< Back to all clusters
[INTERNATIONAL] · Poland, Luxembourg · 17 sources

started · updated

Court of Justice of the EU mandates immediate bank refunds for phishing victims

The Court of Justice of the European Union (CJEU) has ruled that banks must immediately reimburse victims of unauthorized payment transactions, including those resulting from phishing attacks, even if the customer is found to have acted with gross negligence.

The ruling, which stems from a case involving a Polish woman who lost approximately 700 euros to a phishing scam, establishes a ‘refund first, dispute later’ principle. Payment service providers are required to credit the stolen funds to the victim's account no later than the end of the next business day after the incident is reported.

Under this decision, banks can no longer withhold reimbursements by citing a customer's failure to protect security credentials. While banks may still seek to recover the funds from the customer if they can prove intentional fraud or gross negligence in court, the initial obligation to restore the funds remains. The only exception allowing a bank to suspend immediate reimbursement is if the institution has reasonable grounds to suspect the customer is personally committing the fraud, in which case they must notify the relevant national authority in writing.

Entities

Court of Justice of the European Union · European Union · European Union · Poland

Claims

What the coverage asserts, and how many sources carry each claim.

Sources