# CJEU ruling on bank liability for phishing fraud > Live situation record from CLSTR: https://clstr.news/situations/cjeu-ruling-on-bank-liability-for-phishing-fraud > Updated: 2026-10-22T16:32:01.000Z. Sources: 40. Developments: 3. The Court of Justice of the European Union (CJEU) issued a landmark ruling regarding the liability of financial institutions in cases of unauthorized transactions, such as phishing scams. The court determined that banks must immediately reimburse victims of fraud, even if the bank suspects the customer acted with gross negligence. Under the ruling, reimbursement must be completed no later than the end of the next business day following the report of the fraud. The court clarified that a bank cannot use a customer’s alleged carelessness as a reason to withhold funds initially. Instead, the bank must first return the money and can only seek to recover it later if it can prove the customer acted with intent or gross negligence. The burden of proof regarding a client’s negligence lies entirely with the financial institution. The only exception allowing a bank to delay reimbursement is if it possesses credible evidence that the client was a complicit participant in the fraud. In the specific case C-70/25, known as ‘Tukowiecka’, the CJEU reinforced these consumer protections. The case originated in Poland involving a PKO BP customer who lost approximately 700 euros after clicking a phishing link. This decision arrives as fraud levels rise within the European Economic Area, with banking fraud reaching 4.2 billion euros in 2024. In Spain, where consumers have historically borne approximately 80 percent of losses from transfer fraud, experts suggest banks could face potential costs approaching one billion euros when considering claims from the last five years. ## Claims - The reimbursement must be completed by the end of the next business day following the report of the fraud. (disputed by 12 sources) - The upcoming Payment Services Regulation (PSR) will grant banks a 15-day window to evaluate refund requests. (disputed by 2 sources) - The CJEU ruled that banks must reimburse victims of unauthorized transactions immediately, even if they suspect gross negligence by the client. (corroborated by 15 sources) - Banks may seek to recover funds from the client after the initial reimbursement if gross negligence is subsequently proven. (corroborated by 7 sources) - The Court of Justice of the European Union ruled that banks must reimburse fraud victims even if they were negligent. (corroborated by 6 sources) - The case originated from a Polish woman who lost 700 euros to a phishing scam. (corroborated by 4 sources) - Banking fraud in the European Economic Area reached 4.2 billion euros in 2024. (corroborated by 4 sources) - The value of banking fraud in 2024 was 17 percent higher than the previous year. (corroborated by 4 sources) ## Timeline ### 2026-10-22: Court of Justice of the EU rules banks must reimburse fraud victims The EU Court of Justice ruled that banks must reimburse fraud victims, even if the customers were negligent, potentially exposing financial institutions to massive costs. 7 sources. https://clstr.news/cluster/eu-court-rules-banks-must-reimburse-fraud-victims ### 2026-10-17: Court of Justice of the EU mandates immediate bank refunds for phishing victims The CJEU ruled that EU banks must immediately refund victims of phishing and unauthorized transactions, even in cases of gross negligence, before attempting to recover funds through legal action. 17 sources. https://clstr.news/cluster/eu-court-mandates-immediate-bank-refunds-for-phishing-victims ### 2026-10-15: European Court of Justice mandates immediate bank refunds for phishing victims The European Court of Justice ruled that banks must immediately reimburse phishing victims, even if gross negligence is suspected, shifting the burden of proof to the financial institutions. 17 sources. https://clstr.news/cluster/eu-court-rules-banks-must-immediately-reimburse-phishing-victims --- Cite as: CJEU ruling on bank liability for phishing fraud. CLSTR, https://clstr.news/situations/cjeu-ruling-on-bank-liability-for-phishing-fraud