentication elements, this may become relevant to the final allocation of the loss, but it does not turn the customer into the perpetrator of the fraud. Only a reasonable suspicion that the payer themselves acted fraudulently triggers the specific exception to immediate reimbursement under Article 73.

This does not mean that gross negligence no longer has consequences. Article 74 of PSD2 allows a customer to bear losses resulting from unauthorized transactions if they were caused by fraud or by the intentional or grossly negligent breach of their obligations, including the obligation to protect personalized security credentials. The CJEU nevertheless states that this liability must be assessed after the initial reimbursement.

In such a situation, the bank may subsequently attempt to recover the amount. To do so, it must prove the customer’s relevant conduct and the link between that conduct and the loss. Under the PSD2 framework, the burden of proving fraud or gross negligence by the payment service user lies with the provider.

If the bank subsequently proves that the loss resulted from the customer’s gross negligence and the customer refuses to repay the amount, the provider may use the available legal procedures to recover the money. The judgment therefore moves the dispute concerning the customer’s fault to after the reimbursement stage, rather than allowing the bank to retain the money until responsibility has been definitively clarified.

The Court links this structure to the objective of protecting users of payment services. If a bank could suspend reimbursement whenever it invoked gross negligence, the customer would have to initiate proceedings themselves to recover the amount withdrawn from the account. The interpretation adopted by the CJEU places on the provider the obligation to return the money promptly and, if it considers that its own customer should bear the loss, to prove this subsequently.

The judgment does not establish that every victim of online fraud automatically receives their money back. In Tukowiecka, the national court had established that the transfer was an unauthorized transaction. This classification is important. A situation in which a criminal obtains the customer’s data and initiates the transfer themselves is legally different from one in which the customer personally authorizes the payment or transfer, even if they do so after being deceived by a fraudster.

This distinction matters for numerous forms of digital fraud. Phishing may produce different legal outcomes depending on the mechanism: in one case, the criminal steals the authentication elements and executes the transaction without the customer’s authorization, while in another, the victim is persuaded to confirm the transfer themselves. Judgment C-70/25 addresses the first issue and cannot automatically be extended to all forms of banking fraud or to every dispute concerning a payment.

The framework interpreted by the Court derives from Directive (EU) 2015/2366 on payment services in the internal market, known as PSD2, adopted by the European Parliament and the Council of the European Union. The directive harmonizes an important part of the rules on payment services, the security of transactions and liability for unauthorized transactions in the Member States.

The CJEU judgment does not create a new directive or a new reimbursement system. It clarifies how Articles 73 and 74 of the existing framework must be interpreted by national courts. The District Court in Koszalin will now resolve the specific dispute in light of the binding interpretation of EU law given by the Court of Justice.

https://2eu.brussels/ro/news/cjue-banca-trebuie-sa-ramburseze-imediat-o-plata-neautorizata-chiar-daca-invoca-neglijenta-grava-a-clientului