[CLSTR]
< Back to situation

[REVISION HISTORY]

CJEU ruling on bank liability for phishing fraud

Updated 5 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-22 21:32 UTC → 2026-10-23 07:46 UTC · added removed

The Court of Justice of the European Union (CJEU) issued a landmark ruling regarding the liability of financial institutions in cases of unauthorized transactions, such as phishing scams. The court determined that banks must immediately reimburse victims of fraud, even if the bank suspects the customer acted with gross negligence. Under the ruling, reimbursement must be completed no later than the end of the next business day following the report of the fraud. The court clarified that a bank cannot use a customer’s alleged carelessness as a reason to withhold funds initially. Instead, the bank must first return the money and can only seek to recover it later if it can prove the customer acted with intent or gross negligence. The burden of proof regarding a client’s negligence lies entirely with the financial institution. The only exception allowing a bank to delay reimbursement is if it possesses credible evidence that the client was a complicit participant in the fraud, in which case the bank must notify the relevant national authorities in writing. fraud. In the specific case C-70/25, known as ‘Tukowiecka’, the CJEU reinforced these consumer protections. The case originated in Poland involving a PKO BP customer who lost approximately 700 euros after clicking a phishing link. This ruling establishes a ‘refund first, dispute later’ principle, confirming that banks must reverse the practice of withholding funds during investigations into suspected ‘gross negligence’, effectively shifting the primary financial risk of cyber fraud onto banking institutions. This decision arrives as fraud levels rise within the European Economic Area. Data from the European Central Bank, the European Banking Authority, and the Bank of Spain indicate that Area, with banking fraud reached reaching 4.2 billion euros in 2024, representing a 17 2024. In Spain, where consumers have historically borne approximately 80 percent increase of losses from transfer fraud, experts suggest banks could face potential costs approaching one billion euros when considering claims from the previous year. last five years.

Versions

  1. 2026-10-23 07:46 UTC CJEU ruling on bank liability for phishing fraud
  2. 2026-10-22 21:32 UTC CJEU ruling on bank liability for phishing fraud
  3. 2026-10-22 15:49 UTC CJEU ruling on bank liability for phishing fraud
  4. 2026-10-18 09:11 UTC CJEU ruling on bank liability for phishing fraud
  5. 2026-10-18 02:02 UTC CJEU ruling on bank liability for phishing fraud
  6. 2026-10-17 20:26 UTC CJEU ruling on bank liability for phishing fraud

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.