started · updated
Court of Justice of the EU mandates immediate bank refunds for phishing victims
The Court of Justice of the European Union (CJEU) has ruled that banks must immediately reimburse victims of unauthorized payment transactions, including those resulting from phishing attacks, even if the customer is found to have acted with gross negligence.
The ruling, which stems from a case involving a Polish woman who lost approximately 700 euros to a phishing scam, establishes a ‘refund first, dispute later’ principle. Payment service providers are required to credit the stolen funds to the victim's account no later than the end of the next business day after the incident is reported.
Under this decision, banks can no longer withhold reimbursements by citing a customer's failure to protect security credentials. While banks may still seek to recover the funds from the customer if they can prove intentional fraud or gross negligence in court, the initial obligation to restore the funds remains. The only exception allowing a bank to suspend immediate reimbursement is if the institution has reasonable grounds to suspect the customer is personally committing the fraud, in which case they must notify the relevant national authority in writing.
Entities
Court of Justice of the European Union · European Union · European Union · Poland
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 3 SOURCES] Banks are now required to reimburse victims of unauthorized transactions before investigating the client's negligence. www.eldiariotorrelavega.es · pitas.com · www.moncloa.com
- [● 2 SOURCES] The Court of Justice of the European Union ruled in case C-70/25, known as ‘Tukowiecka’, regarding bank reimbursements. pitas.com · www.moncloa.com
- [● 2 SOURCES] If a bank believes a client was grossly negligent, it must first refund the money and then attempt to recover it through legal action. www.eldiariotorrelavega.es · www.moncloa.com
- [● 3 SOURCES] The only exception to immediate reimbursement is if the bank has reasonable grounds to suspect the user committed the fraud themselves. www.eldiariotorrelavega.es · pitas.com · www.moncloa.com
- [● 3 SOURCES] Reimbursement must be completed no later than the end of the next business day after the incident is reported. www.eldiariotorrelavega.es · pitas.com · www.moncloa.com
- [● 3 SOURCES] Banks may only suspend immediate reimbursement if they have reasonable grounds to suspect the customer is committing fraud. www.ilcampanile.it · www.upday.com · sapo.pt
- [● 4 SOURCES] The Court of Justice of the European Union ruled that banks must refund unauthorized payments immediately. www.ilcampanile.it · www.merca2.es · www.upday.com · sapo.pt
- [● 2 SOURCES] In cases of suspected customer fraud, the bank must notify the competent national authority in writing. www.upday.com · sapo.pt
- [● 4 SOURCES] Banks must complete the refund by the end of the next business day after notification. www.ilcampanile.it · www.merca2.es · www.upday.com · sapo.pt
- [● 4 SOURCES] Banks can seek to recover funds from customers if they prove the customer acted with intent or gross negligence. www.merca2.es · www.upday.com · sapo.pt · www.ilcampanile.it
- [● 4 SOURCES] The case originated from a Polish woman who lost 700 euros to a phishing scam. www.ilcampanile.it · www.merca2.es · www.upday.com · sapo.pt
- [● 4 SOURCES] Gross negligence by the customer does not exempt the bank from the obligation to provide an immediate refund. www.ilcampanile.it · www.merca2.es · www.upday.com · sapo.pt